// Vibe Fest App — Legal

Privacy Policy

Last updated: July 26, 2026 · Русская версия

Vivabyte LLC ("we," "us," or "our") operates the Vibe Fest 2026 companion app (the "App"), a progressive web app available at vibeapp.vivabyte.app. This Privacy Policy explains what information the App handles, why, and what choices you have.

The App is built and operated by Vivabyte LLC. Vivabyte LLC is responsible for the information described here. Festival organizers are given limited access for safety and moderation purposes, as described in Section 5.

1. Two Levels of Use

How much information the App handles depends entirely on how you use it:

Browsing — viewing the lineup, schedule, map, activities, or FAQ, and reading the community board, requires no account and no personal information.
Participating — posting on the community board, sending direct messages, reporting content, or blocking another user requires you to sign in, which means we collect your email address and display name.

You can use the entire festival guide without ever creating an account.

2. Information Collected From Everyone

Device identifier

When the App first loads, it generates a random identifier and stores it in your browser. This identifier is not linked to your real-world identity, but it is persistent and specific to your device, so we describe it as pseudonymous rather than anonymous. It is used to avoid counting the same device twice in usage statistics and to associate notification subscriptions with a device.

Usage events

The App records basic usage events — for example, opening the App, switching tabs, or enabling notifications. Each event is stored with the device identifier, the event name, a country code, a general platform label (such as Android, iOS, Windows, or Mac), and a timestamp.

We want to be specific about what is not kept: your IP address is not stored, and your full browser user-agent string is not stored. The country code is derived from your connection at the network edge and then discarded.

Notifications

If you choose to enable festival alerts and grant browser permission, we store the notification endpoint provided by your browser's push service along with its encryption keys and your device identifier. This is required in order to deliver a notification to your device. Notifications are entirely optional, and you can revoke permission in your browser or device settings at any time.

3. Information Collected If You Use the Community Board

The community board lets festival attendees coordinate rides, rooms, and crews with each other. Because it involves strangers arranging to meet in person, participation requires an identity and is subject to moderation.

Signing in is possible two ways:

Sign in with Google — we receive and store your Google account email address, display name, and profile photo URL.
Email code — we send a six-digit code to your email address and store that address along with a display name you choose.

Once signed in, we store:

Your display name, chosen avatar color, language preference, and the date you accepted the community terms
Posts you create, including the category, title, body, and any details you type such as cities, dates, prices, or seat counts
Direct messages you send and receive, including the message content, sender, recipient, and timestamps
Reports you submit and users you block
If you are banned, the fact of the ban and the reason for it

4. What We Never Collect

The App does not request or access:

Your camera, microphone, photo library, or files
Your contacts
Precise or GPS location — location is only ever a country-level inference from your connection
Advertising identifiers, and we do no cross-app or cross-site tracking

We do not sell your personal information, and we do not share it with advertisers.

5. Moderation and Organizer Access

Direct messages sent through the community board are stored in our database and can be read by festival organizers and moderators when reviewing a report or investigating a safety concern. They are not end-to-end encrypted. Please do not use the board to send anything you would not want a moderator to read.

Access is limited to authorized moderators and administrators, who sign in with Google to reach an administrative dashboard. Moderators can review reported content, hide or delete posts, and ban users. Administrators can additionally view usage statistics and send announcements.

Moderation actions are logged, including which moderator acted and why.

6. Service Providers

The App relies on the following providers, each of which handles a specific part of the service:

Cloudflare — hosts the application server and database. As the network edge, Cloudflare processes connection metadata including IP addresses in transit, even though the App does not store them.
GitHub — hosts the App's static files. GitHub receives standard web server request logs.
Resend — delivers the six-digit login code email. Your email address is shared with Resend for that delivery.
Google — provides the "Sign in with Google" service if you choose it. If you use it, Google receives your IP address and account details as part of sign-in.
Browser push services — Google (Android and Chrome), Apple (Safari and iOS), and Mozilla (Firefox) deliver notifications to your device if you enable them.

Festival schedule and lineup content is managed separately and contains no user information.

7. Retention and Deleting Your Data

We keep board accounts, posts, and messages for as long as the account exists. Usage events and notification subscriptions are kept while they remain useful for operating the App. Notification subscriptions are removed automatically once they stop working.

You can delete your account directly in the App at any time. You can also request deletion by emailing ron@vivabyte.app from the address associated with your account. Requests are actioned within 30 days.

Deletion does not work the same way for every kind of content, because the community board involves conversations with other people. Specifically:

Your account is deleted, including your display name, email address, and profile photo.
Your posts are deleted entirely.
Direct messages are anonymized rather than erased. Your name and profile are removed, you appear to the other person as "Deleted account," and the text of the messages you sent is replaced with "[deleted]." The messages the other person sent remain in their own conversation history, so that deleting your account does not destroy their side of the exchange.
Personal identifiers such as your email address and account identifier are stripped from message records and internal keys.
Notifications are detached from your account, and any unused one-time login codes are deleted.

There is one exception. If your account was banned for violating the community rules, we keep a minimal anonymized record of that ban — with no name, email, or photo attached — so that the ban cannot be evaded by simply registering again. This is retained on safety grounds.

We may also retain copies of messages that were reported, where needed to keep the community safe.

8. Your Rights

Depending on where you live, you may have the right to access, correct, delete, or receive a copy of your personal information, and to object to certain processing. To exercise any of these, email ron@vivabyte.app.

If you are in the European Economic Area or the United Kingdom: we process board account information in order to provide the service you have signed up for, and we process usage events on the basis of our legitimate interest in understanding and improving how the App is used. You may object to the latter at any time by emailing us, and you have the right to lodge a complaint with your local data protection authority.

If you are a California resident: we do not sell or share personal information as those terms are defined under the CCPA, and you will not be discriminated against for exercising your rights.

The App is operated from the United States, and information is processed there and on our providers' global infrastructure.

9. Age Requirement

The App as a whole is not directed to children. The community board is restricted to users aged 18 and over, and you must confirm you meet that requirement before participating. We do not knowingly collect personal information from anyone under 13. If you believe a child has provided information through the App, contact ron@vivabyte.app and we will delete it.

10. Security

All traffic between the App and our servers is encrypted in transit using HTTPS. Data is encrypted at rest by our hosting provider. Login codes are stored hashed rather than in plain text. Sessions use signed tokens.

No system is perfectly secure, and we cannot guarantee absolute security. We encourage you to treat the community board as a public space.

11. Changes to This Policy

We may update this Privacy Policy. When we do, we will change the "Last updated" date above. If a change materially affects how we handle your information, we will make a reasonable effort to notify users in the App.

12. Contact

Questions about this policy or about your information:

Vivabyte LLC
ron@vivabyte.app