Privacy policy

Last updated October 25, 2026 (privacy controls update).

This policy explains what Vibebook collects, why, who can see it, who else handles it, how long we keep it, and the choices and rights you have. It covers vibebook.crossoverlabs.ai, the profile pages we show from canvas.vibebook.crossoverlabs.ai, and the share pictures and link previews we make of profiles.

Who we are

Crossover Labs LLC ("we", "us") runs Vibebook. Crossover Labs LLC decides how and why the personal information described here is used, which makes it the "data controller" under EU and UK law.

Crossover Labs LLC, 377 Main St, West Haven, CT 06516, USA. Email: hello@crossoverlabs.ai.

The short version

Vibebook is a social network. Most of what you add is meant to be seen, and some of it stays public even if you choose Friends only. Who can see what lists it.
To build and change your profile page, our server sends what you write about yourself to an AI model run by Anthropic. It never sends your email address, password or payment details.
We don't sell your information or share it for targeted advertising. Vibebook has no analytics tools, advertising pixels or session recording.
There is no delete button for a whole account in the app yet. Email us from your account's email address and we will delete your account and what is in it.

What we collect

Information you give us

Your account. With email signup: your name, email address and password. Your password goes straight from your browser to Google Firebase Authentication, which stores it in hashed form. We never see it. With Continue with Google: your name, email address, profile picture link and Google account ID, which Google shares with Firebase when you sign in. Firebase also records when your account was created and when you last signed in. Signup asks you to confirm you are 13 or older. We check that box before any account is made, and we don't keep your answer on our servers.
Your profile. Your name (up to 40 characters), your handle, your bio (up to 160), your avatar (one of our preset pictures or a photo you upload), your choice of Public or Friends only, the vibe description you write (up to 600 characters) and each change request you send from the profile editor (up to 400 characters).
Personal details, if you add them. They are optional: your city, music, shows, hobbies, a quote, your mood, food, and what you are into right now, up to 120 characters each.
Your profile page. The page our page builder makes from your description and details. We keep the current page and your last 20 versions so you can undo a change.
What you post and do. Your posts (up to 1,000 characters, with an optional photo), comments (up to 500 characters), likes, friend requests, your friends list, and the notifications your actions create for other people, including when you send someone a profile from the share sheet. Each post, comment, friend request and notification stores a copy of your name, handle and avatar as they were at the time.
Photos. Photos you upload as your avatar, to your Photos tab or with a post, and any caption you give them (up to 140 characters). Uploads can be up to 8 MB. Our server resizes each photo, converts it to WebP, and removes hidden data such as location and camera details. We keep the resized copy and a small thumbnail, not your original file.
Credit purchases. When you buy credits, you type your card details, billing address and email on Stripe's checkout page, not on Vibebook. We tell Stripe your account email to fill in the form, and our checkout asks Stripe to keep your card on file with Stripe for future purchases. Stripe tells us the pack you bought, the amount and currency, and the checkout ID, and we add the credits. We keep your credit balance and a record of each credit you receive or spend.
Reports. When you report a profile: your account ID, the account ID of the profile you reported, the reason and any note you write.
Messages to us. If you email us: your email address and what you write.

Information collected automatically

Web server logs. When your browser loads Vibebook, our web servers record your IP address, the date and time, the page or file requested, your browser's user agent and the page that sent you.
Feature logs. For each profile build, change, undo, reset, price check and photo upload, our server logs your account ID, the time, a scrambled (hashed) form of your IP address, the first 120 characters of your description or change request, and the outcome, for example whether a safety check refused it. Photo upload logs add the file type, size and dimensions. Credit changes are logged with your account ID and new balance. Error logs can include your account ID or handle.
Price checks. While you type a vibe description or a change request, the app sends the text to our server so the button can show its price before you press it.
Rate limits. Our server holds your IP address and account ID in memory to limit how many requests can be made in a minute or a day. They are never written to disk.
Automatic freeze reports. If someone's profile page stops responding in your browser while you are signed in, the app reports that page to us once per session, with your account ID as the reporter.
Browser storage. Covered under Cookies and browser storage.

