Privacy

Two separate subjects, kept apart: this website, and the VibeGuard software. What is true of one is not automatically true of the other.

Part 1 — This website

This site loads no third-party resources. No analytics, no tag manager, no error collector, no fonts or scripts or images from another host. Nothing runs in your browser: the pages are static HTML and CSS, and the Content-Security-Policy served with them says script-src 'none', so a script could not run even if one were added by mistake. You can check that yourself with a single curl -I.

No cookies are set and none are read. Nothing is written to local storage, session storage, or IndexedDB. There are no forms anywhere on this site, so there is nothing to submit.

At most one thing is counted

When you follow a link to a distribution channel, the redirect is served by a small worker. The most that worker will ever record is a counter, and a record has exactly three fields:

which channel the link pointed at, from a fixed list of names
the date in UTC
an integer — how many times that day

That is the whole record. It is stated first rather than last because a page that mentions counting only after three paragraphs of denial reads as though the counting needed hiding, and three fields do not.

As it stands the counter is not switched on: the storage it would write to has not been configured, and the worker skips the count when it is absent. So at the moment the redirect only redirects. This paragraph describes the ceiling either way — turning it on cannot add a fourth field without changing the code, this page, and the same commit.

What is not stored

Your IP address — not raw, not hashed, not truncated
Your user agent
The referring page
Your Accept-Language
Cookies — none are set and none are read
Any visitor identifier or session identifier, random ones included
Country, region, or network operator

The redirect worker does not read the request's headers or its body, so there is nothing to discard: the values above are not collected and then dropped, they are never looked at.

What the count cannot tell anyone

Crawlers and link prefetchers increment the counter like anyone else, and the number is not corrected for them — correcting it would mean inspecting the user agent, which is on the list above. Repeated clicks by one person are indistinguishable from clicks by several people, because nothing here distinguishes people. The number is a count of clicks. It is not a count of visitors, and it is not treated as one.

The limit of this statement

Everything above describes the code of this site. Hosting providers keep their own records at their own layer, and what those contain is not something this page has verified, so it is not claimed here either way.

Questions about any of this: https://github.com/YUTAKONDO1205/VibeGuard/issues

Part 2 — The VibeGuard software

A summary of PRIVACY.md, with the subject of each statement named. The point of a summary is to show you that there is a document worth reading, not to save you from reading it.

VibeGuard, the product: VibeGuard does not collect, transmit, store on our servers, sell, or share any data about you, your browsing, or the source code you analyze. VibeGuard never sends your code anywhere.
All four channels: All security analysis runs locally — in your browser with the Chrome extension, or on your machine with the CLI and the GitHub Action.
The Chrome extension only: The extension does not make any network requests. It works fully offline. This sentence is about the extension; it is not a statement about the CLI or the Action, and the summary does not widen it into one.
Reports you ask for: A finding carries the matched line and the matched text. When you ask the CLI or the GitHub Action to write a report — with --out, or a format of json, sarif or markdown — those fields go into the file. If you then publish it, for example by uploading SARIF to GitHub code scanning, whatever the finding matched travels with it. A scan report is as sensitive as the code it describes.
The Chrome extension, on your own device: The side panel keeps a scan history in chrome.storage.local, which survives restarting the browser. Each entry holds the first 200 characters of what you scanned, stored verbatim — for a pasted snippet, that is your raw code, and a credential inside those characters is kept as written. At most 50 entries are kept. The Clear button in the side panel's History section deletes them, and removing the extension does too.
Third parties: None. No analytics, no telemetry, no remote logging, no ad networks.

The no-network claim is machine-checked on every pull request, on every push to main, and again every Monday: .github/workflows/no-network-assert.yml. The workflow states its own scope, which is worth reading before treating it as covering more than it does.

Summarised from PRIVACY.md, last updated 2026-07-29. Where this summary and that file disagree, the file is right.