Legal
Plain-language summary: We only collect what we need to run ProtoVibing for you. Your ideas, documents, and interview notes are yours. We do not sell your data. We do not train AI models on your content. Voice recordings never leave your device. You can export or delete your data at any time.
This Privacy Policy explains how Pathfinder Foundry, LLC (“ProtoVibing,” “we,” “our,” or “us”) collects, uses, and protects information when you use protovibing.ai, alpha.protovibing.ai, and related services (the “Service”). By using the Service, you agree to this policy.
ProtoVibing is operated by Pathfinder Foundry, LLC, a limited liability company organized under the laws of the State of Washington, with its registered address at 522 W Riverside Ave, Ste N, Spokane, WA 99201. If you have questions about this policy or how your data is handled, contact us.
We try to collect as little as possible. Here is everything:
ProtoVibing offers two ways to sign in:
GitHub sign-in (required for Project Owners). When you sign in with GitHub, we receive your GitHub username, display name, email address, and profile picture, plus a GitHub access token used only to create and update project repositories on your behalf. We do not receive or store your GitHub password.
Magic link email sign-in (Reviewers, Editors, Viewers, and anyone else). When you sign in with a magic link, we receive only your email address and the fact that you clicked a verification link. No password, no third-party identity provider.
In either case we also record the fact that you signed in and when.
Anything you produce inside ProtoVibing:
This content belongs to you. We store it in our database to make the Service work and to display it back to you and your invited collaborators.
When you interact with an AI agent inside ProtoVibing, we store:
We use this only to power your project and preserve your working history.
If you use the microphone to dictate to an agent:
Like most web apps, we automatically collect:
We use this to keep the Service running, fix bugs, and improve performance.
If you upgrade to a paid plan, our payment processor (Stripe) collects your payment details directly. We receive only a customer ID, your plan, and your subscription status. We never see or store your full card number.
If you provide your own API key for an AI provider (bring-your-own-key), we store it encrypted at rest using Supabase Vault. We use it only to run agents on your behalf and never share it with anyone else.
We use the information we collect to:
What we do not do with your information:
We share information only in these limited cases:
We use a small set of trusted vendors to run ProtoVibing. They only get the minimum needed to do their job, and they are contractually required to protect your information:
| Vendor | What they handle |
|---|---|
| Vercel | Hosts the web application and runs server code |
| Supabase | Stores your account, projects, and content in a managed Postgres database |
| GitHub | Authenticates your login and stores committed project artifacts in repositories on your account |
| Anthropic, OpenAI, Groq, and other AI providers | Process AI agent requests (messages, transcriptions) when you use their models |
| Inngest | Runs background jobs for long-running agent workflows |
| Resend | Sends transactional emails (notifications, invites, important updates) |
| Stripe | Processes payments if you subscribe to a paid plan |
Anyone you invite to a project as an Owner, Reviewer, Editor, or Viewer can see the project content appropriate to their role. This is a feature, not a leak.
We may disclose information if required by law, subpoena, or court order, or to protect the rights, property, or safety of ProtoVibing, our users, or the public.
If ProtoVibing is acquired, merged, or sells its assets, your information may transfer to the new owner. We will notify you before that happens and give you the opportunity to delete your data.
Your data is stored on servers operated by Supabase and Vercel, primarily in the United States. By using the Service, you consent to the transfer and storage of your data in the United States regardless of where you live.
When you delete a project or your account, we remove the associated data from our live systems within 30 days. Backups may retain copies for up to 90 additional days before being overwritten.
We use cookies for:
We do not use third-party advertising cookies or cross-site tracking.
You can disable cookies in your browser, but parts of the Service may not work.
Regardless of where you live, you can:
If you are in the European Economic Area, the United Kingdom, or California, you have additional rights under GDPR, UK GDPR, and CCPA, including the right to object to processing and the right to lodge a complaint with your local data protection authority. Use our contact form to exercise any of these rights and we will respond within 30 days.
We take security seriously:
No system is perfectly secure. If you believe your account has been compromised, report it immediately through our security contact form.
ProtoVibing is not intended for anyone under 18. We do not knowingly collect information from children under 13. If we learn we have, we will delete it. Parents or guardians who believe their child has provided information to us should contact us.
We may update this policy from time to time. If the changes are significant, we will notify you by email or through the Service before they take effect. The “Last updated” date at the top always reflects the current version.
Questions, concerns, or requests:
This policy is written in plain language and is not a substitute for legal advice. If you need formal legal documentation, consult a licensed attorney.
