How we protect your apps and data.

Secrets are kept out of AI prompts

When a test needs a password, PIN or token, the AI agent (beta) sees a placeholder such as {{password}} in the test's steps, never the value itself. VibeView types the real value on the device. The value is masked in the screen text and app logs the AI reads back from the device, and in the run's results, the AI's reasoning, the live run view and the run's logs. A secret is write-only: once saved, it is never shown again or returned by the API.

There are two exceptions (the test data docs have the details). First, the AI sees screenshots, so a secret that appears on screen reaches it; screenshots and run videos are not masked. Second, a secret shorter than six characters, such as a four-digit PIN, is masked only where it appears on its own, not when it runs into other text. Where you can, type secrets into fields that hide their text, and prefer one-time codes to short fixed PINs.

If your organization uses its own AI provider key, the AI's requests go to that provider under your account. With VibeView-provided AI, they go to a third-party model provider through VibeView. Either way, a request carries the test's steps and app notes, the text on screen and any app logs the AI reads (with secrets masked), and screenshots.

A device of your own for each session

Each session is given its own device, and no other session is assigned to it while yours runs. In your organization, a live session belongs to the member who started it: other members can't watch or control it unless the owner or an Admin invites them. Admins can end any session, and through the API they can also watch and control any session.

Anyone in your organization can watch the sessions that visitors start from your share links and embeds. Only Developers and Admins can take control of them, along with anyone they invite to control them. To use Agent Control on an embed session, the embed's Allow agent control setting must also be on.

When a session ends, iOS and Apple TV simulators are restored to a clean snapshot or erased. Every Android and Android TV session starts from a wiped device. On Roku, your channel and its data are deleted when the session ends. A device that can't be confirmed clean is taken out of service until it is. See Network access for what devices can reach.

Stream access and shared links

A device's video stream opens only with a short-lived access token that VibeView signs for that one session. A token for one session can't open any other.

Anyone who has a share link or collaboration link can use it, so treat them like passwords. An embed key is visible in the pages that embed it, so set its Allowed domains to limit where it works. You can revoke a share link or an embed key at any time: it stops working at once and ends any session running through it. You can turn a collaboration link off or replace it, which disconnects its guests. A team invite works only for the email address it was sent to; it expires after 7 days, and you can revoke it sooner.

Your account and team

• Members sign in with email and password, or with Google, Apple or GitHub.
• You must verify your email address before you can start a device or upload an app.
• Teams have three roles — Viewer, Developer and Admin — so you control who can upload apps, change billing or manage members. See Team management.
• Audit events record key changes, such as invites, API tokens, AI keys, apps, tests, share links and billing, with who made each change and when. Every member can see them and export them as CSV. See Audit events.

Payments

Payments are taken on pages hosted by Stripe. Your card number never reaches VibeView; we keep only the card brand and last four digits, to show you which card is on file.

How long we keep your data

• A test run's app logs and video are kept for 30 days, then deleted.
• Explore (beta) runs, with their findings and screenshots, are kept for 30 days.
• Test runs, with their results and step screenshots, are kept until you delete the test.
• Apps and builds you upload are kept until you delete them.
• Deleting your account closes it and deletes your personal data. If you were your organization's only member, the organization is deleted too: its stored credentials, keys and secrets are erased immediately, its API tokens and invites are revoked, and all of its remaining data, including its tests, runs and screenshots, is permanently deleted within 30 days. We keep billing records for as long as the law requires, and fraud-prevention records for up to 12 months (longer while an account is restricted for abuse). Audit events are kept, with your email address replaced by a placeholder. See Delete account.

The Privacy Policy covers the personal data we collect, the services that process it and your rights over it.

Abuse prevention

Devices are for testing apps. Apps that use a device for something else, such as cryptocurrency mining or selling its network connection, are not allowed on any plan, and the Free plan also restricts some kinds of third-party apps. See Restricted apps. We suspend accounts and organizations that break the Terms of Service; a suspension stops access without deleting anything.

Reporting a security issue

If you think you have found a vulnerability in VibeView, email support@vibeview.io with the details and the steps to reproduce it. Please give us a reasonable time to fix it before you disclose it publicly, and don't access other customers' data or disrupt the service while you test. We'll reply to every report.