Vibeboard privacy policy

Last updated: 25 October 2026

Vibeboard is a Chrome extension that replaces the new tab page with a dashboard of widgets, some of them built by an AI agent. This policy explains what data it handles. Operator: Vibeboard (vibex.plane4bear.com). Contact: support+plane4bear@mobness.com

What stays on your device

Stored in the browser (chrome.storage.local), never sent to us unless noted below:

• your widgets, layout, settings, chat history, and widget data (notes, to-dos, links, …);
• secrets you add for widgets (API keys). They are stored unencrypted and are only ever sent to the hosts you bound them to;
• your own OpenAI API key, if you choose "My OpenAI key". It is sent only to api.openai.com (or the custom API URL you set), never to our server.

What our server stores (only if you create an account)

• email address and, for Google sign-in, your name and Google account id; a salted scrypt hash of your password (we never store the password itself);
• session tokens (stored hashed), until you sign out or they expire;
• a per-day count of AI requests (usage statistics; a cap is optional and off by default);
• synced custom widgets: name, code, permissions list (hosts and secret *names*), size, position and version history. Secret values and chat history are not synced;
• ids of OpenAI responses created through our key, so conversations can't be continued by other users.

Server logs contain request method, path, status and timing. Request bodies (including your prompts) are not logged or stored by us.

Who else receives data

• OpenAI receives your prompts and the data the agent reads while building widgets (API responses, search results), either through our server (shared key) or directly from your browser (your own key). OpenAI's terms apply; conversations are stored with OpenAI because the agent uses stored responses.
• Google processes the sign-in if you use "Continue with Google". We receive your verified email and name only.
• Websites and APIs your widgets call receive the requests you approved (without your browser cookies). Each host needs your explicit permission.

We do not sell data, show ads, or use analytics or tracking.

Google user data. "Continue with Google" gives us only your verified email address, your name and a Google account identifier, used solely to create and sign you in to your Vibeboard account. We do not access your Gmail, Drive, Calendar or any other Google data. Vibeboard's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Permissions

storage (keep your data), identity (Google sign-in), favicon (show site icons in Quick links, fetched locally from Chrome), host access to api.openai.com (own-key mode) and optional access to hosts that you approve per widget.

Your control

• Settings → Account → Delete account removes your server-side data (account, sessions, synced widgets, usage). Data on your device stays until you remove the extension.
• Widgets can be exported, edited or deleted at any time; permissions can be revoked in chrome://extensions.

Retention

Account data is kept until you delete your account. Sessions expire after 30 days. Server logs (method, path, status, timing) are rotated regularly.

Changes

Material changes will be announced in the extension and this file will be updated.