Privacy Policy

This Privacy Policy explains how MAHD LLC ("Vybeshot", "we", "us") collects, uses, and shares information when you use the Vybeshot app, the website at vybeshot.com, and related services (the "Service"). Vybeshot is intended only for users 18 and older. By using the Service, you agree to this Policy.

1. Information we collect

Information you provide

• Account information — email address, password (stored only as a secure hash), username, and display name. If you sign in with Google, we receive basic profile information and a Google account identifier.

• Profile and age information — your date of birth (used to verify you are 18+), and optionally a profile photo, bio, and gender. Date of birth and gender are set once and cannot be changed in-app afterward.

• Content and uploads — the prompts you enter; images and videos you upload (including for image-to-image generation and the Characters feature); the characters, posts, collections, comments, and captions you create; and the AI outputs you generate.

• Communications — messages you send other users, support requests, and reports you submit.

• Waitlist (website) — if you join the waitlist on our website, we collect your email address.

Information collected automatically

• Device and session data — device identifier, device name and model, operating system, app version, and IP address, collected with requests and stored with your sessions.

• Usage and analytics data — interactions such as posts you view (with view source, device, and IP), generation and subscription activity, and similar app analytics. We maintain some analytics ourselves and also use third-party analytics (Google Analytics for Firebase) to understand how the app is used and to measure our advertising.

• Advertising and measurement data — to measure the performance of ads we run (for example, on Google and Meta), we and our measurement partners process limited event and device information, including ad-attribution data and — only with your permission, as described in Section 14 — your device advertising identifier (IDFA).

• Push tokens — a push-notification token so we can send notifications.

• Security logs — sign-in events, registration attempts, and audit records (with IP and device), used to protect accounts and prevent abuse.

• Anti-bot data (website) — we use a third-party bot-protection (CAPTCHA) service on certain forms; that provider processes your IP and challenge data and may set its own cookies.

Payment information

Purchases are handled by Apple through In-App Purchase. We do not receive your full payment card details. We receive and store transaction identifiers and subscription status from Apple, and we share consumption information with Apple as described in the Subscription Policy.

2. Sensitive content: photos of people, likeness, and face data

If you upload media of people — for example, photos, video, or audio used to create a Character or to generate content — those uploads, and the characters and outputs derived from them, may depict or reveal information about identifiable individuals, including their face. We use this media solely to perform the generation you request.

We do not perform facial recognition, and we do not create, derive, or store biometric face templates, faceprints, or any other biometric identifier. We do not use face data to identify, verify, or track any person. Media you upload is treated as ordinary image, video, and audio content for AI generation, not as a biometric identifier.

To produce your result, your uploads are sent to the third-party AI providers listed in Section 4, which process them under their own privacy policies. We hold your uploads only on our own secured servers for the brief period needed to process the request. The original images, video, and audio you upload for a generation are permanently and automatically deleted from our systems as soon as that generation finishes, whether it succeeds or fails.

You are responsible for having the necessary consent and rights for any person depicted, as required by our Terms of Use. Do not upload images of minors or of anyone who has not consented.

3. How we use information

• To provide, operate, and improve the Service and generate the content you request;

• To create your account, authenticate you, and maintain security;

• To process subscriptions, grant and track Vybes, and prevent payment abuse;

• To send service and transactional messages (e.g., email verification, payment and subscription notices) and push notifications;

• To moderate content, enforce our Terms, and respond to reports and legal requests;

• To analyze usage and maintain the reliability and safety of the Service;

• To measure and optimize the performance of our advertising; and

• To comply with legal obligations.

4. AI processing and third-party providers

To generate content, we send your prompts and any images or videos you provide to third-party AI providers that run the AI models. These providers process your inputs to return a result and apply their own safety filtering, and they handle your inputs under their own terms and privacy practices. Do not submit information, or images of any person, that you would not want sent to a third-party AI service.

Depending on the model you select, your prompts and uploaded media are sent to one of the AI providers below. Each provider processes your inputs under its own privacy policy:

• OpenAI — GPT Image models. Privacy Policy.

• Google — Imagen and Gemini (including "Nano Banana") image models. Privacy Policy.

• Stability AI — Stable Image and Stable Diffusion (SD 3.5, SDXL) models. Privacy Policy.

• Alibaba Cloud — Qwen, Wan, and Z-Image image and video models, via Alibaba Cloud Model Studio. Privacy Policy.

• Ideogram — Ideogram image generation, editing, face swap, and upscaling models. Privacy Policy.

As we add or update models, we may also send your inputs to the following providers:

• Kling AI (Kuaishou) — video models. Privacy Policy.

• MiniMax (Hailuo) — video models. Privacy Policy.

• Black Forest Labs — FLUX image models. Privacy Policy.

• ByteDance (BytePlus) — Seedance video models. Privacy Policy.

