VibePen Privacy Policy

Effective date: 14 August 2026

This policy explains what Enthusiast, LLC ("VibePen", "we", "us") collects when you use vibepen.io and the Pen sandbox domain (currently twilityapp.com), why we collect it, who we share it with, and what you can do about it.

We have written it against what the software actually does. If you find something here that does not match how the Service behaves, tell us at dustadk@gmail.com and we will fix one or the other.

The short version. We collect very little. The only cookies we set are the ones that keep you signed in, and Section 3 covers browser storage in full, including what we do and do not run there. Visitors who are not signed in are counted using a hash that rotates every day and cannot be linked back to an IP address or across days. The one disclosure that surprises people is in Section 4: URLs found inside published Pens are sent to Google Safe Browsing to be checked.

---

1. Who is responsible#

Enthusiast, LLC, 1109 Davenport Blvd 301, Franklin, TN 37069, United States, is the controller of the personal data described here. Contact: dustadk@gmail.com.

2. What we collect#

2.1 Account data#

When you create an account, our authentication provider (Neon Auth, running Better Auth, on our Neon Postgres database) records your email address, your name as supplied, your password hash or the identifier of the identity provider you signed in with (for example Google), and session and sign-in records.

VibePen's own account table separately holds: an internal account identifier; a username derived from your email address at first sign-in; your display name; a link to your authentication identity; your plan; the date you joined; and, if applicable, the fact and reason of a suspension. We do not store your email address in VibePen's own tables — it stays with the authentication provider.

Your username and display name are public.

2.2 Content you publish#

Everything in a Pen: the files and their contents, the title, description, optional prompt text, visibility, and the complete version history. Versions are immutable and are kept, including after you delete the Pen (Section 6). Where our ingestion rewrites references to third-party JavaScript CDNs, we keep both what you uploaded and what we serve.

Anything you put in a Pen becomes what you made it: files in a public Pen are public, including any personal information you place in them.

2.3 Agent authorization data#

Agent access tokens and OAuth client registrations are stateless signed values. We do not keep a table of tokens, clients or authorization codes; the token itself carries the account identifier, its scopes and its expiry. When an agent publishes, the resulting Pen and its rate-limit records are attributed to your account in the ordinary way.

2.4 Engagement events#

For public Pens we record that a view, copy or download happened, on which day. Each event stores a visitor key: a SHA-256 hash of a server secret, the calendar day, and either your account identifier (if signed in) or your IP address and user-agent string (if not).

• The hash is one-way. We do not store IP addresses or user-agent strings in this table.

• Because the day is part of the input, every key changes at midnight UTC, so events cannot be joined into a profile of one person over time.

• One event per visitor, per Pen, per kind, per day. Authors' own activity and obvious bot traffic are discarded before anything is written.

We use this only to rank trending Pens and to show authors how their Pens are doing.

2.5 Abuse reports#

When someone reports a Pen we store the category, whatever they wrote, the time, the reporting account identifier if they were signed in, and a reporter key built the same day-rotating way as the visitor key. Reports are retained after they are resolved, including dismissed ones, as the record of what was looked at.

2.6 Security and integrity records#

• Scan records. For every published version: the external hostnames it references, the findings of our static heuristics, a score, and which URL reputation service ran.

• Content Security Policy violation reports. When a Pen tries to do something the sandbox forbids, the browser reports it to us: the Pen's identifier, which rule refused, the origin it tried to reach, and the file inside the Pen it came from.

• Rate-limit events. For each publish or report: a bucket name, a timestamp, and a subject, which is either an account identifier or a salted hash of an IP address — never the address itself.

• Moderation audit records. For every action an operator takes: who took it, what changed, when, and the reason they wrote.

2.7 Technical logs#

Our hosting provider processes network-level information needed to deliver and protect the Service, including IP addresses and request metadata, and retains short-lived operational logs. Our application writes diagnostic logs, which may incidentally contain identifiers such as a Pen id or an account id.

2.8 Correspondence#

If you email us, we keep the message and our reply.

2.9 What we do not collect#

Advertising, analytics, tracking and anything else we might run in your browser are covered in Section 3.2, in one place. Beyond that: we do not accept binary uploads. We do not currently process payments and we do not hold payment card data. We do not sell personal information, and we do not "share" it for cross-context behavioural advertising as those terms are used in California law.

3. Cookies and other browser storage#

If you are not signed in, we set no cookies at all.

3.1 The cookies we set#

All three are set by Neon Auth on vibepen.io and carry the __Secure-neon-auth prefix, so you can find them in your browser's developer tools. Every one of them is strictly necessary: it exists to keep you signed in to a session you asked for, and it expires on its own.

3.2 Analytics and anything else non-essential#

There is none. We run no analytics service, no advertising network and no tracking pixels; we set no cookie that is not in the table above; and we use no local storage, session storage or other browser storage of our own.

Because everything in Section 3.1 is strictly necessary, we do not ask you for cookie consent and we do not show a cookie banner — there is nothing to consent to. If that ever changes, this section is where it will be described: what the thing is, what it stores and for how long, and who receives it. For visitors in the EEA and the UK we would ask for consent before anything non-essential is set, not after, and make refusing as easy as agreeing.

