Privacy Policy

1. Introduction

Welcome to VibeSync ("we", "our", or "us"). We value your privacy and are committed to protecting your personal data. This Privacy Policy explains how we collect, use, store, and share your information when you use our mobile application and services. By using our application, you agree to the collection and use of information in accordance with this policy.

2. Information We Collect

We collect and process the following categories of information to provide, personalize, and improve the VibeSync experience:

• Account Credentials: Email address and password when you register.
• Profile Details: Username, first name, last name, gender, nationality, Date of Birth, and display name provided during profile completion.
• User-Generated Content: Profile pictures, chat messages, shared media (images, videos, audio/music tracks), and playlists.
• Real-time Presence & Sync Status: Your online status, last-seen timestamps, active session identifier, and playback state (used for Host/Guest music synchronization).
• Device Tokens: Firebase Cloud Messaging (FCM) tokens to deliver push notifications.
• Activity & Gamification Metrics: To calculate your Vibe score and unlock profile achievements, we track app usage statistics, including total rooms hosted, total rooms joined, tracks shared count, and consecutive daily listening streaks.
• Music Preferences & History: We analyze playback information, recently played items, and music listening history (including frequency of genres like genreFrequency mapping) to personalize features.
• Time Diagnostics & Usage: We monitor application activity times (specifically during late-night hours between 12 AM and 4 AM) solely for the purpose of granting special diagnostics-based profile achievements (e.g. the "Night Owl" achievement).
• Search Queries: Keywords entered in the search bar are processed to query and return corresponding music, rooms, and profile results.
• Technical & Diagnostic Data: IP address, device type, operating system version, unique device identifiers, and basic crash logs/diagnostic information collected automatically via Firebase service engines to monitor app stability.
• Local Audio and Music Files (READ_MEDIA_AUDIO / READ_EXTERNAL_STORAGE): VibeSync requests access to your device's local audio and music files to function as a media player.
  • How it is used: This access is used strictly to discover, display, and play audio files (such as MP3s) stored locally on your device within the VibeSync app.
  • Data Sharing & Uploads: Your local music files remain strictly on your device and are not automatically uploaded to our servers. A local file is only uploaded to the VibeSync cloud library if you explicitly choose to share it in a "Vibe Room" (co-listening session) or manually click "Upload to VibeSync". When uploaded, the file is securely stored on Firebase Storage to allow synchronized playback with your friends.
  • Opt-out: You can revoke this permission at any time via your device's system settings. If revoked, the local music player functionality will be disabled, but you can still use the rest of the app.

3. How We Use Your Information

Your information is processed for the following purposes:

• To authenticate your identity and secure your account.
• To enable private and group messaging services.
• To synchronize music and video playback in real-time rooms (Vibe Rooms).
• To verify your age to ensure compliance with our minimum age requirement (16 years or older).
• To deliver instant chat alerts and push notifications.
• To compute and award gamified user activity scores (Vibe score), listening streaks, and profile achievements.
• To enforce security rules, block abusive accounts, and process user moderation reports.

4. Data Sharing and Third-Party Services

We do not sell your personal data. Your data is only shared with trusted service providers essential to run the application:

• Firebase (Google LLC): Used for secure user authentication, database hosting (Firestore & Realtime Database), media hosting (Firebase Storage), and push notifications (Firebase Cloud Messaging).
• YouTube API Services (Google LLC): We integrate YouTube API Services to allow searching, loading, and playing videos directly within our sync rooms. By using the YouTube integration, you agree to be bound by the YouTube Terms of Service (which can be accessed at https://www.youtube.com/t/terms). Furthermore, please review the Google Privacy Policy at http://www.google.com/policies/privacy to understand how Google processes and protects your data when accessing YouTube. When you perform searches, your queries are processed by YouTube to fetch video results. Revoking Access: Users can revoke VibeSync's access to their Google data at any time via the Google Security Settings page at https://security.google.com/settings/security/permissions.

5. Data Security & Retention

We employ industry-standard encryption protocols (SSL/TLS) to secure all data in transit. Your messages, user profiles, and media remain safely stored in cloud storage. Please note that data stored in Firestore database tables is encrypted using default Google Cloud infrastructure-level encryption at rest, rather than client-side end-to-end encryption.

6. Your Rights and Account Deletion

You have full control over your data. You can delete your account and associated information in one of two ways:

• In-App (Instant): In the VibeSync app, navigate to Settings and tap Delete Account. This permanently and instantly deletes all your data.
• Web Request (24-hour SLA): You can submit a deletion request by sending an email to vibesync.officials@gmail.com from your registered email address. We will verify your request and manually delete all your records within 24 hours.

Upon deletion, all of the following information is permanently purged:

• Your Firestore user profile, contact links, and presence state.
• All uploaded music tracks and custom playlists.
• All media files, images, and audio waveforms stored in Firebase Storage.
• Your login credentials from Firebase Authentication.
• Any associated device tokens and session records.

7. European User Rights (GDPR)

If you are a resident of the European Economic Area (EEA) or the United Kingdom (UK), you have specific rights under the General Data Protection Regulation (GDPR):

• Legal Basis for Processing: We process your data based on contractual necessity (to provide the chat and synchronization services) and legitimate interest (for gamification, analytics, and security).
• Right to Access / Portability: You have the right to request a copy of the personal data we hold about you.
• Right to Rectification: You can update and correct your personal data at any time via your in-app profile.
• Right to Restrict Processing: You have the right to request that we restrict the processing of your personal data under certain conditions.
• Right to Erasure: You can instantly delete your account as outlined in Section 6.

8. California Privacy Rights (CCPA)

If you are a California resident, the California Consumer Privacy Act (CCPA) grants you specific rights regarding your personal information:

• No Sale of Personal Information: We have not sold any personal information to third parties for a business or commercial purpose in the preceding 12 months.
• Right to Know & Delete: You have the right to request access to the specific pieces of personal information we have collected about you and request deletion of that data.

9. Children's Privacy

VibeSync is strictly restricted to users who are 16 years of age or older. We require users to confirm their age during registration and provide their Date of Birth during profile setup. We do not knowingly collect personal data from anyone under the age of 16. If we become aware that we have inadvertently collected data from an underage user, we will immediately delete that account and all associated data.

10. Contact Us

If you have any questions about this Privacy Policy or our data handling practices, please contact us at vibesync.officials@gmail.com.