Privacy, credits & licenses

Applies to vibeware.xyz and every app on its subdomains. Last updated 11 November 2026.

Your work stays on your device

• Apart from the two live apps and the “Ideas & support” form below, the apps run entirely in your browser. What you type, build or export is never uploaded.
• There are no accounts. Apps save your work in your browser's local storage, on this device only. Clearing your browser data removes it. The live apps below are the only exception.
• Share links carry their content inside the link, after the #. Browsers never send that part to a server. The same goes for timelines embedded in other websites and for Timeline's scrolling web stories.
• A Timeline link can be locked with a password. The timeline is then encrypted in your browser (AES-256, with a key made from the password), the password itself is never part of the link, and the person who opens it enters the password in their own browser. Nobody else, including vibeware, can read it.
• To work offline, Timeline keeps a copy of its own program files (not your timelines) in your browser's cache. You can remove it like any site data in your browser settings.
• Timeline keeps up to 15 earlier versions of each timeline (Version history) in your browser's storage, on your device only. Deleting a timeline from My timelines deletes its versions too.
• Backups of your timelines (Back up all) and .json copies are files downloaded to your device; Timeline never writes to other files on your computer.
• Files you import (Excel, CSV, Microsoft Project, and PowerPoint templates for your brand colours and fonts) and text you paste to make a timeline are read in your browser. Dates are found with simple rules on your device, not by an online AI service.
• Every page is served from this site. A strict security policy makes your browser block requests to any other server: no CDNs, no Google Fonts, no embedded content. The one exception is Timeline used as a PowerPoint add-in: inside PowerPoint it loads Microsoft's add-in library, as Microsoft requires.

Live sessions (Brainstorming, Team games, Office Quest)

These three apps let a group work together in real time, so their content has to pass through a server:

• Boards and games run on vibeware's own relay, hosted by Cloudflare. It keeps each session's content (notes, answers, the names people enter, and in Office Quest the personality-quiz answers and the fun fact each player writes for their team) so everyone sees the same thing and can come back to it.
• A session is deleted automatically 30 days after its last activity. The facilitator can delete it at any time.
• There are no accounts. Your browser keeps a random key so you can rejoin as the same person; nothing links it to you.
• Hidden notes, quiz answers and votes are only sent to the people allowed to see them. In Office Quest, fun facts are shown to your own team during the game and to everyone on the host's screen at the end.
• Only these three apps keep live sessions on the relay. The only other thing any app sends to it is a message from the form below, and only when you press Send.

Ideas & support form

Every app has an “Ideas & support” link for suggestions, problem reports and questions:

• What you write, the type of message, which app it's about and, only if you give it, your email address, are sent to vibeware's relay (hosted by Cloudflare) and only the vibeware team can read them.
• Once a day, new messages are emailed to the vibeware team, using Amazon SES or Resend (email delivery services) to send that one email. The email holds the same details as above, never your IP address or its fingerprint.
• If you leave your email address, the vibeware team may answer you by email, sent through Amazon SES from a vibeware address.
• Your email is used only to answer you. It's never added to a mailing list or shared.
• Messages are deleted automatically 6 months after they arrive, or sooner when handled.
• To stop spam, the relay keeps a salted one-way fingerprint of your IP address (not the address itself) for up to 30 days, and your browser solves a small puzzle before sending. There are no CAPTCHAs, cookies or trackers.

Emailing vibeware

Email sent to a vibeware address is received by Amazon SES (in Ireland), held briefly in private storage, and forwarded to the vibeware team's mailbox; the stored copy is then deleted (at the latest after 7 days). A text copy of the message (sender, subject and text, without attachments) is kept for the team for 30 days so they can answer from the vibeware address. Replies go out through Amazon SES.

Counting visits

We use Vercel Web Analytics to see which apps people use and where visitors come from. It is built to be private:

• No cookies and nothing stored on your device. Visits are counted with a short-lived hash that resets every day, so you can't be followed across days or across other websites.
• Each visit records the page address without anything after ? or #, the site that linked to it, the country, and the browser, operating system and device type.
• Only totals are shown to us. We never see individual visitors.
• If your browser sends Do Not Track or Global Privacy Control, the counter doesn't run at all.

Hosting

The site is hosted by Vercel. Like any web host, it processes the technical details of each request, such as your IP address, to deliver the files.

Credits & licenses

This page and the app list use:

Each app lists its own credits and licenses in its About or Privacy dialog.