Privacy Policy
Last Updated: November 2026 • Effective Immediately
Core Principle: 100% Local Source Code Privacy
VibeSleuth is deliberately engineered from the ground up to be an offline-first security application. We do not operate cloud scanning servers. Your proprietary source code, git metadata, configuration files, and vulnerability scan reports are analyzed strictly on your local computer CPU. They are never transmitted, uploaded, copied, or stored on any external servers.
1. Information We Do Not Collect
When using the VibeSleuth desktop software, we do not collect or have access to:
- Source code contents, file paths, repository structure, or branch names.
- AST trees, code tokens, secrets, or passwords found during static scans.
- Vulnerability reports, severity counts, or code review findings.
- Network traffic of your development environment.
2. Licensing and Payment Information
VibeSleuth licensing is handled through our third-party merchant and payment processor, Freshlimepay (freshlimepay.com).
- Purchases: Financial transactions, credit card numbers, and billing addresses are processed directly and securely by Freshlimepay. VibeSleuth does not store or process your financial data.
- Key Activation: When activating your lifetime key in VibeSleuth, the application communicates securely via HTTPS with Freshlimepay licensing endpoints to validate the license key state and trial quotas.
- Local State: Once verified, your license activation status is cached locally on your device in your user application data directory.
3. Quarantine and Temporary Files
When analyzing remote Git repositories or selected folders, VibeSleuth stages files in a temporary quarantine sandbox directory on your local filesystem (e.g., within standard OS temporary paths). As soon as the analysis completes or when the scan process terminates, all temporary quarantine files are automatically deleted.
4. Third-Party Engines (Opengrep and Cargo-Audit)
VibeSleuth bundles and provisions the open-source Opengrep engine and utilizes Cargo-Audit. Both tools run locally as standalone processes:
- We explicitly disable telemetry flags and auto-update tracking (e.g.,
OPENGREP_ENABLE_VERSION_CHECK=0). - Opengrep rules are sourced from open-source community sets without sending your AST models to remote cloud registries.
5. Website Data & Analytics (vibesleuth.saposs.com)
When you visit our website at vibesleuth.saposs.com, standard anonymous web server logs may be recorded for performance and security maintenance.
We use Google Analytics with IP anonymization to understand aggregate site traffic and usage patterns. Analytics cookies are only stored if you consent via our Cookie Banner. You can accept, decline, or revoke your cookie choices at any time.