Privacy and data flows

What stays on your computer and what the app can send.

The download on this site doesn't contact Vibezeo's servers at all: no sign-in, no analytics, no crash reports and no update checks.

On your computer. Workspaces, layouts, settings, threads, teammates, tasks, notes, Dictate's history and dictionary, file checkpoints and the commands you run in Vibezeo terminals (text that looks like a secret is stored redacted) are stored in the app's data folder, ~/.tandem/.
Your data. Settings › Privacy exports it to a zip (every table as JSON, teammates' memory and skills, your notes), without engine sign-ins or secrets, and can delete Vibezeo's data from this computer. Engine sign-ins stay unless you tick Also remove engine sign-ins.
Secrets are stored only in your operating system's keychain. Logs are scrubbed of tokens and keys, and diagnostics contain no prompts, file contents or tokens.
Engines talk to their vendors directly, under those vendors' terms, from their own provider homes. Vibezeo doesn't send your prompts, code or terminal output to us.
Dictate recognizes speech on your computer. Audio is never saved or sent; the only network request is the model download you start, from Hugging Face.
Plugins talk to each service directly from your computer, with the credential from your keychain. Nothing goes through Vibezeo's servers.
SSH hosts you add are reached with your own ssh. Vibezeo keeps each host's name, address, port, key file path and key fingerprint, never a password or a key.
Usage statistics and crash reports are off by default and stay off unless you turn them on in Settings › Privacy.

The full list of what the app can send once Vibezeo accounts open, where to and when, and who processes it, is on the privacy page. The app shows the same list in Settings › Privacy.

Agent-proof secrets

Agents read .env files, so a key written there ends up in their context, their transcripts and every worktree copy. Keep the value in your keychain and put a reference in the file instead.

Settings › Secrets › Add secret. Give it a name (stripe-test) and paste the value. It's saved in your system keychain; Vibezeo keeps only the name and never shows the value again.
In the folder's .env, use the reference as the value: API_KEY=vibezeo-secret://stripe-test. Agents, diffs and worktree copies see only that text.
Run the command with the play button in a terminal pane's header (or "Run with secrets…" in its menu). The dialog lists what the .env uses and names any secret that's missing. Run opens a new pane beside it in the same folder: the command gets every .env variable with the references replaced, and when it exits the variables are unset before the shell takes over.

In that pane, a secret value the command prints shows as [REDACTED], on screen, in its scrollback and in what Vibezeo saves or reads from the pane.

What it doesn't cover:

A command that's given a secret can use it, write it to a file or print it encoded; only the exact value is masked, and only in that pane.
These forms of a value show unmasked:
- values under 4 bytes (Settings › Secrets warns when you enter one);
- a value printed in parts more than 50 ms apart;
- a value printed with colours or other escape codes inside it, or JSON-escaped, URL-encoded or otherwise encoded;
- a value a full-screen program draws in pieces as it redraws the screen.
Programs the command starts in the background keep the values after it exits; only the shell after it starts without them.
Agent panes never get the values in this version, and there's no vibezeo run command line yet.
The Flatpak build can't run with secrets yet.

Settings › Privacy › Delete local data… removes every secret from the keychain too.