Privacy policy
This policy explains what personal data vibefixr.com collects, why, how long we keep it and what your rights are under the EU General Data Protection Regulation (GDPR). We collect as little as we can.
Who is responsible
The controller is Vibefixr, operated by Gustav Björk, Sweden. Contact: vibefixr@mail.grokbot.com.
What we collect and why
| What | Data | Purpose and legal basis | Kept for |
|---|---|---|---|
| Website analytics (GoatCounter) | Page visited, referrer, browser type, screen size and approximate country. No cookies, and we don’t store your IP address. | Understanding which pages are useful. Legitimate interest (Art. 6(1)(f)). | Aggregated statistics, kept while the site runs |
| Free scan request form (Netlify Forms) | Email, app or repo URL, the tool you built with, and the problem description you write. | Running the scan and emailing you the result. Your request (Art. 6(1)(b)). | Up to 12 months, then deleted |
| Key checker email report (Netlify Forms) | Email, the checked URL, the types of findings (never the keys), and whether you agreed to one follow-up email. | Sending the report you asked for, plus one follow-up only if you ticked the box. Consent (Art. 6(1)(a)); withdraw any time. | Up to 12 months, then deleted |
| Payments (Stripe) | Stripe handles your card details; we never see them. We receive your name, email, country, the amount and what you bought. | Delivering the service you paid for and bookkeeping. Contract (Art. 6(1)(b)) and legal obligation (Art. 6(1)(c)). | Accounting records 7 years, as Swedish bookkeeping law requires |
| Email you send us | Your address and what you write. | Answering you. Legitimate interest. | Up to 24 months after our last contact |
The free health check and Supabase key checker
When you run a check, our server downloads your page and its public JavaScript files once, the same files any visitor’s browser gets. They are scanned in memory and discarded. We never store your files or any key we find; keys are masked before results leave our server. We never use a found key, never contact your database and never test your security rules. We don’t keep a log of checks. To stop abuse, the server counts checks per hashed IP address and per checked domain in memory only, for at most 24 hours. Our host may keep standard technical request logs for a short time.
Who processes data for us
- Netlify (hosting and forms), USA.
- GoatCounter (cookieless analytics), EU.
- Stripe (payments). Stripe is also an independent controller for payment data; see Stripe’s privacy policy.
- Zoho Mail (our vibefixr.com mailbox, carl@vibefixr.com), USA.
- Grok Bot (the mailbox behind vibefixr@mail.grokbot.com).
- Google Gmail, for replies to some of our outreach emails.
Where data goes outside the EU/EEA, such as to the USA, transfers rely on the EU–US Data Privacy Framework or the European Commission’s Standard Contractual Clauses. We don’t sell your data or use it for advertising.
Your rights
You can ask for access to your data, correction, deletion, restriction of processing, data portability, and you can object to processing based on legitimate interest. Where we rely on consent, you can withdraw it at any time. Email vibefixr@mail.grokbot.com and we’ll answer within one month.
You also have the right to complain to the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY): imy.se, or to the supervisory authority where you live.
Cookies
We don’t set cookies for analytics or advertising. Stripe’s checkout pages may set their own cookies needed for payment and fraud prevention.
Changes
If we change how we handle data, we’ll update this page and the date at the top.