Privacy Policy

Last updated: 2026-10-01

1. Who we are

myvibecode.app is a service of OrgOps GmbH, Kleestraße 21–23, 90461 Nürnberg, Germany (see Legal Notice) — the controller within the meaning of the GDPR. Questions: mail@orgops.io

2. What data we collect

For a free account we collect only your email address — entered when you request a login link. No passwords, no tracking pixels, no analytics.

If you buy a paid plan (e.g. a custom subdomain), the payment is handled by our payment provider Polar (see §5). Polar collects the data needed to process the sale and issue an invoice — your name, billing address, country, and where applicable VAT ID and payment details. We never see or store your card data; from Polar we only receive back your email, the purchased product, the amount, and which app the purchase belongs to, so we can unlock the feature.

3. How we use it

  • To send you a magic link so you can sign in
  • To notify you when your account is activated from the waitlist
  • To associate your apps and deployments with your account
  • To send you invitations and service notifications about your apps (e.g. storage or custom-domain warnings)

4. Your app data

Source code you push is stored in a private repository on our self-hosted GitLab instance. Your apps and their databases run on Hetzner Cloud servers in the EU — in Falkenstein and Nuremberg (Germany) and Helsinki (Finland). Each app gets its own database with its own credentials in a shared PostgreSQL cluster on this infrastructure; backups are stored in Hetzner Object Storage.

If your coding agent uses the optional Platform Brain, your question and excerpts of your app's deployed source code are processed by our own LLM server (llm.orgops.io), which we operate ourselves — no third-party AI provider is involved, and the Brain has no access to your app's database.

For personal data that your apps process (e.g. data of your app's users), you are the controller and we act as your processor. This is governed by our Data Processing Agreement (German: Auftragsverarbeitungsvertrag), which is part of our Terms of Service. See also our technical and organisational measures and the full list of sub-processors.

5. Infrastructure & sub-processors

  • Hetzner Cloud (Hetzner Online GmbH, Germany; data centres in Germany and Finland) — all servers, storage, backups and networking. This includes the platform itself, the build runner, and all apps and app databases.
  • AWS Route 53 — used exclusively to manage the wildcard DNS record *.myvibecode.app that points your app subdomain to our servers, and for the DNS validation of our TLS certificate. No other AWS services are used and no account or app data is transferred to AWS.
  • Outlook SMTP (Microsoft) — transactional email delivery for login links, invitations, activation and service notifications.
  • Polar (Polar Software, Inc., San Francisco, USA) — payment processing for paid plans. Polar acts as our Merchant of Record: it is the legal seller of paid plans, handles checkout, taxes (VAT/sales tax), and issues the invoice. This involves a transfer of the billing data named in §2 to the United States, safeguarded by Polar's Data Processing Agreement and EU Standard Contractual Clauses. See Polar's privacy policy and our Terms of Service.

6. Data retention & deletion

Your data is stored for as long as you have an account. When you delete an app, its source code, database, container images and running containers are removed from our live systems immediately. Copies may remain in access-restricted backups for up to 7 days, after which they are automatically and permanently erased. If a backup is ever restored, the deletion is re-applied so deleted apps do not reappear.

To delete your account and all associated data, email mail@orgops.io. We will process deletion requests within 30 days.

7. Your rights (GDPR)

You have the right to access, correct, restrict, and delete your personal data. To exercise any of these rights, contact mail@orgops.io.

8. Cookies

We use a single HTTP-only session cookie to keep you logged in. No third-party cookies. No tracking.