Effective August 26, 2026
Vibe Rater is operated by ThinkForge AI LLC, the legal entity identified as the seller on the App Store product page. Questions and privacy requests can be sent to hello@getviberater.app.
Account and identity data. Hosts sign in with Apple. Vibe Rater receives Apple’s app-specific user identifier, a one-time authorization code, and the name a host chooses to provide. The authorization code is exchanged with Apple for a refresh token. That refresh token is encrypted before storage and used only to maintain or revoke Apple authorization. Vibe Rater does not request an email address from Apple.
Table data. We store the table title, participant display names, bill total and line items, who paid what, the host’s adjustment cap, one-to-five ratings, calculated shares and transfers, and self-reported settlement status.
Optional content. Participants may add a comment and payment instructions such as a Venmo handle or Zelle email. These fields are visible only within the relevant table and operational moderation tools.
Security and request data. The service processes session cookies, invite tokens, IP addresses, and request metadata to authenticate requests, prevent replay, enforce rate limits, investigate abuse, and keep the service available. Raw invite and session tokens are stored only as hashes. IP addresses used for the in-memory sign-in rate limit are not intentionally retained by Vibe Rater as a user profile.
On-device receipt scan. Camera frames and receipt images stay on the iPhone. Apple Vision text recognition runs on-device. Vibe Rater receives only the bill information a host reviews and submits.
We use the data above only for app functionality, security, fraud and abuse prevention, support, legal compliance, and maintaining the exact settlement result. We do not use it for third-party advertising, developer advertising, cross-context behavioral advertising, data brokerage, or model training.
Comments never affect money. Comments are not attributed to their author when results are shown, but they are not technically anonymous. Authorship is retained so participants can report content and Vibe Rater can investigate it.
Ordinary comment text is cleared 72 hours after results are shown. When a comment is reported, a restricted copy may be kept for up to 90 days for abuse review, then cleared unless a longer period is required by law or needed for an active safety matter.
Vibe Rater uses Cloudflare to host the web and API service and Supabase to host PostgreSQL data. They process data for Vibe Rater under their own security and data-processing terms. Apple processes Sign in with Apple. If a user chooses to open Venmo, Cash App, or another payment service, that separate service receives data only through the user-directed handoff and applies its own privacy policy.
Vibe Rater uses HTTPS, secure HttpOnly cookies, hashed session and invite tokens, server-side calculation, nonce-bound Sign in with Apple verification, encrypted Apple refresh tokens, database row-level security, and restricted moderation access. No system is perfectly secure.
Hosts can delete their account in the app. Participants can delete their own comment, report content, and block another participant for that table. Depending on location, users may have rights to access, correct, delete, restrict, object to, or receive a copy of personal data. Email hello@getviberater.app.
Vibe Rater is for adults age 18 and older and is not directed to children. If we learn that a child provided personal data, contact us and we will take appropriate deletion steps.
Cloudflare, Supabase, and Apple may process data in the United States and other countries. Where applicable law requires a transfer safeguard, we rely on the lawful mechanisms made available under our provider agreements.
We will update the effective date when this policy changes and provide additional notice for material changes when appropriate.