Privacy Policy

VibeXo — Privacy Policy · Version v1.0 · Last updated: November 9, 2026

Operated by VibeXo by GoChiHQ (Ontario, Canada) · Contact: [email protected]

This Policy explains what personal information VibeXo collects, why, who processes it, and your rights. It is written to align with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial law, including Quebec's Law 25 where it applies. We never sell your personal information.

1. What we collect — the honest inventory

• Account information: your email address and phone number (used for the sign-up verification code), and your password — which is stored only as a server-side hash by our authentication provider, never in plain text, never in your browser.
• Profile information: display name, date of birth (to enforce 18+), gender and who you're interested in, your display country, city, residence country (kept private — never shown to other members), currency and language, and optional details you choose to add (such as height, occupation and bio).
• Photos you upload, which pass moderation before they become visible.
• Questionnaire answers and preferences, used to compute matching scores.
• Your activity in the app: likes/passes (swipes), matches, conversations and messages, blocks and reports, gifts you send or receive through the gift feature, meetup participation, and pet-date arrangements.
• Location, only as you control it: GPS is off by default. If you turn it on, precise coordinates are used for distance matching; if you turn it off, stored precise coordinates are deleted within 24 hours. Other members only ever see your city and approximate distance — never your precise location. Roaming changes only what you discover; your residence and billing information never move.
• Moderation records: detection results, warnings, strikes, appeals and actions on your account. The moderation log is retained for 24 months.
• Wallet records: your token balance, purchases, and an append-only ledger of token movements (for example, 2 tokens for a permanent photo unlock).
• Your consent record: the date and time you agreed to the Terms of Service and Privacy Policy, and the versions you agreed to.
• Device-local data (current build): some information is stored in your own browser's local storage on your device — your profile cache, wallet and unlocks, preferences and session handling by our authentication library. Clearing your browser storage removes it.
• Identity verification (only if you choose it): see section 3.

2. Why we use it

• To create and secure your account, verify your phone, and confirm you are 18+.
• To show your profile to other members as you configure it, compute matches, and operate messaging, meetups and gifts.
• To moderate content, enforce the Community Guidelines, prevent fraud and abuse, and keep the service safe.
• To process purchases and maintain your token wallet.
• To meet legal obligations, including child-safety reporting where the law requires it.
• We do not use your information for third-party advertising, and we carry no advertising trackers.

3. Identity verification and biometrics

• Verification is optional for members (it may be required for creators). If you choose to verify, your government ID and a live selfie are processed by our verification provider, Persona, under its own security and privacy controls.
• VibeXo never receives or stores your ID images, your selfie, or biometric templates. We store only the outcome — pass/fail, the fact that liveness passed, and the date of birth shown on your document so the 18+ check can be recorded.
• Do not start verification unless you consent to Persona processing your ID and face data for this purpose. The consent step in the verification flow explains this before anything is collected.

4. Who processes your information

• Supabase — our database and authentication provider. Your account and profile data is stored in Supabase's Canada (Central) region.
• Cloudflare — delivers the app and protects it from attacks; processes connection data (such as IP addresses) as part of delivery and security.
• Persona — only if you choose identity verification, as described in section 3.
• Payment providers — when real payments are enabled, purchases are processed by VibeXo's own payment provider (never the main GoChiHQ account) and we receive only confirmation and limited transaction details, not your full card number.
• The law and safety: we may disclose information where required by law, court order, or to report child-safety offences to the appropriate authority (in Canada, Cybertip.ca).
• Your information is never sold and is not shared for third-party marketing.

5. How long we keep it

• Account and profile information is kept while your account exists. When you delete your account, your profile, photos, matches and messages are erased.
• Moderation records are retained 24 months, as described above, for safety and enforcement.
• Backups and legal records may persist for a limited period where required for security, fraud prevention or law.

6. Your rights

• Access and correction: you can view and edit most profile information in Settings, and ask us for a copy of the rest.
• Withdrawal of consent: you may withdraw consent to optional processing (for example GPS) at any time in Settings; withdrawing consent for processing that the service depends on means deleting your account.
• Deletion: Settings → Delete account permanently erases your profile, photos, matches and messages.
• Complaints: contact us first at [email protected]. If you are not satisfied, you may complain to the Office of the Privacy Commissioner of Canada, or to your provincial commissioner (in Quebec, the Commission d'accès à l'information).

7. Security

• Passwords are hashed server-side by our authentication provider; access to member data is restricted by row-level security so members can only read and write their own rows, and columns that represent trust decisions (verification status, moderation state) can only be written by our server-side systems.
• No system is perfectly secure. If a privacy incident puts you at real risk of significant harm, we will notify you and the Privacy Commissioner as PIPEDA requires.

8. Children

• VibeXo is 18+ only. If we learn an account belongs to someone under 18, we remove the account and delete its information.

9. Changes

• We may update this Policy; material changes will be announced in the app and the version and date at the top will change. Your consent record is updated when you agree to a new version at sign-up or when prompted.