privacy policy

vybedrop (“vybedrop,” “we,” “us,” or “our”) is a mobile and web app that lets small private groups (“tribes”) share photos and videos (“drops”) with each other for a limited time. This Privacy Policy explains what information we collect, how we use it, who we share it with, and the choices you have. It applies to vybedrop (vybedrop.com), our mobile apps, and app.vybedrop.com (together, the “Service”). vybedrop is currently operated as [Legal Entity Name — to be confirmed]. If you have questions, see “contact us” below.

We built vybedrop to hold as little of your data as we reasonably can. We do not sell your personal information, and we do not use your content to train advertising or machine-learning models.

account information

When you create an account, we collect an email address (if you sign up by email) or basic profile details from Google or Apple (if you sign in that way — typically your name and email address, as permitted by your privacy settings with that provider). You choose a username and, optionally, upload a profile photo.

tribes and content

We collect the tribes you create or join, your role and status in each tribe, and any nickname you set for yourself within a specific tribe. When you post a drop, we store the photo or video file, an optional caption, and the ritual (if any) it was posted in response to. We also store your reactions (“vybes”) to other members’ drops, and your participation in tribe “rituals” (recurring prompts), including streaks.

reports, blocks, and feedback

If you report a drop or another member, or block someone, we store who made the report, who or what it concerns, and any details you provide. If you submit feedback or a bug report through the app, we store the message and, if you choose to include one, a contact email.

waitlist

If you join our waitlist from vybedrop.com, we collect only the email address you submit.

To run notifications and keep the app working, we collect:

• a push notification token issued by your device (through Apple, Google, or Expo’s push relay) and the platform (iOS/Android) it was issued for, so we can deliver notifications;
• timestamps for account activity, such as when you last used the app and when you last viewed a tribe, which power “new activity” indicators;
• a record of notifications sent to you and whether you opened them, kept for a limited time to prevent duplicate or over-frequent notifications and to power in-app quiet-hours settings.

product analytics, crash reporting, and session recordings

We use PostHog to understand which parts of the app people use and where they get stuck, Sentry to catch crashes and slow performance, and UXCam to record and replay app sessions so we can see what a bug report or drop-off actually looked like. All three are tied to your account ID, not your name or email.

What we track with PostHog and Sentry is a small, fixed list of product events (like completing signup, posting a drop, or joining a tribe) and technical data (crashes, load times, failed requests) — never free text, drop captions, or other content you post.

Session recordings from UXCam reconstruct what a screen looked like and how you interacted with it — they are not video. We block out all text field content, photos, and videos everywhere in the app, and we don’t record the sign-in, sign-up, or profile-editing screens at all.

If you sign in with Google or Apple, those providers share basic profile information with us (typically your name and email address) as permitted by your account settings with them — we never see your Google or Apple password.

If you don’t upload a profile photo, your avatar is generated on the fly by a third-party service, DiceBear (api.dicebear.com), based on your username or profile ID. This request is made directly from the device of whoever is viewing your avatar (which may be another member of your tribe), not routed through our servers — so DiceBear may receive your username or profile ID from other users’ devices when they view a tribe you belong to. Uploading your own profile photo avoids this.

• to create and maintain your account and tribes;
• to deliver drops, reactions, and rituals to the right tribe members;
• to send push notifications you’ve enabled (new drops, reactions, join requests, ritual reminders, and similar tribe activity);
• to respond to support requests, feedback, and reports;
• to maintain the security and integrity of the Service, including investigating reports of abuse; and
• to comply with legal obligations.

within a tribe

A drop you post is visible to every member of the tribe you post it in, along with your username and avatar. If you set a tribe-specific nickname, other members of that tribe see it instead of your account username. Members can react to, save, and report drops shared with the tribe. If you leave a tribe or delete your account, drops you already posted may remain visible to the other members who received them, in the same way a message already sent in a group chat can’t be unsent for everyone.

service providers

We share information with vendors who help us run vybedrop, under contracts that limit their use of your information to providing services to us:

• Supabase — hosts our database and handles account authentication;
• Cloudflare — stores and delivers photos and videos (R2 and Stream), and hosts our API and websites (Workers and Pages);
• Expo — relays push notifications to Apple and Google on our behalf;
• Google and Apple — provide sign-in services if you choose to use them;
• DiceBear — generates default avatars, as described above;
• PostHog — records product analytics events, as described above;
• Sentry — records crash reports and performance data, as described above;
• UXCam — records and replays app sessions, as described above.

legal and safety

We may disclose information if we believe in good faith it is necessary to comply with a legal obligation, protect the rights or safety of vybedrop, our users, or the public, or investigate violations of our Terms of Service.

business transfers

If vybedrop is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any such change and any choices you may have.

We do not sell your personal information.

Tribes have a lifespan set by their creator. When a tribe ends, its host chooses to:

• dissolve it — drops become inaccessible to members and are queued for deletion from our systems, subject to a short grace period during which the host can still save content; or
• archive it — drops remain visible to members in a read-only tribe, until a member deletes their account or the content is otherwise removed.

Deleted or dissolved content is removed from active use promptly, but may persist for a limited additional time in backups, logs, or as residual copies before being permanently erased from our systems, and other members may retain their own local copies (for example, photos they saved to their device) that we have no ability to remove.

• notifications — control what you receive in Settings, per-tribe and globally.
• blocking and reporting — you can block another member or report a drop or member from within the app.
• access and correction — you can update your display name and avatar at any time in your profile.
• deletion — you can delete your account from Settings. This removes your profile details, your own drops and reactions become inaccessible, and any tribe you solely hosted is dissolved. Depending on your state or country, you may have additional rights to access, correct, delete, or port your personal information, or to object to certain processing.

To exercise a right not covered by the in-app tools, contact us at hello@vybedrop.com. We may need to verify your identity before acting on a request.

vybedrop is not directed to children, and you must be at least 13 years old (or the minimum age required in your country) to use the Service. We do not knowingly collect personal information from children under that age. If you believe a child has provided us with personal information, contact us at hello@vybedrop.com and we will take steps to delete it.

We use industry-standard measures — including encryption in transit and access controls — to protect your information. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

Our infrastructure is hosted in the United States (Supabase, on AWS us-east-1) and on Cloudflare’s global network. If you use vybedrop from outside the United States, your information will be transferred to and processed in the United States and other countries, which may have different data protection laws than your own.

We may update this Privacy Policy from time to time. If we make material changes, we will update the “last updated” date above and, where appropriate, notify you in the app.

Questions about this policy? Reach us at hello@vybedrop.com.