Privacy Policy

Last updated: 13 October 2026

VibTribe is a privacy-first messaging app. This Privacy Policy explains exactly what data we collect when you sign up and use the service, how we use it, who can see it, and the choices you have. It is a separate document from our Terms & Conditions, although both must be accepted to use the App.

A. Information We Collect About You

We process the following categories of account, communication, device and feature data. Which categories apply depends on the features you use and the permissions you grant:

  • Full name — required at signup; shown to other users you chat with.
  • Date of birth — required at signup, used to enforce our age policy: sign-up is blocked under 13; users aged 13–17 must complete verifiable guardian consent; users 18+ sign up directly. Kept strictly confidential: visible only to you and our authorised admin team; never shown to other users.
  • Mobile number & country code — required at signup for account identification and contact discovery. These are not openly exposed in profiles or creator search. Number-based discovery is limited to permitted contact matching and exact-number lookup; account owners and authorised administrators retain their permitted access. VibTribe does not currently provide mobile-number OTP verification.
  • Email address — required at signup. Used for OTP verification, password recovery, support replies, and (only if you opted in) promotional emails. Your email is visible only to you and our admins, never to other users.
  • Password — stored only as a salted bcrypt hash. We never see or store your plaintext password.
  • Username (optional) — a public handle other users can find you by.
  • Profile photo / avatar (optional) — stored in a private storage bucket and served only via short-lived signed URLs to viewers permitted by your Profile photo visibility setting (All / Contacts / Nobody). Direct public URLs are not issued.
  • Tribe (group) avatar (optional) — stored in a private storage bucket and served via short-lived signed URLs only to current members of that tribe. Non-members cannot fetch the image.
  • Short bio (optional).
  • App preferences — selected theme, notification toggles, language, and per-feature permissions you have granted (microphone, camera, contacts, notifications).
  • Two-factor authentication state — whether 2FA is enabled, and if so, the encrypted TOTP secret (readable only by you, never to other users).
  • Encryption material — your ECDH public key (used by others to send you encrypted messages) and your private key, wrapped/encrypted with a key derived on your device from your 6-digit PIN. We never store your PIN or the unwrapped private key.
  • Chat messages & media (1-to-1) — encrypted on your device before upload; we store only the ciphertext plus routing metadata (chat id, sender id, timestamp, delivery/read status, expiry).
  • Group / tribe messages and attachments — support end-to-end encryption using keys for the recipients who have set up encryption. Encrypted payloads and routing metadata are stored to deliver the service. Legacy or otherwise unencrypted content does not have end-to-end protection; members added later do not automatically gain access to earlier encrypted content.
  • Status updates (stories) — caption, media file URL, visibility audience and views. Automatically and permanently deleted 24 hours after posting.
  • Contacts — contact entries you save in VibTribe. With permission, supported devices can read contacts you choose or allow for matching. Numbers are normalised and hashed on your device before matching requests; the raw address book is not sent in those requests. Saved in-app contacts can contain contact names and numbers. You can withdraw contact-matching consent in the Consent Center.
  • Blocked users — the list of accounts you have blocked.
  • Calls metadata — caller, callee, start/end timestamps, missed/answered status and connection signalling. Audio/video uses WebRTC, directly between devices where possible or through a relay; connection services necessarily process network information such as IP addresses. VibTribe does not record calls.
  • Presence & technical data — last-seen timestamp, online status, device push-subscription tokens (web push and Firebase Cloud Messaging tokens for Android).
  • Support tickets — name, email, issue title and body, attachments and reply thread that you submit through the in-app help form.
  • Login & session security — count of failed login attempts, account status (active / suspended / blocked), active session records, OTP rate-limit records.
  • Consent records — timestamps for when you accepted these Terms, when you accepted this Privacy Policy, and when you opted in (or out of) promotional emails. For the marketing choice we also record the IP address and the screen the choice was made on (signup form, re-consent prompt, or profile settings) for compliance audit purposes (DPDP Act 2023, GDPR, CAN-SPAM).
  • Role and entitlement flags — standard, admin or master-admin status, verification status, premium entitlement and expiry, and feature access settings. A VibZ milestone badge is separate from account verification.
  • VibZ content and connections — uploaded videos, covers, captions, hashtags, creator identity, publication status, VibIn connections, VibMates counts, likes, comments, shares and milestone statistics.
  • VibZ viewing and discovery — viewer account identifiers, per-viewer view counts, watch duration and completion signals, searches, content interests and engagement used for recommendations. A recorded view requires at least 2 seconds of watch time. Creators and authorised administrators can access individual viewer insights; other viewers cannot.
  • Safety and administration — reports, sampled video frames and caption context used for AI screening, safety flags, review outcomes, administrator decision logs, removal reasons, notices, appeals and Push start/end information.
  • Device storage — persistent sign-in credentials, app preferences, encrypted offline conversation/media caches, drafts and queued outgoing messages on your device. This local storage is distinct from the server copy.

