How your data is handled.

Scope

This policy covers the VIBE CTRL website and macOS app, published by Ailin (艾林). The current download is a workflow preview; the public release and checkout are being prepared. Membership and trial offers are described in the terms of service and apply when the relevant features open. Earlier installed releases and Dev may differ. Third-party software and services have their own account, pricing, quota and privacy rules.

• Terms of service

Local settings and device information

The app stores environment settings, control modes, mappings, associated app names and identifiers, device identifiers, Bluetooth voice associations, and audio output options in local preferences.

Removing a device retains a local configuration archive. A read error may also preserve an original backup.

To switch profiles and execute mappings, the app reads the foreground app’s identifier and device inputs, then sends mouse and keyboard events. This information is not uploaded to the publisher. The app does not read or save your chat content or log the full text typed on your computer keyboard.

Voice and dictation tools

External dictation shortcuts trigger your selected tool and its microphone. Supported remotes send audio while the voice button is held; VIBE CTRL decodes it in memory and routes it to a local audio device or virtual microphone. External tools follow their own settings and privacy policies.

When selected, Built-in Voice uploads remote audio over HTTPS to the VIBE CTRL service, which forwards it to a third-party speech recognition provider. Audio and recognized text are processed in memory without recording files or database content storage. Text is inserted using keyboard events. The provider processes data under its own terms and privacy rules.

Each account shares 10 free minutes daily across Macs, resetting at midnight Asia/Shanghai. The server retains account associations, dates, request IDs, sample counts, states and timestamps for quota enforcement and duplicate prevention, without audio or text. Explicit failures release usage; unknown outcomes after timeout or interruption may retain usage. Contact the publisher to request record deletion.

Local audio tests do not upload audio, start recognition or consume quota. Built-in Voice requires valid sign-in; device control and external dictation retain their existing membership requirements. This feature requires a compatible app version and administrator activation.

Local diagnostics

The app retains local summaries of the last 20 dictation sessions, the last 80 voice-button routing events, and the latest audio test. These may include time, duration, device identifiers, Bluetooth associations, sample counts, audio peaks, and failure reasons, but no audio or dictated text.

Clear them in Settings → Privacy Policy. This preserves mappings and voice associations; later use creates new records.

When hardware diagnostics are explicitly enabled in Dev, the app may also write local device state and button statistics, without voice content.

Optional Codex usage display

When enabled, the app starts a local Codex CLI service and requests usage data through local pipes, caching remaining allowance, reset times, and the plan name. The CLI may use its existing sign-in to contact OpenAI.

VIBE CTRL does not request account passwords or API keys, or use this feature to read or submit conversations. Turn it off in Settings → General to stop the service and refreshes without affecting controls.

Apart from the account, membership and update requests described below, the app sends no usage analytics to the publisher and includes no advertising, behavioral analytics, or third-party crash-reporting SDKs.

Permissions and optional components

Accessibility enables mouse and keyboard output. Input Monitoring reads supported remote buttons; Bluetooth connects their voice channels. macOS manages these permissions and you can revoke them.

Controller-only use does not require Bluetooth authorization for remote voice. Dictation tools request their own microphone permissions.

The optional virtual microphone requires administrator authorization, routes audio locally, and has no network service. Deleting the app does not automatically remove this system component.

Retention and deletion

Local settings and caches remain until you clear or remove the corresponding preferences or replace them with new settings. Uninstalling may leave preferences retained by macOS.

Dev and release apps use separate preferences. Contact the publisher for help removing all settings, archives, caches, or the optional audio component.

Your website account is retained until you request deletion. To delete your email account and sign-in records, contact the publisher from that email address. Manage third-party data through the relevant service.

Updates and contact

This policy and its date will be updated when data processing changes. For privacy questions or deletion assistance, contact Ailin (艾林): kinggreenhall@gmail.com.

Website account and downloads

Cloudflare Workers, D1, R2 and Email Service provide email verification and downloads. After the first successful verification we store a random user ID, email and creation time. We do not request a name, avatar, phone number or password.

Codes expire after 10 minutes, are stored only as keyed hashes, and allow up to 5 attempts. Expired records are cleaned daily. Code emails are for sign-in only.

