A plain-language summary of how VibeCode Café handles security and privacy. This is an informative overview for users; formal policies are finalized before public launch.
We never see or store your password: it is hashed with bcrypt (salted) before it touches the database. We cannot read it back, and it cannot be recovered.
The site runs over HTTPS (via Cloudflare). Passwords and sessions travel encrypted; the login cookie is http-only and SameSite=Lax.
Account: email, display name, bio. What you publish: projects (title, description, rules, cost, stack). Votes: stored per account. That's it - no tracking pixels, no third-party analytics.
On our own server, in our own infrastructure (not on a third-party SaaS database). Data is not sold and not shared with advertisers.
Approved projects and their rules become public - that is the point of the gallery. Anything still pending or rejected is visible only to you and to the moderators.
Before a submission goes public it is reviewed by an AI moderation agent against an ethical policy (no illegal/harmful content). A human admin can always override.
A single session cookie keeps you logged in. No advertising cookies, no cross-site tracking.
You can edit or delete your own projects at any time from your profile. To export your data or delete your account, contact us and we'll do it.
Questions?
Contact us at [email protected] for data export, account deletion, or any security concern.