THEVIBE

Privacy

Last updated: 11 October 2026

Your photo

Your photo is sent to our server, shrunk, and passed to an AI model that describes it (Groq; if that's unavailable, Google Gemini or OpenRouter instead). We don't save the photo.
The same analysis also checks whether the photo shows violence (e.g. killing, badly injured people) or sexual content. If it does, no songs are given; 3 such photos from one device or account within 24 hours pause searching for 24 hours. Only the device/account ID and the time are kept for that, for 24 hours, not the photo.
So the same photo isn't analysed twice, we keep the AI's text description for up to 30 days, filed under a fingerprint (hash) of the image. The fingerprint can't be turned back into the photo.
Only if you share a result with “Share the photo too” ticked, a smaller copy of the photo is saved to show on the share page. Location and camera data (EXIF) are removed first. Anyone with the link can see it.

Each result (songs, mood, language, the AI's description) is saved so you can swap songs and share it. Results you don't share are deleted after 60 days; shared ones stay online until you ask us to remove them.
We keep your likes and swapped songs for a year: for your “Liked songs” list, to shape your next suggestions (artists you like come forward, ones you keep swapping out are left out) and to see which suggestions work. After 10 likes an AI writes a “music personality” card from that list; it is kept until your likes change. You can remove any like from the list.

A random ID in a cookie (thevibe_device_id, 1 year) lets you change your own results and keeps likes to one per device. It isn't linked to your name or email. No advertising or analytics cookies.
Your recent searches stay in your own browser (local storage); “Clear history” removes them.

You don't need an account. If you make one, we keep only your username and a one-way hash of your password; no e-mail or name is asked for, which is why there is no password reset.
With “Continue with Google” we ask Google only for your anonymous account number (not your name, e-mail or picture) and keep just a hash of it.
When you sign in, that device's likes move into your account so they show on all your devices. Sign-in lasts 180 days in a session cookie.
“Delete my account and likes” removes your account, likes and music personality card at once.

To prevent abuse, we keep the IP address of each search for a few minutes (rate limiting). As on any website, server logs may also contain IP addresses.

Groq (Google Gemini and OpenRouter as backups): photo analysis.
Deezer, Spotify, iTunes: finding songs, covers and previews — only song and artist names are sent.
Genius: lyrics search — the words you type as a lyric hint.
Last.fm: trending songs.
Google Fonts: the page's fonts load from Google.
Spotify login (only when enabled): your Spotify access token, to save songs, kept until you disconnect.

You can use the app without sharing anything, untick “Share the photo too”, and clear your history.