B. What We Do Not Collect

  • We do not read or sell the contents of your end-to-end encrypted 1:1 messages or media.
  • We do not expose your date of birth, email address, or two-factor secret to other users.
  • We do not send your raw phone address book in contact-matching requests; those requests use device-generated number hashes.
  • We do not record your voice or video calls.
  • We do not track your precise GPS location.
  • We do not use third-party advertising trackers to profile you. VibZ does use first-party viewing, search and engagement signals to personalise its feed, as described below.

C. How We Use Your Data

  • To operate the messaging, calling, status and group features you use.
  • To verify your identity at signup and during password resets (email OTP).
  • To enforce safety, prevent abuse, and respond to lawful requests from authorised Indian agencies.
  • To respond to support tickets you submit.
  • To send service notifications (delivery, security alerts) and, only with your explicit opt-in, promotional emails.
  • To publish and discover VibZ, maintain VibIn connections and VibMates milestones, calculate engagement and provide creator insights.
  • To personalise the For You feed from viewing, searches, likes, content and creator signals, and to give active administrator-pushed clips additional prominence with a Featured tag.
  • To screen VibZ for safety, prioritise serious concerns for administrator review, handle reports and appeals, and log final decisions. This screening is not performed on the contents of end-to-end encrypted chats.
  • To renew sign-in sessions, provide per-device session controls and synchronise encrypted offline data when connectivity returns.

D. Encryption Approach

  • Key exchange: ECDH on the NIST P-256 curve via the Web Crypto API.
  • Message & media encryption: AES-GCM-256 with a fresh random IV per payload.
  • Private-key protection: your private key is wrapped with an AES-GCM key derived from your 6-digit PIN using PBKDF2-SHA256 (100,000 iterations) before being stored on our servers.
  • If you forget your PIN, encrypted chat history cannot be recovered.

E. Account Deletion & Retention

You can delete your account any time from Profile → Danger Zone → Delete My Account. This removes your profile, contacts, encrypted keys, chats, messages, statuses, push tokens, support tickets, and your authentication record. Some operational logs and backups may persist for a short period for security and legal reasons. Status media is auto-deleted 24 hours after posting regardless of account state. For any data-protection request, contact the Grievance Officer at Labhansh.garg@outlook.com.

Admin-initiated offboarding. When an administrator removes your account, we send an email to your registered address stating the reason — General, Breach of Terms & Conditions, or Incomplete Sign-up — and personal data associated with the account is deleted immediately. A limited set of records (e.g. audit logs, consent records, records required for security, fraud prevention, dispute resolution and statutory retention under Indian law) may be retained for the periods required by applicable law.

Incomplete sign-up reminders. If you verify your email address but do not complete onboarding, we send up to three reminder emails (at approximately 24 hours, 72 hours and 7 days after email verification) to help you finish. Reminders stop the moment onboarding is completed. This processing is based on legitimate interest in completing the account creation you started, and no reminders are sent once onboarding is complete or the account is deleted.

VibZ records. Content, engagement, viewer insights and recommendation signals are processed while needed to operate VibZ. Removal, account deletion and safety review can affect availability; limited moderation, notice, appeal and security records may be retained where needed for dispute resolution, safety or legal obligations. We do not promise a fixed deletion period for those retained records. Removing a clip does not retract copies another person has saved or shared outside VibTribe.

Offline copies. Encrypted caches may remain on a device after ordinary logout so they can be reused on a later sign-in. Maximum Privacy Mode wipes the encrypted cache and its wrapped cache key on logout; device storage controls also let you clear cached data. Decrypted cache memory is cleared when the app is backgrounded. Clearing server content cannot remotely erase files you or recipients exported to another app.