Information from others

Google, if you continue with Google (listed above).
Stripe, when you buy credits (listed above).
Other members, when they send you a friend request, like or comment on your post, send you a profile, or report your profile.

How we use it

To create your account and sign you in.
To show your profile, page, posts, photos and friends to the people your settings allow, and to run the feed, Explore search and notifications.
To build and change your profile page (see How the page builder uses AI).
To keep Vibebook safe: we check descriptions, change requests and photos before we use them, check the code of every new page, limit request rates and handle reports. A profile reported by three different members is automatically reset to the plain starter page and locked. If you think that was a mistake, email us and a person will look at it.
To sell credits and keep your balance right.
To find and fix problems and investigate abuse.
To answer your messages and requests, and to meet our legal obligations.

We don't use your information for advertising, we don't sell it, and we don't use it to train AI models.

How the page builder uses AI

Your profile page is written by an AI model from Anthropic. Our server, never your browser, sends it:

your vibe description, to check it is allowed, to price it, and, with your personal details and photo captions, to build your page;
your change request, to check it is allowed and to price it, and, with your current page (which shows your name, handle and bio), your personal details and your photo captions, to change your page;
the text you are typing in the description or change box, when the price can't be worked out without the model;
a small thumbnail (at most 320 pixels on its long side) of each photo you upload, to check the photo is allowed;
the code of each new page, to check it is safe to run.

We never send the model your email address, password, payment details or IP address. Automated checks can refuse a description, change request or photo. When that happens nothing new is saved to your profile and no credits are spent, and you can try again or email us to ask a person to look.

Who can see what

Anyone, including people who are not signed in, can see: your name, handle, avatar, bio, your friend and post counts, and whether your profile is Public or Friends only. This small public record lets people find you and send you a friend request.

Only you and our server can read your private account record: your credit balance, join date, raw profile description and change requests, search index words and internal account metadata. Search uses the index on our server and returns public profile cards, not those private fields. Your generated page may include details you asked to publish; its visibility follows your profile setting.

With a Public profile (the default), anyone can also see your profile page, your personal details, your posts, your Photos tab and captions, and share pictures and link previews of your page. Signed-in members can see your friends list and find you in Explore by your name, handle, bio, vibe description and personal details.

With Friends only, your profile page, personal details, posts written while you are Friends only, friends list and photos are visible only to you and your friends. Share pictures of a Friends only profile can be generated only by its owner. Explore finds you only by your name and handle. Switching the setting updates your existing posts too.

Always:

Comments follow both the post and the commenter. You can read a comment only if you can access its post and the commenter's profile. A Friends only member's comments are hidden from strangers, including comments on public posts. Changing Friends only applies to existing comments too.
Any signed-in member can see which members liked a post.
Friend requests are visible only to the two people in them. Your notifications, your credit history, and your email address are never shown to other members.
When you report a profile, we don't tell that member who reported them.
When you share a profile to Facebook, X, Instagram or a text message, or download its picture, that service gets what you share under its own policies.

Cookies and browser storage

Vibebook's own pages don't set cookies, and we use no advertising or analytics cookies or trackers. The app does keep these things in your browser so it works and loads fast:

Your sign-in session (Firebase Authentication, in IndexedDB), so you stay signed in.
An offline copy of pages and records the app has loaded (Firebase, in IndexedDB), so pages paint quickly. It stays in your browser after you log out, until you clear this site's data in your browser settings. On a shared computer, clear it when you are done.
A copy of your own account record (localStorage vb_me) and a signed-in flag (vb_signed_in), so your name and picture show at once. Logging out removes both.
A note that you have seen the free credits message (localStorage vb_first10).
Session storage, cleared when you close the tab: your signup progress (not your password), your conversation with the profile editor (last 40 messages), and a flag so a frozen page is reported only once.

Google, when you continue with Google, and Stripe, on its checkout page, can set their own cookies on their own websites under their own policies.

Our home page loads its fonts from Google Fonts, and profile pages can load fonts from Google Fonts when the page builder picks one. Signed-in pages also load Firebase's code from Google's servers. When that happens, Google receives your IP address and browser details.

