Privacy policy
What we collect
- IP address — rate limiting and abuse prevention. Stored in ephemeral caches (24h).
- Uploaded site content — the files you upload via the API.
- API keys — hashed (SHA-256). We never store the raw key.
- Request logs — Cloudflare Workers generates standard request logs.
- Site traffic aggregates — date, site, page path, and page-view count. Query strings and visitor identifiers are discarded.
- Product analytics — cookie-free, self-hosted Plausible reports for
vibedrop.ccand signed-in dashboard pages. Token-bearing verification and claim pages are excluded. - Hosted-site analytics — human HTML page views on
*.vibedrop.siteare sent to a separate self-hosted Plausible site. Query strings and URL fragments are removed first. IP address and User-Agent are used transiently by Plausible to calculate aggregate visitor metrics; raw IP addresses are not retained. - Explore community activity — votes are linked to a one-way hash of a random ID stored in your browser. If you comment, your chosen public name, comment text, and posting time are stored and shown publicly. We do not ask for an email address.
What we don't collect
- Analytics cookies or browser fingerprinting on user sites
- Raw visitor IP addresses in site-owner analytics
- Payment card information (handled by Stripe)
Third parties
We use Cloudflare for hosting (Workers, R2, D1, KV) and a self-hosted Plausible Analytics instance for cookie-free product and hosted-site analytics. The two Plausible sites are kept separate. See their respective privacy documentation.
Data retention
Free tier sites are deleted automatically after 30 days of inactivity. Anonymous API keys are retained until manually deleted. Site traffic aggregates are retained for up to 90 days. Explore votes and comments are retained while the associated public site exists, unless they are removed earlier for moderation or following a valid deletion request.
Your rights (GDPR / CCPA)
You can request deletion of your API key and all associated sites by emailing hello@vibedrop.cc with the key prefix. For an Explore comment, include the page and comment text so we can locate it.