Your workspace stays yours.

About the developer

Vibeforge is provided by Nevin Abraham, a solo developer (“I”). This policy applies to the Vibeforge Windows app and this website. For privacy questions, contact nevinabraham77@gmail.com.

Data on your device

The app stores selected project folders, coding agents, pane layout, and chat session identifiers in a local settings file. Interface preferences such as theme, font, shortcuts, notifications, and selected metrics are also stored locally.

Account details, session tokens and the signed offline licence are saved in %LOCALAPPDATA%\MultiCodeTerminal\account.dat, protected with Windows Data Protection API (DPAPI) for the current Windows user. Signing out removes this saved account file, not your online account or billing. Browser sign-in and checkout may leave cookies or session data under the relevant provider’s controls.

Session details read supported local agent metadata, such as the selected model, context and token usage, timing, tool activity, session identifiers, and reported or estimated cost. Temporary captures contain selected metadata rather than prompts or credentials. Local checkpoints and agent handoff records are created when you request them and remain on this computer.

The Dashboard stores daily activity totals locally, including project paths, agent and model identifiers, working and idle time, available token and tool counts, and successful in-app Git actions. It does not store prompts, source code, credentials or commit messages in its analytics file. Activity is retained for up to 365 days, subject to storage limits. You can export the filtered totals to a CSV file you choose. To remove local Dashboard data, close the app and delete %LOCALAPPDATA%\MultiCodeTerminal\dashboard.json; tracking starts fresh on the next launch. Exports stay where you save them; the app does not upload them.

The file explorer and editor read files from folders you select. The editor writes a file when you save it. The app reads local chat archives created by supported coding agents, including compatible chats made in VS Code extensions, to show history and resume a session. Those archives remain in the agent’s own location; the app does not upload them to a Vibeforge server.

Source Control reads the selected folder’s local Git status and commit history. The app can stage files, create commits, initialize a repository, or change its origin remote when you request those actions. The app does not automatically push project files.

Accounts and identifiers

Supabase provides authentication, the account database and server functions for licences and billing. It processes your email, account ID, authentication/session records and, when supplied by Google sign-in, display name and profile image. Email/password authentication, emailed verification codes and password recovery are handled by Supabase. Google sign-in is also subject to Google’s privacy policy.

The service stores your plan, trial and paid-access dates, early-user number, gift eligibility and billing status/identifiers. The app sends a stable SHA-256 device identifier derived from the Windows machine ID (or computer name as a fallback). The original value is not sent; this persistent hash is not anonymous data. It binds an offline licence to a PC and limits repeat trials and gifts. Normalized email addresses (including removal of certain aliases) also prevent repeat claims. The first 15 eligible early users receive free Lifetime access without a payment method.

Network requests expose IP addresses and request metadata to the receiving infrastructure. The account service uses hashed rate-limit keys derived from IP addresses, emails or account IDs to limit abuse. Infrastructure/error logs can also contain request information. Your Windows country/region setting is sent for localized pricing and checkout; GPS location is not collected for pricing.

I use this data to deliver and secure accounts, licences and purchases, prevent abuse and answer support requests. Where a legal basis is required, these purposes relate to providing the service you request, legitimate interests in security/fraud prevention and applicable financial/legal obligations. Supabase processes app account data on my behalf; see its privacy information and data processing terms.

Payments and billing

Dodo Payments is the merchant of record for purchases through the app’s browser checkout. Vibeforge sends your email/name or existing customer ID, selected product, account ID, checkout-attempt reference, applicable discount and country/region. You enter payment and required billing/tax details directly at Dodo’s checkout. Vibeforge does not collect or store full payment-card numbers or card security codes.

Dodo sends payment, subscription, refund and dispute updates to the account service. Stored billing records include customer, payment, subscription, checkout and event IDs, amounts, timestamps, and payment/refund/dispute/cancellation status. They grant the right access, prevent duplicate charges, reconcile delayed events, retry failed cancellation and support billing enquiries. Prompts and project files are not needed for this process.

Monthly subscriptions renew until cancellation is confirmed. Use Cancel subscription or Manage billing in Account settings. A Lifetime upgrade requests monthly cancellation; pending or failed attempts are retried and shown in the app. Do not assume renewal has stopped while confirmation is pending. Cancellation normally preserves access to the paid-through date and is not a refund. Signing out, uninstalling or requesting account deletion is not a substitute for confirming cancellation. See Terms and Refunds and support.

Dodo controls its own transaction, fraud, tax and regulatory processing as merchant of record. Its privacy policy and buyer terms explain its practices and rights procedures. Providers may process data outside your country, including through service providers; their terms describe applicable transfer safeguards.

