Privacy Policy

VibeGym ("we") is operated by Maksym Sych, a sole proprietor registered in Poland (NIP 5273145674), address: Zygmunta Hübnera 2/51, 01-756 Warsaw, Poland. We are the data controller for the personal data described here. Contact: support@vibegym.space.

• Account data — email address, optional name, timezone, locale, password hash (if you set a password).
• Learning data — quiz answers, Builder Readiness Score, training sessions, lesson progress, streaks and XP.
• Billing data — subscription plan and status. Card details are processed by Stripe; we never see or store your card number.
• Analytics data (only with your consent) — product events such as pages viewed and lessons completed, collected via PostHog. This includes your first landing-page path, referring website and campaign labels so we can understand how visitors reach the app. We do not copy arbitrary URL query parameters into this attribution record.
• Newsletter data — email address, signup source, consent version, request and confirmation dates, and subscription status. A newsletter subscription is separate from a training account.
• Technical data — server logs and error reports (Sentry) needed to keep the service secure and working.

• Contract — providing the training service you signed up for, processing payments, sending transactional email (sign-in links, payment receipts and failures).
• Consent — product analytics cookies; lifecycle emails where required; the optional newsletter after you confirm your email. You can withdraw analytics consent through "Cookie preferences" and newsletter consent through the unsubscribe link in an email.
• Legitimate interest — service security, fraud prevention, error monitoring.
• Legal obligation — accounting and tax records for payments.

We share data only with processors needed to run the service: Stripe (payments), Resend (transactional email and newsletter delivery), PostHog (analytics, with consent), Sentry (error monitoring), DigitalOcean (hosting). If you arrive from one of our ads, we also send Meta Platforms server-side conversion events (hashed email, ad click id, IP address and browser user-agent) to measure ad performance — no Meta cookies or scripts run on this site. Some processors are located outside the EEA; transfers rely on the EU Standard Contractual Clauses or an adequacy decision.

• Strictly necessary — sign-in session (httpOnly refresh token), anonymous quiz session (vg_anon), your cookie choice. The cookie choice is shared between our website and app and expires after 180 days. No consent needed.
• Analytics — PostHog identifiers, set only after you click "Accept analytics". A first-visit attribution cookie is shared between our website and app for up to 90 days after consent. Withdraw any time via "Cookie preferences".

Account and learning data are kept while your account exists. When you delete your account (Settings → Danger zone), your profile is anonymized immediately and any active subscription is canceled. Billing records are retained as required by tax law (typically up to 10 years).

Newsletter confirmation links expire after 24 hours. We retain subscription status separately from your account so an unsubscribe remains effective. Unsubscribing stops newsletter messages; you can also request deletion of the subscription record by contacting us.

Under the GDPR you can request access, rectification, erasure, restriction, portability, and object to processing. Account deletion is self-service in Settings. For anything else, email support@vibegym.space — we answer within 30 days. You may also lodge a complaint with your local supervisory authority.

We will announce material changes to this policy by email or an in-product notice before they take effect.