1. Who we are and what this policy covers
ApeMotion Technologies LLC provides VibeDesk and is responsible for the personal information described here. Contact our privacy team at support@apemotion.games. This policy covers the VibeDesk website at vibedesk.app and its web account services, including the account services used by that product.
This policy describes information we access on your device as well as information sent to us, our service providers, or a destination you choose. Device-to-device content and cloud account records are handled differently, as explained below.
2. Information we use and why
| Information | Purpose and destination |
|---|---|
| Account and sign-in information | Your verified email, account identifier, supported sign-in provider and provider identifier, login challenges, session credentials and security events. Provider authentication responses may also include basic profile fields, such as a name or profile image; VibeDesk uses the verified identity and email for authentication and does not use those profile fields for advertising. We receive sign-in information when you authenticate or use account services to protect access and keep the account working across devices. We do not receive your Google or Apple password. Email verification uses one-time codes. Different verified emails, including Apple private relay addresses, normally identify different accounts. |
| Devices and connections | Device names and identifiers, platform information, device public keys, last-seen times, IP addresses and connection status. The account and signaling services use this information to show your devices, authorize connections, find peers and prevent abuse. Connection start/end times, duration, participants and entitlement outcomes are used for mobile allowances, connection limits, billing eligibility and support. We do not use IP addresses for advertising profiles. |
| Purchases and membership | When web billing is offered, Stripe processes checkout and payment details. We process customer, product and transaction references, membership periods, renewal/refund status and verification or recovery records to administer your membership. Checkout may request your billing address and tax information; we retain required country, tax and transaction facts for accounting. Web account tools can also show membership purchased in an app store, using verified records supplied by the original provider. Native store purchases remain managed through their original stores; we do not receive their full payment-card numbers. |
| Support and security | If you contact us, we receive your email, message and any attachments or diagnostic information you choose to send. Share only what is needed. Services process request metadata, error outcomes and limited security records to operate safely, investigate failures and comply with applicable obligations. App diagnostic logs may also remain on your device; sending them to support is a separate choice. |
3. Website storage and browser information
Visiting the website sends the requested URL, IP address, browser/network information and request timing to our hosting and security provider, Cloudflare. Turnstile checks used for email sign-in process browser and network signals to resist automated abuse. Resend processes the destination email and delivery information for sign-in codes.
The website stores your chosen language in local storage. Web sign-in uses secure HttpOnly session cookies and an in-memory request protection token. Account deletion uses this tab’s session storage to preserve an operation through retries; after cleanup, a minimal receipt and limited status credential can remain for up to 30 days, or until the browser removes them. These journals do not store sign-in tokens, your email, device profiles or subscription identifiers.
Account pages let you view and manage account, device, usage and billing records originating from your VibeDesk apps. This website does not capture your screen, microphone, camera, photo library or clipboard to provide web account management. The apps’ content features are covered by their own platform policies.
There are no advertising cookies or marketing analytics added by VibeDesk. Security services and payment or sign-in providers may use their own necessary storage. You can clear browser storage, but doing so may sign you out, reset your language or remove a deletion receipt.
5. Service providers and other disclosures
We use providers only as needed for the features you use:
- Cloudflare: hosting, account and Tasks infrastructure, network protection and Turnstile verification. It processes the relevant account data, hosted content and request/network information.
- Resend: delivery of email sign-in codes, including your email address and delivery metadata.
- Google: Browser-based Google sign-in when you choose it.
- Stripe: web checkout, payment processing and subscription management when available. It processes the payment and billing information you supply in that web flow.
If your shared account has membership purchased through another VibeDesk product, the account service provides its verified status to this product. Payment and renewal remain with the original purchase provider.
We do not sell personal information, rent it for advertising, or share it for cross-context behavioral advertising. We may disclose necessary information to processors that operate the service, at your direction to a recipient, when required by law, to protect users or legal rights, or in a corporate transaction subject to applicable safeguards and notice. Independent stores, identity providers and recipients also process information under their own policies.
6. Security and international processing
We use encrypted transport, account and device authentication, access controls and limited retention to protect information. Browser sign-in cookies are HttpOnly; account-changing requests use additional request protection. Cloud-synchronized Tasks are protected by service access controls and encrypted transport, but are readable by the service for synchronization and are not end-to-end encrypted.
