Privacy Policy

Last Updated: May 25, 2026

Effective Date: May 25, 2026

Revision: 1.2

Revision History

1. Introduction

This Privacy Policy describes how Sia Makerlab ("we," "us," or "our") collects, uses, and shares information in connection with your use of the Vibe Coder Android mobile application and the companion Vibe Coder Server software (collectively, the "Service").

Vibe Coder Android is a remote-console developer tool. The Android app signs in to a Vibe Coder Server that the user runs on their own PC inside their own local area network. All project source code, prompts, build artifacts, Git history, and uploaded files remain on the user's own PC at all times. We do not host, receive, or have access to any of that data.

As of v0.4.x (May 2026), the Android client (vibe-coder-android) and the server (vibe-coder-server) are distributed as two separate Git repositories, kept wire-compatible through a shared :shared JVM module that defines DTOs, API paths, and WebSocket frames. The two components communicate exclusively over your own local area network.

By downloading, installing, or using the Service, you agree to the collection and use of information in accordance with this Privacy Policy. If you do not agree with this Privacy Policy, please do not use the Service.

2. Information We Collect

2.1 Information You Provide

The Service does not require you to create an account with Sia Makerlab. On the Connect screen the Android app asks for four values, all of which are used only against your own server:

• Server URL (for example http://<PC IP>:17880)
• Username and Password — created in the Vibe Coder Server's local admin web console (http://<PC IP>:17880/admin) and stored only on your own PC
• Device name — a label you choose to identify this Android device on the server

We do not collect:

• Names or email addresses
• Phone numbers
• Physical addresses
• Payment information

2.2 Information Collected Automatically

2.2.1 Local Device Storage (Android App)

The Android app stores the following data locally on your device only:

This data is stored exclusively on your device using Android Jetpack DataStore. As documented in the project README, Vibe Coder Android is a single-user LAN tool; the bearer token is intentionally not wrapped in the Android Keystore so that the same token may be presented as either an Authorization: Bearer header or a vibe_session cookie. Treat any device that has signed in as a trusted device, and sign out (or clear app data) before handing the device to anyone else. We do not have access to this data, and it is never transmitted to our servers.

Passwords are sent only to your own Vibe Coder Server during the login exchange and are not retained on the Android device after a session token has been issued.

2.2.2 Local Server Storage (Vibe Coder Server, runs on your PC)

The Vibe Coder Server, which you run on your own PC, stores the following data locally. This data never leaves your PC unless you choose to transmit it:

Passwords are stored as cryptographic hashes only; the plaintext password is never recoverable from the server database. Session tokens are likewise stored as hashes only.

2.2.3 LAN Network Traffic

Traffic between the Android app and the Vibe Coder Server occurs entirely over your own local area network. The Service does not route any of this traffic through Sia Makerlab's servers, and we cannot observe or log it.

The console WebSocket performs authentication by sending {"type":"auth","token":"..."} as the first frame after connect; the token is never placed in the connection URL.

2.3 Permissions

In line with the capabilities documented in the project README (LAN networking to the companion server, APK download, and opening the system install screen), the Android app's manifest declares:

INTERNET

Required to communicate with your Vibe Coder Server over LAN.

REQUEST_INSTALL_PACKAGES

Required to open the system "Install unknown app" screen for the debug APK that you yourself built and downloaded. The Service does not silently install anything.

Storage / FileProvider access

The app reads its own downloaded APK file from app-private storage in order to launch the install intent. It does not read other apps' files, photos, or documents.

The Android app does not collect microphone audio, camera images, contacts, or precise location at the policy level documented here. If a future build introduces an additional Android permission, this policy will be updated to reflect it before that build is released.

2.4 Information We Do NOT Collect

We explicitly do not collect:

• Personal information
• Location data
• Camera or microphone data
• Your project source code, prompts, or build outputs
• Contacts, photos, or files outside the app's own download directory
• Any usage analytics or telemetry
• Advertising identifiers (the app displays no ads)
• Browsing history
• Communication contents

3. How We Use Information

3.1 Local Data Usage

All locally stored data is used solely to:

• Maintain the signed-in connection between your Android device and your own Vibe Coder Server
• Authenticate API and WebSocket requests against your own server
• Display project lists, live logs, and APK build artifacts on your phone
• Install the debug APK that you built on your own PC

3.2 No Third-Party Sharing for Telemetry

The Service does not integrate any analytics SDK, advertising SDK, crash-reporting SDK, or telemetry pipeline. We receive no usage data from the Service.

4. Data Sharing and Disclosure

4.1 We Do Not Sell Your Data

We do not sell, trade, or rent your personal information to third parties. We do not have access to your project data, prompts, or build artifacts in the first place.

