Scope and operator.
This notice covers the Vibestarz website and hosted experience. It does not cover independent services, an event organizer’s separate activities, or apps hosted elsewhere. The operator’s legal identity, address, privacy contact, and effective date remain to be confirmed.
The information below reflects the application’s current design. Final deployment-specific provider contracts, logging, retention periods, and international-transfer arrangements need to be verified before this notice is adopted.
Information the experience uses.
| Information | Why it is used |
|---|---|
| Host identity and access | Authorize hosting and connect rooms to a host. Depending on deployment, identity may include a user ID, name, and email from sign-in, or an authorized host session. |
| Open-call submissions | Save your idea, chosen name, email, optional place, context, review stage, and consent record for producer review and follow-up. These submissions are private to the maker and authorized production team. A separate acceptance is required before an approved idea enters a public room. Your private idea page supports updates and withdrawal. |
| Project support and conversations | Save your chosen name, optional email, optional nonbinding pledge interest, and private messages to the project team. Authorized operators manage this pilot; your preferences and conversation are not public. Team updates are public. Leaving clears your name, email, and pledge interest; earlier messages remain accessible through your private link and to authorized operators. No automatic email is sent, and pledge interest does not authorize a charge. |
| Contact messages | Your name, reply email, topic, message and review status are stored privately for authorized operators. The form requires permission to review and reply; it does not enroll you in marketing. Messages are removed from the active database after 90 days on the next desk or form activity, or earlier by an operator. Backups may retain copies. |
| Room participation | Maintain membership, display names, role, votes, reactions, and any messages or build contributions you send. |
| Creative material | Process ideas, descriptions, lyrics, media, build instructions, and generated results into the selected experience. |
| Saved work and reports | Store episodes, app metadata, versions, contributions, and reports so work can be revisited and reviewed. |
| Device and request information | Deliver pages, adapt the install experience, maintain sessions, diagnose failures, and limit abuse. Requests expose information such as IP address and browser headers to hosting infrastructure. |
| Local preferences and app state | Remember an active room, participation mode, sound and haptic preferences, and data you enter into supported embedded prototypes. |
The app uses hashed credentials and short-lived rate-limit keys in parts of its server storage. Hashing these identifiers does not mean that every record is anonymous.
What other people can see.
Names you choose, ideas, room messages, reactions, and contributions may be visible to the host or other participants according to the room’s features. Results can include voting summaries and attribution. Assume material submitted to a show may be seen by others.
Published apps can appear in a public gallery with a title, idea, media, credits, versions, or source. A room expiring does not necessarily remove an app or archived episode. A person who receives a link can share it further.
Use a nickname and sample data where possible. Do not include passwords, API keys, financial details, private case records, or other sensitive information in ideas, chat, or build instructions.
How information is used.
Information is used to provide rooms, authentication, voting, generation, playback, build progress, saved results, moderation, and support; to protect the service; and to investigate operational problems.
Where data-protection law requires a legal basis, the final operator must identify the applicable basis for each purpose, such as providing a requested service, legitimate interests in security and operations, legal obligations, or consent where required. These bases are not interchangeable and must be confirmed for the actual service.
AI and infrastructure providers.
Material needed for a generation task is sent to configured service providers. Depending on the feature and deployment, the application includes integrations for Anthropic and OpenAI for AI work, fal for generated media, and ElevenLabs for music or voice. Hosting and storage can use Railway or Cloudflare infrastructure.
When audition email is configured, requested private-link emails and producer-triggered update notices use Resend. That provider receives the recipient address and message; a requested link email includes the private access link. Pending message contents are encrypted in the delivery queue and removed after provider acceptance. Changing contact details or withdrawing cancels pending retries; an email already in progress may still arrive. Verified delivery events retain provider message identifiers, delivery status and timestamps. Bounces, complaints and suppressions stop further email requests to the affected address. Studio monitoring can receive project-level delivery metadata; it excludes recipient addresses, subjects, message bodies and private links. Address verification and lost-link recovery are not provided.
A provider receives the task input relevant to its service, which can include ideas, lyrics, descriptions, build instructions, or generated content. The exact providers used vary by configuration. Provider retention, training use, subprocessors, and location depend on the applicable contract and settings; this page does not promise that all providers retain nothing or never use data for training.
A production provider list and contractual safeguards must be confirmed before final publication of this notice.
Other disclosures.
Hosts and authorized operators can access information needed to run and review the experience. Service providers process information to operate the product. Information may also need to be disclosed to comply with applicable law, address threats or abuse, or establish or defend legal rights.
A reorganization or transfer of the service could involve its records, subject to applicable protections and notice. No advertising tracker or data-sale integration was identified in the current application code review; that finding is not a substitute for verifying all deployed infrastructure and operational practices.
Storage and retention.
Room access has an expiry, while saved episodes, generated media, app versions, and moderation records can persist separately. Expired access is not the same as verified deletion. Server logs and backups may have their own retention periods.
Browser data can remain until it expires, the app updates it, or you clear it. Room cookies are configured for up to 30 days; the password-based host session is configured for 12 hours. See Cookies & storage for details.
The final notice must specify retention periods or criteria for server records, logs, backups, and provider copies. No automatic deletion deadline is promised by this draft.
Your choices and requests.
You can avoid optional submissions, leave a room, disable available sound or haptic features, and clear local site data. Clearing site data can remove access and unsynced prototype work; it does not erase server records.
Depending on where you live and which laws apply, you may have rights to access, correct, delete, or receive a copy of personal information, restrict or object to processing, withdraw consent, and complain to an appropriate authority. Some laws provide additional rights concerning sale, sharing, or sensitive information.
Use the privacy request route on the contact page. Include the relevant room or app link and a description of the request. We may need proportionate information to verify a request; never send a password or session token. The final operator must establish a functioning request channel and response process before adopting this notice.
Children and sensitive information.
The proposed self-service preview is intended for adults. It is not designed as a children’s service and has no established parental-consent workflow. An adult audience policy alone does not resolve every obligation if children use a service.
If you believe a child’s personal information has been submitted, notify the operator using the contact route. Programs involving children, sensitive records, or vulnerable participants require a separate design and review.
Security and international processing.
The application includes access controls, session protections, request limits, and restrictions around embedded generated apps. No service can guarantee absolute security. Avoid putting confidential material into an experimental shared environment.
Providers may process information outside your country. Applicable transfer mechanisms and contractual safeguards must be identified by the operator for the final deployment; no particular data-residency guarantee is made here.
Updates and questions.
Changes to the data practices should be reflected here with an updated date and any required notice or consent. For questions or requests, see Contact. This draft must be reconciled with actual operations before it becomes an effective privacy notice.