An HttpOnly cookie keeps you signed in for 180 days, after which verification is required again. Signing out revokes the current session immediately. The server stores only a session-token hash, user association, and start and expiry times.

Abuse counters use keyed hashes of the email and IP address, without storing raw IPs; expired counters are cleaned daily. Cloudflare also processes requests and email delivery data under its service policies.

Accounts support downloads and future purchases. Online payment is not yet integrated and we do not collect card details. The website does not receive app audio, dictated text or device settings.

App accounts, devices and membership

Browser email sign-in and registration use state, PKCE and a one-time callback. No activation code or Keychain confirmation is needed. The server stores account associations, device names, random installation identifiers, session creation and activity times, credential digests, expiry and revocation state. Each account supports two signed-in App devices, listed and removable on the website.

The app generates no account signing key and does not access Keychain. Session credentials and signed state are stored in local Application Support with directory permissions 0700 and file permissions 0600, using restricted temporary files and atomic replacement. This protects access between system users; it does not provide independent encryption or isolation from other processes running as the same user. Old Keychain entries are not read, migrated or deleted. The installation identifier remains after sign-out to avoid counting reauthentication as a different installation.

Sessions last up to 180 days; signed state is cached for up to 30 days. Expired cached sign-in requires online verification. The app normally checks session status every minute using its in-memory credential, backing off to five minutes after network failures, without rewriting credential files. Remote removal takes effect in the app on the next successful online check, stopping control and dictation and returning to sign-in. Sign-out clears local credentials and attempts server revocation, retaining button settings.

Membership and device seats are independent of account sign-in. The server also retains membership expiry, purchase or gift records, membership device links and verification times. Pending gifts require email verification. Temporary browser login records contain state, PKCE challenge, installation identifier, device name and ticket digests, expire after ten minutes and are cleaned daily. The verifier stays in the app; callback codes are single-use.

The account service does not receive hardware serial numbers, MAC addresses or button mappings. Optional Built-in Voice processes audio and recognized text as described above. Public IPs are used only as keyed short-lived rate-limit digests. Removing an App sign-in or membership device requires email verification within ten minutes. Contact the publisher for account and entitlement data deletion requests. Real payment processing is not connected.

Trial and entitlement records

When the trial feature opens, the server records eligible account registration times, the start and end of a one-time trial, and purchased or gifted entitlements and their status. These records support access, expiry calculations and prevention of repeated trials. The published offer supports up to two Macs for both trial and paid access; control and dictation require a valid trial or membership. Sign-in sessions and entitlements are separate, and offline caching cannot extend entitlement expiry.

These records do not include audio, dictated text, button mappings or hardware serial numbers. A refund may adjust the related order entitlement without automatically deleting the account or local settings.

Checkout and Paddle

Paddle has been selected as the payment provider and merchant of record for CNY and USD software purchases; live payments are not open yet. Once checkout opens, Paddle processes payment and fraud-prevention data under its own privacy policy. This may include email, name, billing region or address, tax details, payment information, IP addresses and transaction records. The checkout and Paddle policies identify the information required.

Vibe Ctrl receives the order or transaction identifier, account association, product, currency, amount, and payment or refund status needed to provision access, reconcile orders, provide refunds and resolve disputes. We do not request full card numbers, security codes or payment passwords through the website or support email, or store those complete payment credentials in this project’s account database.

The current offer is software only and collects no shipping address; Paddle may separately require a billing address. Order, refund and dispute records may remain after account deletion where needed for transaction verification and legal obligations. Contact the publisher or Paddle about applicable data requests.

• Paddle privacy policy
• Refund policy

Update checks and downloads

Checking for updates or downloading packages sends ordinary network request information to the hosting service. Release feeds provide version and compatibility information; authenticated private downloads verify the account and short-lived download credentials. These requests deliver and protect distribution without receiving your audio, dictated text or mappings.

In app versions that support it, automatic checks can be disabled in settings while manual checks remain available. Finding an update does not authorize installation; downloading and installing require user choices. Formal release updates are still being prepared, and Dev and earlier installations may differ.