4.2 Third-Party Service Providers

The Android app does not integrate any third-party analytics, advertising, or telemetry SDKs. The Vibe Coder Server invokes third-party command-line tools (claude, git, gradle / gradlew) that you have installed on your own PC. These tools are governed by their respective licenses and privacy policies:

• Anthropic Claude Code CLI — https://www.anthropic.com/legal
• Git — governed by your own Git configuration
• Gradle — governed by Gradle's terms

When you send a Claude prompt through Vibe Coder Android, your prompt and any relevant file context are transmitted by the Claude CLI installed on your own PC directly to Anthropic, under your own Anthropic account. Sia Makerlab is not in that data path.

4.3 Legal Requirements

We may disclose information we hold (which is essentially limited to Google Play developer-account contact data and store metadata) if required to do so by law or in response to valid requests by public authorities.

5. Data Retention

5.1 Local Data on the Android Device

Data stored locally on your device remains until you:

• Sign out from within the App
• Clear the App's data through device settings
• Uninstall the App

5.2 Local Data on the Vibe Coder Server

Data stored locally on your PC by the Vibe Coder Server remains until you delete the server's data directory, revoke a signed-in device, delete the user account from the admin console, or uninstall the server.

6. Your Rights and Choices

6.1 For All Users

You have the right to:

• Access: View your locally stored settings within the App and the server's data directory on your PC
• Delete: Remove all local data by clearing app data or uninstalling the App, and by deleting the server's data directory on your PC
• Revoke: Revoke a signed-in device's session token or delete the user account from the server's admin console at any time
• Disconnect: Stop the Vibe Coder Server process at any time to immediately sever the connection

6.2 For Users in the EEA, United Kingdom, and Switzerland

Under GDPR and applicable laws, you have additional rights including the right to access, rectification, erasure, restrict processing, data portability, object, and withdraw consent. Because we do not host, receive, or process the project data that flows through the Service, these rights are exercised by you directly against your own PC's filesystem and database.

6.3 For California Residents (CCPA/CPRA)

California residents have the right to know, access, delete, and opt out of the sale of personal information. We do not sell personal information as defined by the CCPA/CPRA.

7. Data Security

We implement appropriate technical and organizational measures in the Service's design to protect your data:

• Server-side passwords are stored as cryptographic hashes only — never as plaintext
• Server-side session tokens are stored as cryptographic hashes only
• WebSocket authentication is performed by a first-message handshake; the token never appears in the connection URL
• The same token is accepted as either an Authorization: Bearer header or a vibe_session cookie by the server, simplifying the LAN client without expanding the trust surface

Network transport between the Android app and the Vibe Coder Server occurs on your own LAN; security on that network segment (Wi-Fi password, isolation from untrusted devices) is the user's responsibility. As noted in §2.2.1, the Android session token is stored in Jetpack DataStore without Keystore wrapping — appropriate for a single-user LAN tool, but treat your device accordingly.

8. Children's Privacy

The Service is a developer tool intended for software developers. It is not directed to children under 13 (or under 16 in the EEA). We do not knowingly collect any personal information from children.

9. International Data Transfers

We do not transfer your project data internationally because we do not receive it. Any international transfer that occurs (for example, when the Claude CLI on your PC transmits a prompt to Anthropic) is governed by the respective third party's privacy policy.

10. Third-Party Links and Services

The App may contain links to third-party websites or services (for example, Anthropic, Gradle, or Git documentation). We are not responsible for the privacy practices of these third parties.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by updating the "Last Updated" date and displaying a notice within the App for material changes.

12. Disclaimer of Liability

12.1 Third-Party Services

We are not responsible for the data collection, use, or security practices of third-party services invoked by the Vibe Coder Server, including the Anthropic Claude CLI, Git, and Gradle.

12.2 LAN Security

We are not responsible for the security configuration of the local area network on which you run the Vibe Coder Server. Running the server on an untrusted or publicly-exposed network is strongly discouraged.

12.3 Data Loss

We are not responsible for any loss of data stored locally on your device or on your PC.

12.4 Limitation of Liability

TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, WE SHALL NOT BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR PUNITIVE DAMAGES RESULTING FROM YOUR USE OF THE SERVICE.

13. Governing Law

This Privacy Policy shall be governed by the laws of the Republic of Korea. For EU users, it shall be interpreted in accordance with applicable EU law including the GDPR.

14. Contact Us

Sia Makerlab

• Email: sia@siamakerlab.com
• Website: https://siamakerlab.com

For GDPR-related inquiries from EEA residents, please include "GDPR Request" in the subject line.

---

Summary of Data Practices

---

This Privacy Policy is available in English. If translated versions are provided, the English version shall prevail in case of any discrepancy.