Privacy
Privacy policy
What we collect when you use Vibrometer, why, who handles it for us, how long we keep it, and how you can see, change or delete it.
I. Who we are
Vibrometer (vibrometer.ai) is run by Sieve Data Inc., a Delaware corporation, 169 Madison Ave, Ste 15119, New York, NY 10016, USA. We decide how your personal data is used (we are the “controller” under the GDPR and the UK GDPR).
Write to us about privacy, and send any privacy or legal notice, to notices@usesieve.com. We have not appointed a data protection officer.
II. The short version
- Your vibe check is worked out in your browser. Your conversations leave it only when you choose to add your vibe check to the boards, and a sample of up to 40 of your prompts, with secrets, links and paths removed, goes to our AI provider to write your vibe type.
- When you upload conversations, our server measures them and then deletes them. It keeps a redacted copy only if you tick the optional box that allows it, and you can withdraw that later.
- We keep the numbers measured from your conversations, your account and the profile you choose to fill in. Your handle, profile and numbers appear on the boards and on links you share. If you say you’re open to work, only employers we have given access see your candidate profile.
- We measure how the site is used with our own analytics. We use no advertising or tracking cookies, and by default store nothing in your browser for analytics.
- The site loads its fonts from Google Fonts, so Google receives your IP address and browser details when a page loads.
- We don’t sell your data, and we don’t use it for advertising.
- You can delete your account and data yourself, at any time, from your account page.
III. What we collect, why, and on what basis
Each row is one kind of data. The legal basis is the reason the GDPR lets us use it. How long we keep each is in How long we keep it.
| Data | What it is and why we use it | Legal basis |
|---|---|---|
| Conversations you analyse | You pick Claude Code or Codex transcripts on the analyse page. They are read and measured in your browser; nothing is sent while you do this. A summary of each conversation (date, project folder name, first prompt, measurements) is kept in your browser only, for the extras. | Not received by us |
| Prompt sample for your vibe type | To write your vibe type, your browser sends us your measurements and percentiles, when you work (time of day, weekdays), and up to 40 of your prompts, each cut to 280 characters, with secrets, email addresses and links removed and file paths cut to the file name. We pass them to our AI provider for that one request and don’t store them. We keep the vibe type that comes back on your account if you’re signed in. If you choose Private (numbers only) on the analyse page, or use the CLI’s --private, none of this is sent and you get no vibe type. | Contract: to provide what you asked for (Art. 6(1)(b) GDPR) |
| Conversations you upload to the boards | When you choose to add your vibe check to the boards (on the site, with the CLI or the Claude Code plugin), the conversations you pick are shortened and redacted on your device (long tool output cut, working folders and branches dropped, home folders in file paths replaced with ~, keys, tokens and emails masked), then sent to us. Our server shortens home folders again as they arrive, in case an older app version didn’t. Our server checks they are genuine, measures your habits, and deletes them. We keep the measurements, the check’s result, the conversations’ IDs (so two accounts can’t claim the same one) and what you agreed to. | Contract: to provide what you asked for (Art. 6(1)(b) GDPR) |
| Redacted copies (optional) | Only if you tick Let Vibrometer and its partners use these conversations, with secrets and identifiers removed, to improve their services: we keep a compacted, redacted copy of that upload’s conversations to improve Vibrometer and its scoring and for research, and may share de-identified data with partners for the same purpose. | Your consent (Art. 6(1)(a)), which you can withdraw at any time |
| Research use of your numbers (optional) | Only if you tick Let Vibrometer use the numbers measured from this upload (never the conversations themselves) to study which habits lead to better results, and publish findings that can’t identify anyone: we use that upload’s measurements (never its conversations) to study which habits lead to better results, and publish aggregate findings in which no group smaller than 5 people is shown. | Your consent (Art. 6(1)(a)), which you can withdraw at any time |
| Your answer to the outcome question (optional) | After a vibe check whose upload allows research, we may ask once: How did your recent coding sessions go?The answer is kept with that upload, used only for research, and never shown publicly. You can skip it. | Your consent (Art. 6(1)(a)), which you can withdraw at any time |
| Account | Your email address (when you sign in with a one-time code sent by email), your handle, how you sign in, and hashed sign-in tokens for your browser and the CLI. We use them to sign you in and keep your vibe check, groups and credits on your account. Emails we send are sign-in codes only. | Contract: to provide what you asked for (Art. 6(1)(b) GDPR) |
| Profile (optional) | Display name, school, city, region, country, major, graduation year, role and GitHub username, if you add them, and whether you’re open to work. Your name, school, city, major and country appear next to your handle on the boards and in cohort comparisons. If you’re open to work, your whole profile, including your role, graduation year and GitHub username, is shown on the Patrons page to employers we have given access, and to no one else. | Contract: to provide what you asked for (Art. 6(1)(b) GDPR); “open to work” on your consent, which you can turn off in your profile |
