Privacy policy
LetsVibe is built to collect as little as possible. We do not use analytics, ads or trackers, we never ask for your email address, and you can delete everything yourself at any time.
Last updated 11 November 2026
The short version
- We store your public GitHub username, numeric ID and avatar link so you can sign in and so we can confirm which repositories are yours. Nothing else about you.
- Graded reports are public. They show your username, avatar, repository name and scores.
- Your code is copied temporarily, graded by AI models running on LetsVibe's own computer, and the copy is deleted. It is never sent to an AI company.
- You can export or delete your data from My Data instantly, with no request to anyone and no notification sent.
Who runs LetsVibe
LetsVibe is an independent project run by an individual developer, Todd (GitHub: Todd0042). For anything about your data, email [email protected].
What we collect
When you browse without signing in
Nothing is stored about you. Your browser must send standard technical information (such as your IP address) to load any website; LetsVibe uses it only to deliver the page and does not keep access logs. All pages, fonts, scripts and images are served from LetsVibe itself, so your browser does not contact other companies while you browse. Images of GitHub avatars and project icons are fetched by our server and passed on to you, so GitHub does not see your visit.
When you sign in with GitHub
We request GitHub's read:user permission only, and store:
- your GitHub numeric ID and username,
- the link to your public GitHub avatar,
- when you first signed in and when you last signed in,
- your submission allowance and beta-tester status,
- which version of the terms of use and privacy policy you accepted, and when (you accept them, and confirm you are 18 or older, before signing in).
GitHub gives us a temporary access token, which we use once to read your public profile and then discard. We do not store it. We never request or store your email address, even if it is public on GitHub. Your username and avatar are refreshed each time you sign in.
When you submit a repository
- The repository's public contents, including its commit history, are copied to a temporary folder for grading and deleted when grading ends.
- The report we generate is kept: scores, written findings, the verdict, measurements (such as lines of code and complexity), the detected category, platforms and hardware, a short excerpt of your README, the graded commit ID and when it was graded.
- Queue history: which repository was submitted, by which account, when, and whether it succeeded.
Possible hard-coded secrets found in your code are recorded by type only (for example "API key, 1 occurrence"). Their location and contents are never stored or published.
When you submit an appeal
We store the text you write, the repository it concerns, your GitHub username, and the decision.
When a report needs your input before publishing
The unpublished report is stored privately together with the specific lines of your code it asks about (file, line numbers and the lines themselves), your explanation once you give one, and the dates involved. Only you and the site operator can see it. It is deleted as soon as it is published, withdrawn by you, or removed after review, or automatically 7 days after the request if no explanation is given.
When you report an error in a review
We store the statement you disputed, your explanation, the outcome of the automatic check against your code (and of manual review, if needed), and the dates. Confirmed corrections are applied to the published report, which notes that it was corrected.
In your browser
A few strictly necessary items keep you signed in. They are listed in the cookie policy.
What is public
LetsVibe is a public leaderboard. For every graded repository, anyone can see the owner's GitHub username and avatar, the repository name and link, and the full report. Your account itself (sign-in dates, allowance, appeals, queue history) is never public.
How we use it
- To sign you in and confirm you own the repositories you submit.
- To grade repositories and publish the results on the leaderboard.
- To enforce fair-use limits and review appeals.
- To keep the service secure and working.
We do not sell, rent or trade any data, use it for advertising, build profiles of people, or use your code to train AI models. Grades describe a repository at one commit; they are not decisions about you as a person.
Legal bases for processing
Where data-protection laws such as the EU and UK GDPR apply, we rely on these legal bases:
- Performing our agreement with you (contract): signing you in, grading the repositories you submit, publishing their reports, handling your appeals, explanation requests and error reports, and carrying out your export and deletion requests.
- Legitimate interests: keeping the service secure and working, preventing abuse, enforcing fair-use limits, keeping short-lived backups, and reviewing code before a report is published. We have weighed these against your interests: the data involved is minimal, mostly already public on GitHub, and you can delete it at any time.
- Legal obligation: if we are ever required by law to keep or disclose specific information.
We do not rely on consent for any processing, because we do nothing optional with your data: there are no analytics, advertising or marketing. Where processing is based on legitimate interests, you may object by emailing us; you can also simply delete the data yourself on My Data. Grades are produced automatically, but they assess a repository at one commit and have no legal or similarly significant effect on you.
Services involved
| Service | What it does | What it sees |
|---|---|---|
| GitHub | Sign-in; hosting of the public repositories we copy; avatars and icons (fetched by our server) | Your sign-in on GitHub's own pages; requests from our server, not from your browser |
| Cloudflare | Delivers LetsVibe securely over HTTPS | Network traffic to the site, as with any website on its network, under Cloudflare's privacy policy |
| Ko-fi | Optional support for LetsVibe | Only what you share with Ko-fi if you choose to visit it; LetsVibe receives nothing from it about your LetsVibe account |
The AI models run on LetsVibe's own hardware. No AI provider receives your code or data. We may disclose information if required by law, and only what is required.
How long we keep it
- Temporary repository copies: deleted as soon as grading finishes, or at the next server start if grading was interrupted.
- Reports and projects: until you delete them, delete your account, or the repository is removed by us.
- Your account: until you delete it.
- Cached avatars and icons: until the project or account they belong to is deleted.
- Reports awaiting your input: until published, withdrawn or removed, and never more than 7 days without an explanation.
- Error reports: until you delete the project or your account.
- Deletion progress: kept in memory for up to one hour so your browser can show the result, without project names.
- Backups: a copy of the database (accounts, reports, appeals and queue history) is made once a week, and only the two most recent copies are kept, so no backup is ever more than about two weeks old. Backups stay on LetsVibe's own server.
When you delete anything, it is removed from the live service and from every backup at the same moment; backups are never taken half-way through a deletion. Deleted records are overwritten in the database files rather than just marked as removed. If a backup ever cannot be cleaned, that whole backup is destroyed rather than kept.
Your controls and rights
Everything below is self-service on My Data, and nobody is notified when you use it:
- See and export everything we store about your account as a JSON file.
- Delete one project, all of your projects, or your entire account. Account deletion also signs you out on every device.
- Correct your username or avatar by changing them on GitHub and signing in again.
Depending on where you live, you may have further rights, such as to object to processing or to complain to a data-protection authority. Email [email protected] and we will help; you do not need to give a reason.
Security
Connections use HTTPS. Sign-in sessions are cryptographically signed, kept only in a cookie that page scripts cannot read, expire 30 days after your last visit, and stop working immediately if the account is deleted. The GitHub sign-in is protected against forgery. We request the minimum GitHub permission, never store GitHub access tokens, and only the repository owner can submit, re-grade, appeal or delete a project. No system is perfectly secure; if you believe you have found a vulnerability, please email us privately.
Age requirement
LetsVibe is for adults. You must be 18 or older, or the age of majority where you live if that is higher, to create an account, and you confirm this when you sign in. We do not knowingly hold data about anyone younger. If you believe someone under that age has an account, email [email protected] and we will delete it.
Changes to this policy
If we change how we handle data, we will update this page and its date before the change takes effect. Material changes will also be noted on the leaderboard.