No system is completely secure. Keep authorization codes and account access private, use trusted devices, and disconnect sessions you no longer need. We and our providers may process information in the United States and other countries where infrastructure or support operates. Where applicable law requires transfer safeguards, we use the applicable contractual or other lawful mechanism. Contact us about your rights or transfers.
7. Retention and account deletion
You can request deletion from the app’s account settings or from the account deletion page, without installing an app. You must verify account ownership and confirm deletion. Signing out or uninstalling the app is not an account-deletion request.
- Account access: accepted deletion revokes account sessions and device authorization immediately. An existing offline peer connection may continue until disconnected or reconnected; end such sessions on your devices.
- Profile, devices and cloud Tasks: personal profile information, email/device associations and cloud Tasks data are scheduled for removal from primary services within 24 hours of acceptance. Deletion invalidates sign-in codes and operation credentials. Provider cleanup can continue separately; the receipt distinguishes these outcomes.
- Connection and usage details: up to 30 days after a connection ends, and no more than 30 days after account deletion.
- Security audit records: 90 days from the event. Task synchronization operations and superseded changes are normally cleaned on a 90-day schedule; current content remains while the account uses Tasks, and account deletion removes the account’s cloud Tasks records.
- Deletion receipt: a limited progress record and status credential are available for up to 30 days. They do not restore login access.
- Transactions and required accounting records: minimum purchase, refund and tax records are retained for 10 years after the relevant UTC calendar year ends. Minimum purchase-chain ownership and transfer facts remain while renewal or an unresolved matter requires them, then for 10 years after the year of the last substantive handling. Routine retries do not restart those periods. This does not retain an ordinary login email, device profile or connection IP indefinitely.
- Raw payment evidence: encrypted evidence is kept while necessary for verification, renewal, refunds or legitimate recovery. After the contract ends and related matters are resolved, it is removed as soon as practical, normally within 180 days.
- Provider authorization cleanup: successful revocation removes its encrypted credential. Failed revocations are retried for up to 30 days before the encrypted credential is removed and unresolved work is escalated. Only the necessary protected provider relationship remains for an unresolved case, with its reason and resolution condition reviewed at least every 90 days.
- Backups: deleted personal data ages out of backups within at most 30 days. Backups are not used for normal account lookups or marketing; deletion records must be reapplied before a restored backup returns to service.
- Current-month free allowance: if you register again with the same verified email, a keyed email digest and the minimum quota summary remain only until the UTC month ends. They prevent resetting already-used or cleared free time and do not restore the old account.
Specific unresolved disputes and legal obligations can require a separate, restricted hold. The reason, responsible owner and end condition are reviewed at least every 90 days. Support messages and attachments are retained as needed to resolve your request and applicable obligations; you may request their deletion. Data held independently by your sign-in or purchase provider, or by a recipient, follows that party’s policy.
Deleting a VibeDesk account does not cancel Apple or Google Play renewals. Cancel those subscriptions through the original store. Stripe cancellation, if relevant, has a separately reported result. Deletion does not erase computer files, local app data on every device or recipients’ copies. Re-registering creates a new account; recovery of valid remaining membership requires verification and does not restore old devices or content.
8. Your choices and privacy rights
You can manage signed-in devices, sign out, edit supported account/device settings, delete Tasks or request account deletion. For access, correction, a copy of your data, deletion, or an objection or restriction request, contact support@apemotion.games. We may verify your identity before acting.
Depending on your location, you may also have rights to portability, to withdraw consent for optional processing, to appeal a decision or to complain to your local data protection authority. We do not discriminate against you for exercising applicable privacy rights. Necessary processing supports the service you request; where relevant law applies, we rely on contract, legitimate interests in security and operation, legal obligations, or consent for optional uses. Withdrawing an optional permission stops that feature’s future access but does not undo actions already completed.
9. Children
VibeDesk is a remote productivity service and is not directed to children under 13 or a higher minimum age required by applicable law. We do not knowingly collect their personal information. If you believe a child has provided it, contact us so we can investigate and delete it as required. Do not use the service to monitor a child or another person without lawful authority and any required consent.
10. Changes and contact
We identify the policy’s update date above. We will provide notice of material changes and request additional consent where required before using information for a new purpose. For privacy questions or requests, contact ApeMotion Technologies LLC at support@apemotion.games.