Privacy Policy

Vibeland is an iOS app that builds Home Screen, Lock Screen, and Siri widgets. The widget you make is stored on our server. The data shown inside the widget — your photos, calendar events, reminders, contacts, health metrics — is read by your iPhone through Apple system frameworks and rendered locally. None of that personal device data is uploaded to our server.

This document describes what we collect, what stays on your device, and how we handle the gap.

2.1 Account information

• Email address (when you sign in with email).
• Display name (provided by Sign in with Apple, Google, or set manually).
• An OAuth identifier from Apple or Google when you choose those sign-in methods. We don’t see your password.

2.2 Widgets you create

• The widget specification: layout choice, atom selection, data binding configuration, optional title and description.
• The share code (eight characters) so you can place the widget on a Home Screen and share it.
• A flag indicating whether the widget is public.

2.3 What we do NOT collect

• Photos from your library. Picked photos are written to a local App Group container on your device. The spec stores only the photo’s id; the bytes never leave your phone.
• Calendar events and Reminders. The spec stores the query (e.g. “today” or “next 7 days”), and the iOS widget extension reads your events directly from EventKit at render time.
• Health data. The spec stores the metric name (e.g. “steps”) and goal. The widget extension queries HealthKit on your device. We never receive a value.
• Contacts. The spec stores the picked contact’s identifier; the photo and primary phone number are saved to a local App Group container only.
• Location. We don’t request or use location.
• Browsing history, advertising identifiers, contacts graph. We don’t collect any of these.

• Calendar (NSCalendarsFullAccessUsageDescription). Asked once when you first build a Calendar atom widget. Used only by the iOS widget extension to render events.
• Reminders (NSRemindersFullAccessUsageDescription). Asked once when you first build a Reminders atom widget. Also used to mark a reminder complete when you tap it on the Home Screen (iOS 17+ interactive widgets).
• Health (NSHealthShareUsageDescription). Asked per metric — only the specific HKQuantityType your widget reads. Granting access to one metric does not grant any other.
• Photos. We use Apple’s permissionless PHPickerViewController. You explicitly hand the picker the photos you want; we never request access to your full library.
• Contacts. We use Apple’s permissionless CNContactPickerViewController. Same handoff model.

When you share a widget by share code, the recipient’s phone fetches the same spec from our server and renders it with the recipient’s data. They see their calendar, their steps, their reminders — never yours. For atoms that need device-local content (Photo, Contact), the recipient’s widget shows a placeholder until they pick their own.

We support Sign in with Apple, Google OAuth, and email/password. Authentication is handled by Supabase Auth on our infrastructure; passwords are stored as bcrypt hashes. We never receive your Apple or Google password.

Account data is retained while your account exists. You can delete your account at any time by emailing support@vibeland.app. Account deletion removes your widgets and account record from our database within 30 days.

Local App Group data (photos and contact images you picked) is removed when you delete the corresponding widget or uninstall the app.

Vibeland is not directed at children under 13. We do not knowingly collect data from children under 13.

We’ll update this page when the policy changes and post the new “Last updated” date. Material changes will be communicated in-app.

Questions, requests, or complaints: support@vibeland.app.