We share your inputs with these providers solely to generate the content you request, under agreements that limit their use of your data and require protections consistent with this Policy. Some providers may also retain or use submitted content to provide, secure, and improve their own services in accordance with their own privacy policies (linked above). The specific providers we use may change as we add or update models, and we keep the list above current.

5. How we share information

• Service providers / sub-processors — we share data with vendors that host and run the Service (see the list below).

• Advertising and analytics partners — we share limited usage and event information (such as app opens and completed subscriptions, including amount and currency) with analytics and advertising-measurement providers — currently Google (Google Analytics for Firebase and Google Ads) and Meta Platforms (Facebook and Instagram) — to measure and optimize our advertising. We do not share your name, email address, or password with these partners for advertising. See Section 14 for your choices.

• Public content — content you choose to make public (posts, profile, comments) is visible to others and may appear on our public website and in social previews. Private content is not published.

• Legal and safety — we may disclose information to comply with law, enforce our Terms, or protect the rights, safety, and property of users, the public, or MAHD LLC, including reporting child sexual abuse material.

• Business transfers — in a merger, acquisition, or sale of assets, information may be transferred subject to this Policy.

We do not sell your personal information.

6. Categories of service providers

We share personal data only with service providers that help us operate Vybeshot, under agreements that limit their use of it. These fall into the following categories:

• Cloud hosting, storage, and delivery — to store and serve your account data, uploads, and generated media, and to send transactional email.

• AI generation providers — to process your prompts and uploaded media and return generated results (see Section 4).

• Authentication and notifications — for Google sign-in and push-notification delivery (via Apple and Google).

• Advertising and analytics — for app and advertising analytics and to measure the performance of our marketing (Google Analytics for Firebase, Google Ads, and Meta).

• Payments — Apple, which processes subscription purchases.

• Security and anti-abuse — for bot protection, rate-limiting, and logging.

The specific AI generation providers we use are listed in Section 4. A current list of our other service providers is available on request at hello@vybeshot.com.

7. Notifications and email choices

You can control push notifications in your device settings. You can opt out of subscription renewal reminder emails in-app; certain transactional messages (such as email verification, payment failures, and subscription status changes) are necessary to operate your account and cannot be turned off while you have an account.

8. Data retention

We keep information for as long as your account is active and as needed to provide the Service, then retain it as required to comply with legal obligations, resolve disputes, prevent abuse, and enforce our agreements. Backups and logs may persist for a limited period after deletion.

9. Your rights and choices

Depending on where you live, you may have rights to access, correct, delete, port, or restrict the processing of your personal information, and to object to certain processing. To exercise these rights, contact hello@vybeshot.com. We will verify your request and respond as required by applicable law (including the GDPR and the CCPA/CPRA). You will not be discriminated against for exercising your rights. Note that date of birth and gender are set once and not user-editable in-app; contact us to correct them.

10. Deleting your account

You can request deletion of your account and associated personal data by contacting hello@vybeshot.com. We will delete or de-identify your data except where we must retain it for legal, security, or backup reasons. You can also delete your account directly in the app from your profile menu (Delete Account).

11. Security

We use technical and organizational measures to protect your information, including password hashing, encrypted transport, signed media URLs, and session controls. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

12. International data transfers

We and our providers operate in the United States and other countries, and some AI providers process data internationally. By using the Service, you understand your information may be transferred to and processed in countries with different data-protection laws than yours. Where required, we rely on appropriate safeguards for such transfers.

13. Children

The Service is for adults 18 and older. We do not knowingly collect personal information from anyone under 18. If we learn we have collected data from a minor, we will delete it. Contact us at hello@vybeshot.com if you believe a minor has used the Service.

14. Advertising, analytics, and tracking

We measure how the app is used and how our marketing performs, using the following:

• Apple SKAdNetwork / AdAttributionKit — a privacy-preserving framework that reports aggregated ad-conversion data to advertising networks without identifying you individually.

• Analytics and ad-measurement providers — we use Google Analytics for Firebase, and we share conversion events (such as completed subscriptions) with Google Ads and Meta, to measure and optimize our advertising. These providers process this information under their own privacy policies (Google; Meta).

• Device advertising identifier (IDFA) — we use your device's advertising identifier to measure advertising across other companies' apps and websites only if you grant permission through Apple's App Tracking Transparency prompt. You can decline, and you can change your choice anytime in Settings → Privacy & Security → Tracking. If you decline, we rely only on the privacy-preserving methods above.

On our website, with your consent, we use advertising cookies from Google Ads and Meta to measure our marketing and to show you relevant ads (remarketing); you can accept or decline these through our cookie banner. The website also uses a third-party bot-protection service on forms, which may set cookies necessary to operate.

15. Changes to this Policy

We may update this Policy from time to time. We will update the date above and, for material changes, may provide additional notice. Your continued use of the Service after changes take effect constitutes acceptance.

16. Contact us

MAHD LLC — hello@vybeshot.com.