Do Not Track and Global Privacy Control. We don't track you across other websites, sell your information or share it for targeted advertising, so these browser signals have nothing to switch off on Vibebook. If that ever changes, we will update this policy first and honor Global Privacy Control as an opt-out.

Companies that handle it for us

These companies process information for us, only to run Vibebook:

Google LLC (United States): Firebase Authentication (sign-in), Cloud Firestore (our database, stored in the United States), Cloud Storage for Firebase (photos, stored in Iowa, United States), the Firebase code your browser loads, and Google Fonts. Google's own policy: policies.google.com/privacy.
Anthropic, PBC (United States): the AI model that builds and changes profile pages and checks descriptions, photos and page code.
Stripe, Inc. (United States): the checkout page and card payments. Stripe also uses payment information under its own policy, for example to prevent fraud: stripe.com/privacy.
Hostinger: the server our website and API run on, in Boston, Massachusetts, United States. It handles every request to our website and API, and holds our logs and the share picture cache.

BLRB Digital LLC, which manages Crossover Labs LLC, holds the Stripe account our checkout uses, so it receives the details of your credit purchases from Stripe.

With other members, as set out in Who can see what.
With the companies above, only for the jobs listed.
For legal reasons, when the law requires it, to respond to valid legal process, or to protect the rights, safety or property of our members, the public or us.
For copyright notices. If you send a copyright notice or counter-notice, we may send a copy, including your contact details, to the other side, as our Copyright policy explains.
In a business change. If Crossover Labs LLC or Vibebook is sold, merged or reorganized, your information may pass to the new owner as part of that deal. We will post a notice here.

We don't sell personal information, and we don't share it for cross-context behavioral advertising.

How long we keep it

Account, profile, details, posts, comments, likes, friends and photos: while your account exists, or until you delete an item. Posts and photos you delete are removed from our database, and deleted photos are removed from storage. A photo you attached to a post also sits in your Photos tab and stays there until you delete it from that tab. Comments other members left on a post you delete stop showing but stay in our database until your account is deleted.
Copies of your name, handle and avatar on older posts, comments, friend requests and notifications stay as they were until those items are deleted.
Page versions: your last 20. Older ones are deleted automatically.
An unfinished signup: if you create a sign-in but never finish your profile, the sign-in stays until you finish or ask us to delete it.
Share pictures: we keep the latest picture of your page and delete older ones when a new one is drawn.
Reports: as long as we need them to keep Vibebook safe.
Purchase records: as long as tax and accounting law requires. Stripe keeps its own records under its own policy.
Feature and error logs: they have no fixed expiry today. We keep them only as long as we need them to investigate abuse, settle questions about credits and keep the service secure.
Web server logs: kept only for a limited time, and deleted automatically on a rolling basis as newer entries replace them.
Rate limit counters: in memory only, never written to disk, and lost whenever our server restarts.
Emails to us: as long as we need them to answer you and keep a record of the request.

When we delete an account, we delete the sign-in, account record, profile page and its versions, personal details, posts and their comments, your comments, likes, friend links and requests, notifications, photos and share pictures. We keep purchase records and logs only as described above.

Security

Every connection to Vibebook uses HTTPS.
Passwords are handled and stored in hashed form by Firebase Authentication. We never see them.
Database and storage rules check who may read and write each record. Photos have no public download links, and every photo read is checked against the owner's privacy setting.
Only our server can write profile pages, credits, reports and purchase records.
Members' profile pages run in a locked-down sandbox on a separate web address, with no access to your account.
Uploaded photos are re-encoded and stripped of hidden data before we store them, and IP addresses in our feature logs are hashed.

No method of storing or sending information is perfectly secure, so we can't promise absolute security. If a breach affects your information, we will tell you as the law requires.

Your choices and rights

In the app, any time: change your name, bio, avatar, personal details and privacy setting in Settings; rebuild, change, undo or reset your profile page; delete your posts and photos; edit photo captions; unlike; unfriend; and cancel or decline friend requests. Your handle can't be changed after you choose it.

By email: write to hello@crossoverlabs.ai from the email address on your account to:

get a copy of the information we hold about you, in a common machine-readable format;
correct anything you can't change in the app;
delete a comment, or delete your whole account and everything in it;
ask a person to review an automated refusal or a locked profile;
ask any question about your information.

