Privacy Policy

Last updated: July 3, 2026

This policy explains how VibeWin collects, uses, and protects your personal data, in accordance with the EU General Data Protection Regulation (GDPR), the Spanish Organic Law 3/2018 (LOPDGDD), and, to the extent applicable, US state privacy laws.

1. Who is responsible (data controller)

Leandro Leonel Utz Torrisi (Spain). Contact: hello@vibewin.app. Full identification details are in the Legal Notice.

2. What data we collect

We do not collect special-category data, and we do not buy data about you from anyone.

3. Why we use it (purposes and legal bases)

We do not use your data for automated decisions with legal or similarly significant effects. Scores apply to giveaways, not to you; personalization simply matches giveaways to the preferences you chose.

4. Who we share it with (processors)

We share data only with the providers that run the Service, under data-processing agreements:

• Supabase: database, authentication, and hosting of user data;
• Stripe: payment processing and subscription billing;
• Resend: transactional email delivery;
• Google: only if you choose “Continue with Google” for sign-in;
• Google AdSense: advertising on the free plan only. When you consent to advertising cookies (see the cookies section), Google receives technical data such as your IP address, device and browser information, and ad interactions in order to select, cap, and measure ads. Premium users see no ads;
• Vercel: website hosting, content delivery, and cookieless analytics (aggregate page-view statistics with no cookies and no cross-site tracking).

Optional postal-code lookup. If you type a postal code on the onboarding screen, our server sends only that code and your country (never your name, email, account, or IP address) to a third-party postal-geocoding service so it can fill in your city and state for you: Zippopotam.us (United States, Canada, and Australia) or postcodes.io (United Kingdom). For Canada we send only the first three characters of the code, and for the United Kingdom only the outward part (e.g. the “SW1A” of “SW1A 1AA”). Because the request is made by our server, these services set no cookies and cannot identify you, and the lookup runs only when you choose to enter a code. You can always pick your state and city manually instead.

Some providers (including Google, Stripe, Resend, and Vercel) process data in the United States. Where they do, transfers rely on the EU-US Data Privacy Framework and/or Standard Contractual Clauses. We never sell your personal data for money. The only sharing for advertising is with Google, and only after you consent to advertising cookies. You can withdraw that consent at any time from “Cookie settings” in the footer.

5. How long we keep it

• Account and activity data: for as long as your account exists. Deleting your account (account page → “Delete account”) permanently removes your profile, preferences, saved/entered lists, and reminders.
• Billing records: kept after deletion only as long as tax and commercial law requires.
• Security logs (IP, rate-limit events): kept briefly and rotated automatically.

6. Your rights (EU/EEA)

You can exercise your GDPR rights (access, rectification, erasure, restriction, portability, and objection) by emailing hello@vibewin.app, and two of them are self-serve on your account page: “Download my data” exports everything we store about you as JSON (portability), and “Delete account” erases it. We respond to emailed requests within one month. You can also complain to the Spanish supervisory authority, the Agencia Española de Protección de Datos (aepd.es), or to the authority of your own EU country.

7. US residents

VibeWin does not currently meet the thresholds that make the California Consumer Privacy Act (CCPA/CPRA) or similar state laws applicable to it. We nevertheless honor the same core rights for all users (to know, correct, delete, and obtain a copy of your data) via hello@vibewin.app. We do not sell your personal information for money. On the free plan we show ads through Google AdSense, which may use cookies to personalize ads only after you agree in our cookie banner; you can change or withdraw that choice at any time from “Cookie settings,” and if you decline, any ads shown are non-personalized.

8. Cookies and local storage

We ask for your consent before any non-essential cookie is set. There are two kinds:

• Strictly necessary: the sb-* session cookies our authentication provider (Supabase) sets to keep you signed in securely, plus small technical values in your browser’s local storage for the interface. Under the ePrivacy rules and the Spanish AEPD’s cookie guidance these require no consent; the authentication cookies are deleted on sign-out or expiry.
• Advertising (free plan only). To keep the free plan free, we show ads through Google AdSense, which can set advertising cookies and use device identifiers to select, frequency-cap, and measure ads. These are set only after you agree. Visitors in the EU/EEA and the UK are shown a Google-certified consent banner on their first visit; until you accept, no advertising cookie is set and any ads shown are non-personalized. You can change or withdraw your choice at any time from “Cookie settings” in the page footer. Premium users see no ads.

For analytics we use Vercel Web Analytics, which is cookieless. It measures aggregate page views without setting any cookies, without cross-site tracking, and without collecting personal data. If you pay, Stripe sets cookies on its own checkout pages under Stripe’s policy, not on ours.

9. The VibeWin Autofill browser extension

The VibeWin Autofill browser extension is part of the Service. It helps you enter giveaways faster on supported platforms. Here is what it collects and why, in plain language:

• Account info. Your email address and user id are synced between vibewin.app and the extension so you stay signed in on both.
• Autofill profile. The details you save for autofill (for example your name, email, address, phone number, and date of birth) are stored in the browser’s extension storage and in your VibeWin account, so entry forms can be filled with your information.
• Entry activity. Which giveaways you marked entered and basic run results (for example how many steps completed) are synced to your account, the same way entries you mark by hand on the website are.
• Giveaway page content. On the supported giveaway platforms (Gleam, KingSumo, SweepWidget, Socialman, and Giveaway Ninja), and on any other site where you trigger a fill or opt in to automatic autofill, the extension reads the page locally in your browser to find the entry form and the entry actions available. This page content is processed locally and is not uploaded anywhere.

We do not sell this data, we do not use it for advertising, and the extension does not collect your general browsing history. By default it runs only on the supported giveaway platforms listed above and on vibewin.app. Beyond that, it acts on another site only when you tell it to. When you click Fill in the popup, it reads and fills the entry form on your current tab that one time. You can also grant a specific site an optional per-site permission (“Run here automatically”) so it will autofill there automatically from then on. On any of these sites the page is read locally in your browser the same way (to find and fill the entry form), and nothing extra is uploaded. Extension data goes only to VibeWin’s own backend (Supabase), under the same protections described in this policy. Deleting your VibeWin account deletes this data too.

The extension requests a small set of Chrome permissions, each for one purpose:

• storage: to save your autofill profile and preferences in the browser;
• alarms: to run periodic checks (like keeping your session in sync) without keeping the extension active all the time;
• tabs: to detect which supported giveaway site is open and to open entry links you ask it to visit;
• cookies: to read your vibewin.app session cookie so the extension knows you are signed in;
• notifications: to let you know when a run finishes or needs your attention;
• activeTab: when you click Fill in the popup, to read and fill the entry form on the tab you are viewing, just that once;
• scripting: to insert the autofill code into the page so it can find and fill the entry form on the sites you use it on.

10. Security

Data is encrypted in transit; passwords are hashed; database access is enforced row-by-row so each account can only ever read its own data; secret keys are confined to the server; and the site runs rate limiting and abuse protection. No system is 100% secure, but if a breach affects your data we will notify you and the authorities as the GDPR requires.

11. Children

The Service is for adults (18+). We do not knowingly collect data from minors; if you believe a minor has an account, contact us and we will delete it.

12. Changes and contact

We will post any changes here and, for material changes, notify you in the app or by email. Questions: hello@vibewin.app. See also the Terms of Service and the Legal Notice.