F. Feature Visibility & External Sharing

Private account fields are not public creator-profile fields. Profile photos and tribe avatars use private storage and permitted-viewer access. VibZ media and covers use private storage with time-limited access links; pending or quarantined clips are not available to other members. VibZ is currently restricted to administrators and master administrators, including when opened from a shared link.

VibZ creator identity, published clips, VibMates, milestone badges and engagement are visible to eligible signed-in viewers. Individual viewer records are limited to the creator and authorised administrators. A Featured tag identifies a clip receiving an active administrator Push; it is not a safety endorsement.

Using an external share option passes the selected link or file to the app you choose. That app's own privacy rules apply, and sharing a link does not grant access to restricted content. Status media is not end-to-end encrypted and anyone who obtains its media URL during its availability window may be able to view it.

G. Device Permissions We May Request

  • Camera & microphone — for sending photos, voice notes, and voice/video calls.
  • Notifications — to alert you of new messages and calls.
  • Storage / file access — to attach files, upload VibZ and select a cover image, or save media you choose.
  • Contacts — where supported and with your permission, to match or import selected contacts. Matching uses hashes generated on your device.

You can manage permissions in the app and device settings. Disabling a permission may prevent the related feature from working. Playback and auto-swipe choices may be stored locally; VibZ playback pauses when the app is hidden. Background call notifications and external share options vary by operating system and installation type.

H. Children & Guardian Consent

Sign-up is blocked for anyone under 13. We do not knowingly collect data from anyone under 13; if we learn that we have, we will delete the account and associated data promptly.

Users aged 13 to 17 may sign up, but the account is restricted to the guardian setup flow (/guardian-setup) until a parent or legal guardian:

  • receives a one-time verification code by email;
  • reviews the consent request page (linked from the email) and explicitly ticks the confirmation box; and
  • submits verifiable consent under §9 of India’s Digital Personal Data Protection Act, 2023.

Until consent is recorded the minor cannot chat, call, share media, or use age-restricted features. The guardian can withdraw consent at any time from the same link, which immediately restricts the minor’s account. We send the guardian a monthly reminder email while the account is active.

When the user turns 18, the guardian consent flow is automatically retired, monthly reminders stop, and all minor-related restrictions are lifted. The historical consent record is retained for compliance audit purposes.

Users aged 18 and above may sign up and use the app directly.

I. Your Rights

Subject to applicable law (including India's Digital Personal Data Protection Act, 2023, and the EU/UK GDPR where applicable) you may request access, correction, export, or deletion of your personal data, and may withdraw consent at any time. Contact the Grievance Officer at Labhansh.garg@outlook.com.

Profile → Privacy → Consent Center provides controls for contact matching, profile activity visibility, product news and optional usage analytics. Turning off optional analytics is not represented as disabling all VibZ recommendation signals or creator view records. You can request an emailed data export through Download my data, subject to its current request limit, and manage local cached data in the offline storage settings.

Terms and Privacy acceptance are recorded separately with the document version. A material update requires a fresh in-app review and acceptance before continuing. Guardians retain the withdrawal rights described above.

J. Marketing Emails

We send promotional emails (product updates, tips, and announcements) only to users who have explicitly opted in. We record the timestamp, source (signup form, re-consent prompt, or profile settings), and IP address of your consent for compliance audit purposes.

  • Legal basis: your explicit consent — DPDP Act 2023 § 6 (India), GDPR Art. 6(1)(a) (EU/EEA), and CAN-SPAM Act compliance (US).
  • Sender: VibTribe <promotions@news.vibtribe.in>. Reply-to: Labhansh.garg@outlook.com.
  • Withdrawal: click the unsubscribe link in any promotional email (no login required, takes effect immediately) or toggle off in Profile → Notifications.
  • Suppression: hard bounces and spam complaints are automatically suppressed and the user is opted out across the platform.
  • Right to complain: you may lodge a complaint with India's Data Protection Board or your local EU data-protection authority.

Transactional and security emails (OTP codes, password resets, ticket replies, account notices) are not covered by this consent and will continue regardless.

K. Contact

For any privacy question or request, email the Grievance Officer at Labhansh.garg@outlook.com. We acknowledge within 24 hours and resolve within 15 days as required by the IT Rules, 2021.

← Back to Sign Up