Checking it's you. We act on requests sent from the email address on the account. If a request comes from somewhere else, we will ask for information that shows the account is yours before we act.

How fast. We answer within 45 days. If we need more time we will tell you why, and take at most another 45 days. Where EU or UK law applies to you, we answer within one month, which can extend by two more months for complex requests.

Someone acting for you. An authorized agent can make a request for you with your signed permission. We may still ask you to confirm your identity with us directly.

Appeals. If we decline your request, you can appeal by replying with "Appeal" in the subject line. We will answer within 45 days and explain our decision. If we still decline, you can contact your state attorney general.

No penalty. We won't deny you the service, charge you differently or give you a worse service because you used any of these rights.

California

If you live in California, the California Consumer Privacy Act (as amended by the CPRA) gives you the rights above: to know what we collect, use and disclose; to get a copy; to correct; to delete; to opt out of sale or sharing; and to limit the use of sensitive personal information. In the last 12 months we collected these categories:

Identifiers: name, handle, email address, account ID, Google account ID and IP address.
Customer records (Cal. Civ. Code 1798.80(e)): name, email address, and the billing address and card details you give Stripe.
Commercial information: the credit packs you buy and your credit balance and spending.
Internet or other electronic network activity: web server logs, feature logs and how you use Vibebook's features.
Audio, electronic, visual or similar information: the photos you upload.
Other information you post: your bio, vibe description, change requests, personal details, profile page, posts and comments.
Sensitive personal information: your account login (email address and password). We use it only to sign you in and provide Vibebook, never to infer things about you, so there is nothing to limit.

The sources, purposes and recipients are described above: we get this information from you, your browser, Google, Stripe and other members; we use it for the purposes in How we use it; and we disclose it for business purposes to the companies in Companies that handle it for us, to BLRB Digital LLC for purchases, and to other members as your settings allow. We have not sold or shared personal information, including that of anyone under 16, in the last 12 months. We don't disclose personal information to others for their own direct marketing.

Other US states

If you live in Connecticut, Virginia, Colorado, Oregon, Texas or another state with a consumer privacy law, you have the same rights to access, correct, delete and get a copy of your information, and to appeal our decision, as described in Your choices and rights. You also have the right to opt out of the sale of personal information, targeted advertising and profiling that has legal or similarly significant effects. We don't do any of those.

EU and UK

Why we use your information (legal bases):

To provide the service you signed up for (contract): your account, profile, page building, posts, photos, friends, notifications and credit purchases.
Your consent: the optional personal details you choose to add. You can remove them any time in Settings.
Our legitimate interests in keeping Vibebook safe, secure and working: safety checks, logs, rate limits, reports, freeze reports and loading fonts.
Legal obligations: purchase records for tax and accounting, and answering lawful requests.

Your rights. You can ask to access, correct, delete, restrict or get a portable copy of your information, and you can object to uses based on our legitimate interests. Where we rely on your consent, you can withdraw it at any time. Our automated checks can refuse a description, change request or photo, but they don't make decisions with legal or similarly significant effects about you, and you can ask a person to review one. You can also complain to the data protection authority where you live or work (in the UK, the Information Commissioner's Office).

International transfers. Vibebook is run from the United States, and your information is stored and processed there. Where our providers move personal data out of the EU or UK, they do so under their data transfer terms, such as the European Commission's Standard Contractual Clauses.

Children

Vibebook is for people 13 and older. Signup requires you to confirm you are 13 or older before any account is made, and we don't knowingly collect information from children under 13. If you are a parent or guardian and believe a child under 13 has an account, email us with their handle and we will delete the account and everything in it. If we learn on our own that a member is under 13, we delete their account.

Changes to this policy

Vibebook doesn't send email, so when we change this policy we post the new version on this page and update the date at the top. If a change would let us use information we already hold in a materially different way, we will ask for your consent first.

Contact

Email hello@crossoverlabs.ai with any question or request about your information, or write to Crossover Labs LLC, 377 Main St, West Haven, CT 06516, USA. Copyright questions go to our Copyright policy.