| Olympiad | Your entries: when you started, the code you submitted, the challenge’s test results, time, turns and tokens, and the questions you put to the challenge’s stakeholder and the answers (questions go to our AI provider to be answered). The session log you submit is graded and then deleted, unless you allowed redacted copies. | Contract: to provide what you asked for (Art. 6(1)(b) GDPR) |
| History of vibe checks | Each vibe check kept on your account (made in the browser, from an upload, or numbers only) is also kept in your history: its measurements, its vibe type, how many conversations and prompts it covered, when the first and last of them started, and your habits per day, week, month, quarter and year. These are numbers only, with no prompts, project names or conversation IDs. We keep the latest 100. | Contract: to provide what you asked for (Art. 6(1)(b) GDPR) |
| Groups, credits and referrals | The groups you start or join, your credits and what you unlocked, and who referred whom. | Contract: to provide what you asked for (Art. 6(1)(b) GDPR) |
| Feedback | What you write with the Feedback button, your email only if you ask us to reply, your account if signed in, and (unless you turn it off) the page, browser, screen size and recent error messages. It is posted to our team’s Slack. Our team reads it, helped by an AI assistant (Claude, by Anthropic) that triages reports without your email or account. | Legitimate interest (Art. 6(1)(f)): fixing and improving the service |
| Usage analytics | Which pages and features are used, in which country, region and city (from our content delivery network), on what kind of device, and where visits come from. To count visitors without cookies, our server combines a shortened IP address (IPv4 /24, IPv6 /48) and your browser’s user agent with a random value that changes every day and is then deleted, so we can’t recognise you from one day to the next. If you’re signed in, your activity is linked to your account. No prompts, file names or emails are recorded. | Legitimate interest (Art. 6(1)(f)): understanding and improving the service |
| IP addresses and security logs | Your full IP address is kept for 30 days for abuse investigation, with a shortened form and a monthly-salted hash on analytics records. Our hosting keeps access logs (IP address, time, address requested, browser) for 90 days. Rate limits hold your IP address for at most 2 days. | Legitimate interest (Art. 6(1)(f)): keeping the service secure and preventing abuse |
| New sign-ups | When you create an account we record how you signed up, your coarse location, your network (the organisation that owns your IP address and its network number, as reported by our content delivery network), your IP address, browser language, timezone, screen size, platform and user agent, how you found us, and your vibe check’s size, agent and vibe type. A message with your handle, email, location, IP address, network and these facts is posted to an owner-only Slack channel. | Legitimate interest (Art. 6(1)(f)): understanding who signs up and preventing abuse |
We don’t make decisions about you that have legal or similarly significant effects by automated means alone. Scores, vibe types and rankings are computed automatically; they describe how you work with coding agents and are not an assessment of your ability. Employers who use the Patrons page make their own decisions.
IV. What other people can see
- Share links (
/v/…,/vs/…) contain your handle and habit measurements in the link itself. Anyone with the link can see them. They ask search engines not to index them, and links you already sent keep working after you delete your account, because the numbers are in the link. - The boards (the Pantheon and the Olympiad standings) show your handle and, if you filled them in, your name, school, city, major and country, with your measurements or results, once our server has checked your upload or graded your entry. Cohort figures (by school, city or major) are shown only for groups of at least 3 people.
- Groups: members see each other’s handles and measurements.
- Patrons (for employers): if you turn on “open to work”, your handle, name, school, city, major, country, role, graduation year, GitHub username, measurements and Olympiad results are listed on the Patrons page. Only employers we have given an access code can see that list. It is not public, not in the data the site sends to other visitors, and not shown to search engines. What the boards show about you (above) stays as it is. Turn “open to work” off in your profile at any time, and you leave the list.
- Your email address is never shown to anyone else.
V. Who processes it for us
These companies process data on our behalf, under contracts that limit them to doing so. We don’t sell personal data or share it for advertising.
| Who | What for | Where |
|---|---|---|
| Amazon Web Services | Hosting, database, file storage, the content delivery network (CloudFront), email delivery for sign-in codes (Amazon SES), and the grading queue | United States |
| AI provider | Writing vibe types, answering challenge stakeholder questions: Amazon Bedrock (Amazon Web Services), which runs the model inside AWS. Under these services’ terms, what we send isn’t used to train models. | United States |
| Slack | Team notifications: new sign-ups and feedback reports | United States |
| Anthropic (Claude) | An AI assistant that helps our team triage feedback reports and work on the code. Report text is passed to it without your email or account. | United States |
| Google Fonts (Google) | Serves the site’s typefaces. Every page loads its fonts from Google Fonts, so Google receives your IP address and browser details (such as the user agent and the page that asked for them) when the page loads, under Google’s own privacy policy. | United States |
We don’t send IP addresses to any outside lookup service at present. We may disclose data if the law requires it, or to protect the service and its users.