3.3 Cookies and Pens#

Pens are served from a separate registrable domain precisely so that Pen code never receives VibePen cookies. Pens themselves may set their own storage in your browser under the sandbox domain; that is the Pen's doing, not ours, and it is isolated to that Pen's own origin.

4. URLs from Pens are sent to Google Safe Browsing#

This is the disclosure most likely to matter to you.

When a Pen is published, we extract the external URLs it references and send them to the Google Safe Browsing Lookup API to check whether any is a known phishing, malware or unwanted-software destination. This means those URLs leave our systems and are processed by Google under Google's terms.

• What is sent: URLs found in the published files. Nothing else — no account identifier, no IP address, no file contents.

• Why: a Pen linking to a known-bad destination is one of the few signals we can act on automatically. A match quarantines the Pen pending human review.

• Note that a URL can itself be information. Do not put a URL you consider private into a Pen.

The check applies to Pens of every visibility, including unlisted ones, because it runs at publish time.

5. Why we process your data, and on what legal basis#

For users in the EEA and the UK, our bases under the GDPR are:

6. How long we keep things#

7. Who we share data with#

We do not sell your data. We share it only with the providers that run the Service, and where the law requires.

These providers are United States companies. Your data is processed in the United States and, for content delivery, at edge locations worldwide.

We may also disclose information where we believe in good faith that it is required to comply with law or a valid legal request, to enforce our Terms, to investigate suspected abuse or fraud, or to protect the rights, property or safety of our users, of VibePen, or of the public. If we are involved in a merger, acquisition or sale of assets, account data may transfer as part of that transaction; we will notify you before it becomes subject to a different privacy policy.

International transfers. We operate from the United States, and using the Service means your data is processed there. Where we transfer personal data out of the EEA or the UK, we rely on the European Commission's Standard Contractual Clauses, together with the UK International Data Transfer Addendum where the UK GDPR applies.

8. Your choices and rights#

Everyone can:

• Delete any Pen at any time, which makes it unreachable on the Service, or publish a new version of it through your agent. Earlier versions are kept either way (Section 2.2).

• Change a public Pen to unlisted (subject to your plan). Note that this stops future distribution by us; it cannot undo copies other people already made under the public licence — see Section 6 of the Terms.

• Stop an agent's access. Agent tokens expire on their own (30 days by default). There is no self-service revocation yet: if a token is compromised, write to dustadk@gmail.com and we will invalidate it.

• Ask us to close your account by writing to dustadk@gmail.com.

Account closure. There is no self-service closure; we do it by hand when you ask. Deletion on the Service is a withdrawal from publication rather than an erasure from the database — nothing here is ever hard-deleted — so it is worth being exact about what closing an account does:

• Your Pens stop being reachable. Each one is withdrawn from the gallery, search, trending, your profile, your dashboard, its own page and its sandbox origin. The rows stay (Section 6).

• Your authentication identity is deleted. That is where your email address, your password hash and your sign-in records live (Section 2.1), and deleting it is what removes them.

• Your account record is stripped, not dropped. We clear the username and display name that made it identifiable. The row itself remains, because every Pen you published, every report you filed and every moderation action taken points at it; removing the row would take those records with it.

• The record of what was published, and of anything we did about it, is kept. Version records, abuse reports, scan results and moderation audit rows are retained. A moderation log that can be erased by closing the account it concerns is not a record of anything.

If you want erasure beyond that, say so when you write to us: we will tell you what we can remove, what we cannot, and why. Where privacy law gives you a right to erasure we will go as far as the retention above allows, and be specific about where it stops.

If you are in the EEA or the UK, you have the right to access, correct, delete and port your personal data, to restrict or object to processing based on legitimate interests, and to complain to your local supervisory authority. Where we rely on legitimate interests, you can object at dustadk@gmail.com and we will weigh your objection against the reason for the processing. Note that we may decline erasure of moderation and abuse records where retaining them is necessary for the safety of the Service or to establish or defend legal claims.

If you are in California, you have the right to know what personal information we collect and how we use it (this policy), to delete it, to correct it, and not to be discriminated against for exercising those rights. We do not sell or share personal information as those terms are defined by the CCPA/CPRA, and we do not process sensitive personal information for purposes requiring an opt-out. Requests: dustadk@gmail.com.

Verification. We verify a rights request by requiring you to send it from the email address on the account, or to demonstrate control of the account.

9. Security#

Pen code runs on a separate registrable domain from the application, on a distinct opaque subdomain per Pen, inside a sandboxed frame under a default-deny content security policy. It cannot reach VibePen cookies, sessions or account data, cannot make network requests to third parties, and cannot post forms off-origin. Agent tokens are signed and scoped. Access to the operator console is limited to a named allowlist and every action it takes is audited.

No service is perfectly secure. If you find a vulnerability, please write to dustadk@gmail.com rather than testing against other people's content.

10. Children#

The Service is not directed to children under 13, and we do not knowingly collect personal information from them. If you believe a child under 13 has given us personal information, write to dustadk@gmail.com and we will delete the account and its data. See Section 2.1 of the Terms for minimum-age requirements, which are higher in some countries.

11. Changes#

We will post any change here with a new effective date, and give notice through the Service before a material change takes effect.

12. Contact#

Enthusiast, LLC 1109 Davenport Blvd 301, Franklin, TN 37069 dustadk@gmail.com