When data leaves your device

Coding agents. When you use an installed coding CLI, the app runs that CLI in the project you selected. Your prompts, relevant project content, and conversation data may be sent by that CLI to its provider under the provider’s account settings and privacy terms. The exact data depends on the CLI and what you ask it to do. Vibeforge does not route prompts through its own hosted service.

Usage metrics. Account limits are checked when you open or refresh the Metrics panel, or explicitly refresh them in session details. For Claude Code, the app reads the locally stored Claude access token and sends it to Anthropic’s usage endpoint. Other supported agents use their installed CLI or locally authenticated usage service. The app displays the result and does not store the access token in its own settings. Session details do not send extra model prompts to collect usage.

GitHub. If you use GitHub sign-in or browse repositories, Git Credential Manager and GitHub handle authentication; the app may use a credential from Git Credential Manager to request your repository list from GitHub. A Git push sends the commits you select to the configured remote using Git and its credentials. Connecting a folder to a repository only sets its remote URL; it does not push files by itself.

Updates and links. When you click Check for updates in a build with a release channel, the app requests release information from GitHub. Opening a provider’s documentation, an installer page, or a release page opens your browser and is subject to that site’s practices.

Review the terms of each coding agent, GitHub and Git remote you use. The optional Ko-fi support link opens Ko-fi, whose privacy and payment practices apply. Workspace content is not sent to Supabase or Dodo for account or billing checks.

This website

This website is hosted on Firebase Hosting. It does not ask you to create an account, submit a form, or provide project files. I have not added cookies, analytics scripts, or advertising trackers to it. Firebase Hosting processes request information such as IP addresses to deliver the site and detect abuse. See Firebase’s privacy and security information.

Retention and control

Your app settings remain on your device until you remove them. Uninstalling the app does not delete the saved settings file or chat archives maintained by your installed agents. Vibeforge retains the original data location, %LOCALAPPDATA%\MultiCodeTerminal\, to preserve existing workspaces. After closing the app, deleting that folder resets app choices and removes app-owned checkpoints and handoff records. Agent chat archives remain in the agents’ own locations.

Online accounts and licences remain while your account is maintained, including to verify Lifetime access. Cancellation does not delete them. There is no automatic expiry timer for these database records; deletion requests are handled manually below.

Trial and gift records (normalized email, device hash, claim date, early-user number and gift flag) can remain after account deletion to prevent repeat claims and preserve eligibility while these programmes operate, where permitted by law. They are identifying records, not anonymous statistics. You may request review or object to their retention.

Billing events, refunds, disputes, cancellation history and abuse-prevention counters also have no automatic database deletion schedule at present. Retention is reviewed on a verified request, considering outstanding payments/disputes, fraud prevention, entitlement verification and accounting/legal requirements. Unneeded data can be deleted or stripped of identifying details. Dodo retains its own transaction records under its policy and legal obligations; I cannot promise erasure of records it must keep.

Logs, backups and support messages have separate retention. Deleted live records may remain in provider backups until those backups expire under the provider’s configuration; deletion is not instant erasure of every backup. Support emails remain while needed for follow-up or legal obligations. To delete agent chats or GitHub data, use those providers’ own tools and account controls.

Deletion and your rights

For access, correction, export or deletion, email nevinabraham77@gmail.com, preferably from your account email. Say what you want removed or corrected; an order reference helps with billing. I may verify account control before acting. Do not send passwords, sign-in codes, full card details or private project files. There is currently no in-app account-deletion button.

For deletion, I review active subscriptions with you, confirm cancellation or unresolved billing first, and remove the account and associated personal records that do not need to be retained. I explain retained categories and reasons. Deletion can remove purchased or gifted licence access; discuss this or request an export first if needed. Local files and accounts with Google, coding agents or GitHub are not deleted. Dodo may need a separate request for records it controls; I can help route it.

Depending on applicable law, you may also restrict/object to processing, withdraw consent where relied upon, or complain to your local data-protection authority. Requests are handled without undue delay and within applicable legal time limits. Some data is needed to provide an account/licence, and some retention is required or permitted by law. I do not sell personal data or use account/billing data for advertising profiling.

Security

Account/payment requests use HTTPS. Local account tokens are protected with Windows DPAPI, licences are digitally signed, and server-side access controls restrict account and private billing records. Project files rely on Windows permissions and installed tools’ controls. Firebase Hosting serves this policy over HTTPS. No system can guarantee absolute security; use agent permissions and approvals for sensitive projects.

Changes to this policy

I may update this policy when the app or website changes. The date at the top of this page will show when it was last revised. Material changes will be reflected here before or when the related feature is released.

Contact

For privacy questions or requests, email nevinabraham77@gmail.com. Please do not include passwords, access tokens, or private project files in your message.