Privacy

Analytic Vibes is a local-first app. It has no backend, no account system and no analytics SDK of its own. This policy is short because the app collects almost nothing, not as a promise, but because there is no server for anything to be sent to.

What the app stores, and where

All of the following is stored on your device:

• Vendor credentials. The API keys, access tokens and private keys you give it for the services you connect are written to the iOS Keychain and read from there when a query runs.
• Your name. Used only for the greeting on the dashboard. It is stored in the app’s shared container and never leaves the device, not even with iCloud sync turned on.
• Your configuration. Projects, connections, metric cards and their order, preferences, and cached metric history and snapshots.

If you use the Apple Watch app, your iPhone sends it the latest dashboard numbers and whether you are on Pro, over Apple’s own iPhone to Watch link. No credential is ever sent to the Watch.

None of this is on a server of ours, so we cannot see it and we cannot recover it for you.

iCloud sync, if you turn it on

iCloud sync is off until you switch it on in Settings. It exists so a second device can pick up your setup without you pasting every key again. When it is on:

• Your projects, connections and metric cards are written to a private database in your own iCloud account. Each one is encrypted on your device before it is sent, with a key held in your iCloud Keychain.
• Your credentials are handed to iCloud Keychain, Apple’s end-to-end encrypted password store, rather than to the sync database.
• Your name, preferences and cached readings are not synced. A new device fetches fresh numbers on its first refresh.

All of it sits in your iCloud account, not ours. We have no access to it, and Apple’s handling of it is covered by Apple’s privacy policy.

What the app reads, and how

The app queries the services you connect, using the credentials you provide, directly from your device. Where a service offers a sign-in (PostHog and GitHub), it happens on that service’s own page, and the app keeps only the access token it is given, in the Keychain like any other credential. Those queries are read-only. The app cannot create, modify or delete anything in your connected projects, and it never sends events of its own to them. A Supabase service_role key is rejected before any network request is made, because it bypasses row level security.

Your use of those services is governed by their own privacy policies, not this one.

Purchases

Subscriptions are sold through the Apple App Store and managed with RevenueCat, which validates the transaction and tells the app whether a subscription is active.

RevenueCat receives only what a purchase requires:

• the App Store transaction and the product identifier bought;
• an anonymous app user ID that RevenueCat generates itself, not tied to a name or an email address.

It does not receive your metrics, your revenue figures, your project or connection names, or any vendor API key or token. There is no code path in the app that could send them.

The app keeps the anonymous ID in your iCloud Keychain, Apple’s end-to-end encrypted password store, so reinstalling the app or opening it on another device signed in to the same Apple Account finds the same purchase. With iCloud Keychain off, it stays on the device. This is the only thing the app puts in iCloud Keychain while iCloud sync is off.

Apple processes the payment. We never see your card details. Apple’s handling of that data is covered by Apple’s privacy policy.

The website

This site is hosted on Vercel, which records standard server logs including IP addresses for security and operational purposes.

The site measures its own traffic with PostHog, processed in the EU. By default this is anonymous: no cookie is set, nothing is stored in your browser, and a returning visitor is indistinguishable from a new one. If you accept the consent banner, PostHog sets a cookie so that your visits are counted as one person. Declining, or simply ignoring the banner, leaves the anonymous default in place. The site sets no advertising cookies either way.

If you join the waitlist, the email address you enter is stored by our email provider for the sole purpose of telling you when the app is released. It is not sold, rented or shared. Every message includes an unsubscribe link, and you can ask us to delete your address at any time by writing to hello@aurenix-cl.com.

Your rights

If you are in the EEA or the UK, you have the right to access, correct, export, restrict and delete personal data we hold about you, and to complain to your local supervisory authority. In practice the only personal data we hold is a waitlist email address, if you gave us one. Everything else lives on your devices or in your own iCloud account, where it is already yours. Write to hello@aurenix-cl.com and we will respond within 30 days.

Children

The app is a developer tool and is not directed at children under 13. We do not knowingly collect data from them.

Changes

If this policy changes materially, the date at the top of this page will change with it, and the change will be described in the app’s release notes.

Contact

Aurenix Creative Labs, hello@aurenix-cl.com