Privacy PolicyAnd the source it was written against

This policy covers viber.space and the account you hold on it. The applications ViberSpace builds for you are yours; what they collect from their own users is your responsibility, and this document does not speak for them.

Scope viber.space

It was written by reading this product's source rather than by adapting a template. Every clause names the table, service or setting that stands behind it, so the document can be held against the system it describes.

Written against c6645a4

Where nothing stands behind a clause — no schedule, no automation, no certificate — the margin says so instead of staying empty.

Unbacked clauses 8

Your account is a single row. It holds the email address you sign in with, the plan you are on, the credit balance left this month, and the dates the account was opened and its allowance last reset. There is no name field and no profile.

Table users

There is no password. You sign in with a one-time code sent to your email address, good for ten minutes. We hold no password for you, hashed or otherwise.

Code good for 10 minutes

Each sign-in opens a session record, which keeps the IP address and the browser user-agent it was opened from.

Table sessions

For every app you build we hold its name and slug, the address of its GitHub repository, its environments and any custom domains, a record of each deployment, and the environment variables and secrets you set on it.

Tables apps · environments

Every conversation with the agent is kept in full — your messages, its replies, and the token counts and cost of each exchange.

Table agent_sessions

If you asked for an invitation, we hold the address and the note you sent. If you tried to sign up without one, we hold the address and the time you tried.

Tables access_requests · signup_attempts

Billing holds your Paddle customer and subscription identifiers, your invoices, and the daily bills and metered events behind them. Card details go to Paddle and never reach us.

Tables invoices · subscriptions

Building an app means sending your instructions and the contents of your app's files to OpenAI's API, which returns the code that gets written. Everything you type to the agent, and everything the agent reads in your repository, crosses that boundary.

Model gpt-5

Every app is a real repository inside a GitHub organisation we control, created and committed to by a GitHub App acting for you. Your code and its whole commit history live there.

Repository host GitHub

Apps run on Fly.io in both environments, and whatever data your app collects from its own users sits in a database on that machine rather than in ours.

Dev and prod Fly.io

The ViberSpace platform database — every table named in Part 2 — is managed PostgreSQL at Neon.

Platform database Neon

Errors are reported to Sentry with request headers and your IP address attached, because the setting that sends them is switched on. A stack trace can carry the values that caused the error.

send_default_pii true

Subscriptions, payments and invoices are handled by Paddle, who take your payment details directly.

Merchant Paddle

Public pages, this one included, load Google Analytics in production. It sets its own cookies and reports your visit to Google.

Measurement ID G-Q4FGSDD92M

Sign-in codes and account mail are sent from leo@viber.space through an ordinary mail service, so your address crosses it every time you sign in.

Sent from leo@viber.space

No one else receives it. We do not sell it, and we hand it to no broker, no advertiser and no data market. We disclose it where the law compels us, and not otherwise.

Sold to No one

ViberSpace runs no advertising, belongs to no ad network, and carries no tracking pixel.

Ad networks None

ViberSpace trains no models. Your files reach OpenAI's API so the agent can work on them and for no other purpose; what OpenAI does with API traffic is governed by OpenAI's own terms, which we do not restate here.

Models we train None

Records are kept while the account exists. Nothing expires on a timer: there is no scheduled deletion, no purge job, and no retention clock running against any table named above.

Purge schedule None configured

Deleting an app removes its record here and tears down its Fly machines. Its GitHub repository and commit history are a separate act and survive until they are removed there.

Job AppDeleteJob

Closing an account is done by asking. There is no self-serve delete control in the product today.

In-product delete Not built

A sign-in code stands for ten minutes. The sign-in cookie is set as a permanent cookie, so a session lasts until you sign out or clear it.

Cookie lifetime 20 years

One signed, http-only cookie holds your session identifier. It is what keeps you signed in, and nothing here works without it.

Name session_id

Rails' own session cookie carries the cross-site request forgery token that protects every form on the site, along with one-off flash messages.

Set by Rails

Google Analytics sets its own cookies on public pages in production. They are the only cookies here that are not ours, and nothing on this site depends on them.

Set by Google

You can ask for a copy of everything we hold about you, for a correction to any of it, or for your account and its records to be deleted.

Channel Contact desk

The one control you hold directly is signing out, which ends that session and clears its cookie.

In product Sign out

Everything else is answered by hand. We promise no turnaround, and would rather print that than invent one.

Response time No date promised

Every request is served over HTTPS; the application refuses plain HTTP.

force_ssl true

Marking an environment variable secret hides its value in the product and cannot be undone. It is not application-level encryption: the value is stored in the platform database as written.

App-level encryption None

Access to the platform database is limited to the people who operate ViberSpace. No external audit, penetration test or certification stands behind this page, and none is claimed anywhere on this site.

Certifications held None

ViberSpace is not intended for anyone under 13, and we do not knowingly hold data from a child. Tell us if you believe we do.

Minimum age 13

The services in Part 3 run in the United States and elsewhere. Using ViberSpace means your data is processed outside your own country.

Sentry region us

When this document changes, the revision below changes with it, and the text it replaced is recorded as superseded rather than quietly overwritten.

This revision 02