Privacy policy.

1. Who we are

vibecoding.rocks ("we", "us") is operated by Brian N. Millar, Ireland. We are the data controller for the personal data described in this policy. You can reach us about anything privacy-related at [email protected].

2. What we collect, why, and on what legal basis

We only process data you actively give us, plus the minimum needed to keep the site working and fair:

• Project submissions — the project details you submit (name, description, links, builder credit) plus an optional contact email. The project details are published if approved; your contact email, if you give one, is never displayed and is used only to contact you about your submission. Legal basis: performance of your request (Art. 6(1)(b)) for publishing, legitimate interest (Art. 6(1)(f)) for moderation.
• Comments — the display name and comment text you choose to post. Both are published if approved. Legal basis: performance of your request (Art. 6(1)(b)), legitimate interest in moderation (Art. 6(1)(f)).
• Reports — the reason, any details you add, and an email address if you choose to leave one. Used only to review the reported listing. Legal basis: legitimate interest in keeping the showcase safe and accurate (Art. 6(1)(f)).
• Voting — when you vote on a project we store the vote together with a salted cryptographic hash (SHA-256) of your IP address. We do not store your IP address itself, and the hash cannot practically be reversed. Its only purpose is limiting each connection to one vote per project. Legal basis: legitimate interest in vote integrity (Art. 6(1)(f)).
• Contact form — your name, email address and message, used only to read and respond to your enquiry. Legal basis: legitimate interest in responding to messages you send us (Art. 6(1)(f)).
• Technical logs — like nearly every website, our server keeps short-lived request logs (IP address, URL, timestamp, user agent) for security and debugging. Legal basis: legitimate interest in operating the site securely (Art. 6(1)(f)).

We do not use analytics services, advertising networks or tracking pixels, and we never sell or rent personal data.

3. Cookies

We use a single session cookie, which is strictly necessary for the site to function (it powers things like form security and status messages after you submit something). Because we set no analytics, advertising or other non-essential cookies, there is no cookie consent banner — there is nothing to consent to.

4. Third parties and international transfers

• Hosting — the site runs on servers operated by our hosting provider acting as our processor.
• Fonts — all fonts are self-hosted and served from our own servers. Loading this site makes no requests to font CDNs or any other third-party servers.
• Share buttons — our share links are plain links. No third-party scripts or embedded widgets load, and nothing is sent to any network unless you click a link and continue there.

In short: visiting this site sends your requests to our servers and nowhere else. We do not transfer your personal data outside the EU/EEA in the course of operating the site [unless your hosting provider does — adjust to match your hosting setup].

5. How long we keep things

• Published projects and comments: while they remain published, or until you ask us to remove them.
• Submission contact emails: while the related project is listed or under review.
• Reports: until resolved, then retained briefly for audit before deletion.
• Contact messages: until handled, then deleted.
• Vote records (hashed): while the related project is listed.
• Server logs: automatically rotated and deleted within 60 days.

6. Your rights

Under the GDPR you can, at any time:

• ask for a copy of the personal data we hold about you (access, Art. 15);
• have inaccurate data corrected (rectification, Art. 16);
• have your data deleted (erasure, Art. 17) — including published comments and submissions;
• restrict or object to processing based on legitimate interests (Arts. 18 and 21);
• receive data you gave us in a portable format (portability, Art. 20);
• withdraw consent, where processing is based on it, without affecting past processing (Art. 7(3)).

To exercise any of these, email [email protected]. We respond within one month. You also have the right to lodge a complaint with your local data protection authority (Art. 77).

7. Security

Personal data is stored on access-controlled infrastructure. Passwords for administrative access are stored only as strong one-way hashes, voting identities are pseudonymized by design, and submission contact details are never rendered on any public page.

8. Children

The site is not directed at children under 16, and we do not knowingly collect their data. If you believe a child has given us personal data, contact us and we will delete it.

9. Changes to this policy

If we change what we collect or how we use it, we will update this page and its date.