Besides the companies named above, we share information with service providers and partners as needed to operate, secure, provide and improve the service, under appropriate contractual protections, and as required by law. We don’t sell it, and we don’t share it for advertising.
VI. Where your data is
Sieve Data Inc. is based in the United States and processes data there: we store and process it in the United States (AWS region us-east-1, Northern Virginia). If you are in the EU/EEA, the UK or Switzerland, your data is transferred to the United States. Where our service providers transfer personal data from the EU/EEA, UK or Switzerland, they rely on the European Commission’s Standard Contractual Clauses (and the UK International Data Transfer Addendum) or other lawful mechanisms. Write to notices@usesieve.com for more about these safeguards.
VII. How long we keep it
| Data | Kept for |
|---|---|
| Conversations you upload | Deleted as soon as they are measured. Uploads that were started but never finished are deleted within 1 day. |
| Redacted copies (optional) | Until you withdraw the opt-in or delete your account, and 730 days at most |
| Prompt sample for your vibe type | Not stored: used for one request |
| Measurements, vibe type, profile, groups, credits, Olympiad entries and code | Until you delete them or your account |
| History of vibe checks | Until you clear your history or delete your account; only the latest 100 are kept |
| Research consent and outcome answers | With the upload, until you withdraw the opt-in (which clears the answer) or delete your account. Research exports are deleted when an analysis is done and re-made rather than kept, so a withdrawal applies from the next export. |
| Account and email address | Until you delete your account |
| Browser sign-in | 365 days, or until you sign out |
| CLI and plugin sign-in | 365 days, or until you sign out with the CLI |
| Sign-in codes | 10 minutes |
| Analytics records | 13 months; daily totals without personal data after that |
| Full IP addresses (abuse log, sign-up record) | 30 days |
| Access logs (hosting) | 90 days |
| Rate-limit records | 2 days at most |
| Sign-up facts (except the IP address) | Until you delete your account |
| Feedback reports | Until we no longer need them to fix or improve the service. When you delete your account, your account, handle and email are removed from them. |
| Application logs (no conversations or prompts) | 14 days |
| Database backups | 7 days, after which deleted data is gone from them too |
| Slack messages | As long as our Slack workspace keeps messages, and no longer than we need them to act on the sign-up or report |
IX. Your rights and how to use them
Wherever you live, you can:
- Delete your account and everything linked to it, straight away, from your account page (“Delete my account and data”).
- Withdraw the optional choices for all your uploads at once from your account page: redacted copies are deleted, and research use stops from the next export. Withdrawing doesn’t affect what was done before.
- Correct your profile or turn off “open to work” on your account page.
- Ask us at notices@usesieve.com for a copy of your data (in a portable format), to correct or erase it, to restrict how we use it, or to object to uses based on our legitimate interest, such as analytics.
We answer within one month, and may ask you to confirm the request from the email address on your account. If you are in the EEA or UK and think we have got something wrong, you can complain to your data protection authority, though we’d like the chance to fix it first.
US residents: we don’t sell personal information or share it for cross-context behavioural advertising, and we don’t use sensitive personal information to infer characteristics about you.
X. Children
Vibrometer is not for anyone under 16. We don’t knowingly collect data from children under 16. If you believe a child has an account, write to notices@usesieve.com and we will delete it.
XI. Security
Data travels over HTTPS and is encrypted at rest. Sign-in tokens and codes are stored only as hashes. Uploaded conversations are redacted on your device before they are sent, and we strip common secrets, but we can’t recognise everything: only upload conversations you are comfortable sharing. If we learn of a breach that affects you, we will tell you and the authorities as the law requires.
XII. Changes to this policy
When we change this policy, we update the date and version at the top. If a change is significant, we will tell you on the site or by email before it applies. A new use of your conversations or numbers will always ask for your consent first; what you agreed to with an earlier upload stays as it was. The upload statements you see now are version 2026-11-13.
XIII. Contact
Sieve Data Inc., a Delaware corporation, 169 Madison Ave, Ste 15119, New York, NY 10016, USA. Privacy requests and notices: notices@usesieve.com. Anything else: hello@usesieve.com.