Privacy Policy

Family references expire after 24 hours; results stay until you delete them. Provider copies follow the provider’s own rules.

Family photo privacy

Family photos are generated through KIE using short-lived reference links, valid for about ten minutes. The template’s other chat, image, video and store services may use the other providers described below. Family photo generation does not use those providers as an automatic fallback.

VibePico reference photos expire after 24 hours; expired links stop working and scheduled cleanup removes stored copies. Results stay in your account until you delete them with the available deletion controls. These are our storage deadlines, not a promise about every provider copy. Face checks are described below and in the Biometric Information Policy.

Introduction

This Privacy Policy applies to VibePico at https://vibepico.com and its apps. VibePico is operated by Xhorizon Labs LLC, a Wyoming limited liability company ("VibePico", "we", "us" or "our"). Xhorizon Labs LLC is responsible for the personal data described in this policy. This page explains what we collect, why, who we share it with, how long we keep it, and how you can download or delete it.

Information We Collect

Account information — your name, email address and avatar, and, if you sign in with Google or Apple, the account identifier that provider gives us.
Content you create — the prompts and messages you send to the assistant, the images, audio and video you upload, the images and videos generated for you, and the messages you send to support.
Sign-up and security data — the IP address you signed up from, the country derived from it, and your language. We use these to limit abuse (for example, how many accounts can be created from one network, and that free sign-up credits are given once per mailbox; for this we keep a one-way hash of your email address).
Marketing attribution — how you first found us: campaign (UTM) parameters, ad click identifiers (such as Google's gclid), the referring site and the first page you visited, stored with your account at sign-up.
Usage and device data — features used, pages visited, device type, operating system and browser, collected through our analytics tools.
Cookies — a session cookie that keeps you signed in, cookies that remember your language and preferences, and first-party cookies used for the attribution above.
Payment information — website payments are processed by Stripe and PayPal. Purchases in the iOS app are processed by Apple, with RevenueCat used to verify and manage store transactions. We keep the order details (product, amount, currency, status) and the payer email, name and transaction identifiers the processor returns. For iOS purchases, we share your VibePico account ID with RevenueCat and receive purchase and subscription information, including product and transaction identifiers, status, purchase dates and expiry dates. We never receive or store full card numbers or your Apple account password.

How We Use Your Information

To provide the service: run your generations, store your chats and media in your Library, and keep your credit balance.
To process payments, issue credits, send receipts, and handle refunds and chargebacks.
To send account, security and support messages.
To detect and prevent fraud and abuse.
To understand how the service is used and which channels bring new users, so we can improve it.

We do not sell your personal information and we do not use your content to train our own AI models.

Family Portrait Checks

Photo preparation can use a detector on your device to count faces and help you inspect their size and position. For new family portrait generations, our server also counts faces in the image returned by the generation provider before settling the reserved credits. If the count differs from the requested number of people, the task uses its one system retry; a second mismatch fails the photo and releases its reserved credits. Detector availability problems are checked again before the task fails. A matching count does not establish identity or guarantee a likeness, and the detector can miss faces.

These checks do not identify people, create identity embeddings or build face profiles. Local review crops and face positions stay on your device. Server detection processes the returned image in memory and retains only aggregate counts and task outcome information, not face geometry. The detection model is fetched from our public media host; photo pixels are not included in those model downloads. Generation itself still sends references to the selected AI provider as described below.

Family portrait references expire after 24 hours. Access is denied after expiry and scheduled cleanup removes stored copies. Results are kept until you delete them using the available photo, task or account controls; once deleted, access stops immediately and scheduled cleanup removes the stored copy. Task and billing metadata follows the account and billing retention rules below. Copies held by an AI provider follow that provider's own retention terms.

AI Providers

When you ask VibePico to write, generate or edit something, your prompt and any media you attach are sent to the AI provider that runs that request. Today these are:

DeepSeek — the chat assistant (language model).
EvoLink and KIE — image and video generation.
Depending on the model you choose: fal.ai, Replicate or Google (Gemini).

Other template media tools: Providers receive media through short-lived signed links (valid for about two hours). Each provider processes your content under its own terms and privacy policy. We will update this list when we add or remove a provider.

Other Service Providers

Cloudflare — hosting, database and file storage.
Stripe and PayPal — website payments.
Apple and RevenueCat — iOS in-app purchases, subscription verification and purchase management.
Resend — transactional email.
Google and Apple — sign-in, if you choose them.
Plausible and OpenPanel — product analytics.
GitHub — encrypted database backups.

We may also disclose data to comply with the law or a lawful request from public authorities, or to protect our rights, property or safety, or that of our users.

Sharing You Control

Chats and media are private by default. If you make a chat public or share a link to a result, anyone with the link can view it until you make it private again or delete it.

Temporary signed links issued for media previews or AI providers remain usable until they expire. Changing a chat to private or deleting it revokes public access through unsigned links.

Data Retention

Your account and content are kept while your account exists.
Deleting a chat removes its messages and prompts; the media it produced stays in your Library until you delete your account.
Deleting your account permanently deletes your chats, prompts, generation history, uploaded and generated media, support tickets, sign-in methods and API keys, and anonymizes your profile (name, email, avatar, IP address and attribution data are erased).
Billing records (orders, subscriptions and the credit ledger) are kept after account deletion, detached from your name and profile, for as long as tax, accounting and chargeback rules require.
The hashed email used to grant free credits once is kept to prevent abuse; it cannot be turned back into your address.
Backups of our database are encrypted, exclude sign-in sessions and tokens, and are deleted automatically after 30 days, so deleted data disappears from backups within that time.

Data Security

We use encryption in transit, encrypted backups, access controls and regular reviews. Media is stored in private storage and served only through our service. No method of transmission over the Internet is 100% secure, but we work continuously to protect your information.

Your Rights

You can access, correct, download or delete your personal information at any time:

Download your data — Settings → Profile → Download my data gives you a JSON file with your profile, chats, generations, orders and credits.
Delete your account — Settings → Profile → Delete account. Eligible website subscriptions are canceled first, and unused credits are forfeited. Apple subscriptions must be canceled separately in your Apple account subscription settings; deleting your VibePico account does not cancel them.
Correct your profile — Settings → Profile.

You can also email us at contact@vibepico.com for any of these requests, or to object to or restrict a use of your data. Your data may be processed in the United States and other countries where our providers operate.

Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by updating the date at the top of this page and, where appropriate, sending a notice through the service.

Contact Us

VibePico is operated by Xhorizon Labs LLC. If you have questions about this Privacy Policy, open a support ticket from your dashboard or email contact@vibepico.com.