Privacy Policy

1. Overview

VibeStep (“the Service”) respects your privacy and complies with the Korean Personal Information Protection Act (PIPA) and other applicable laws. This policy explains what we collect, why we use it, and when we delete it.

VibeStep is a social app for creating and sharing dances built from 2D joint keyframes. We collect only what the Service needs to work. We request no additional scopes (such as email or profile access) during social sign-in; email sign-in uses only the email address needed for authentication.

The rules for using the Service and our policy on user content are in the Terms of Use.

2. Information We Collect

a. Account and authentication

• Your Firebase account identifier (UID) and sign-in provider (Google, Apple, or email).
• Authentication runs through Google Firebase Authentication. When you create an email account, Firebase Authentication stores the email address as an authentication record, but we do not store it in the Service's Firestore database. Firebase processes the password; our server never receives or stores it. Social sign-in requests no additional real-name or profile-photo data.

b. Content you enter or create

• Nickname (2–20 letters and digits; set once and cannot be changed)
• Dance data — joint keyframes, doodle backgrounds, sound loops, outfits
• Posts — title, body, and public/private setting
• Comments (text and motion emoji) and emoji reactions

c. Information generated through use

• Currency balance, in-app payment and shop purchase history, and purchase timestamps
• Rewarded-ad viewing and reward records (ad unit, reward type and amount, transaction identifier, and last reward time). Google Mobile Ads may process IP address, device or advertising identifiers, ad interactions, and diagnostic information while delivering ads.
• Account limits such as storage slots and keyframe capacity
• Text-comment cooldown state, account creation and update timestamps
• Crash and error diagnostics (Android, iOS, and macOS apps). In distributed builds, Firebase Crashlytics collects crash and non-fatal error details and stack traces, the time they occurred, app version and build number, install store channel, API server environment, device model and OS version, and a Crashlytics installation identifier (UUID). We use these reports to diagnose errors and improve app stability. The Service does not set account UIDs, email addresses, or nicknames as Crashlytics user identifiers or custom keys. We do not use Crashlytics on the web. In Android and iOS apps where Firebase Analytics is also enabled, reports may include app usage events preceding an error.
• App usage statistics (Android and iOS apps, and web users who opt in). Firebase Analytics collects automatic events such as app opens, web visits, and sessions; app or web version; install store channel; device model and OS or browser information; language; country-level location inferred from IP address; and an app installation identifier or web browser identifier and Analytics cookie. On the web, we initialize Analytics and begin collection only after the user chooses Allow analytics on their first visit. No analytics data is sent while no choice has been made or after consent is denied. Advertising-ID collection and ad-personalization signals are disabled, and usage statistics are not linked to ads or to the Service account. See How Google uses information from sites or apps that use its services.
• Access logs, IP address, and device/browser information recorded automatically by our hosting infrastructure (Google Cloud Run) for security and reliability

d. Information stored on your device

• Authentication tokens (access and refresh) that keep you signed in
• Preferences such as your language setting and your web Analytics allow/deny choice
• These are kept in local device storage (browser storage on the web). If you allow Analytics on the web, Google Analytics cookies and a browser identifier may also be stored. The mobile app uses the Google Mobile Ads SDK to provide rewarded ads and manage consent. Where available, you can revisit your choices under My Page → Settings → Ad privacy settings.

e. Payment information

In Android, iOS, and macOS apps, you can purchase in-app currency through Apple App Store or Google Play. Those stores process payment and refunds; the Service does not receive or store card numbers. RevenueCat processes store receipts, an app user identifier, and purchase status so we can verify and restore purchases. Our server retains the verified transaction identifier and currency-grant record.

f. Microphone (optional permission)

We request microphone permission only when you use Make by humming in the music library of the Android and iOS apps and on the web. The recorded sound is used only in your device's memory to analyze pitch and create an instrument loop, and it is discarded as soon as the analysis finishes. It is not saved as a file or sent to our servers or any third party. If you choose to save, only the instrument loop (note data) is stored on the server, not the sound. You can use the rest of the Service without this permission and can withdraw it at any time in your device or browser settings.

3. How We Use Information

• Identifying you, keeping you signed in, and tying content to your account
• Providing core features: dance storage, posting, comments, and reactions
• Guaranteeing nickname uniqueness
• Enforcing service rules such as comment cooldowns, storage slots, and keyframe limits
• Verifying in-app purchases, granting and deducting currency, and keeping purchase and ad-reward records
• Providing rewarded ads, enforcing frequency limits, managing ad consent, and preventing reward fraud
• Detecting abuse and abnormal access, and keeping the Service stable
• Diagnosing and fixing crashes and errors, and analyzing usage statistics such as active users, retention, and version adoption
• Responding to inquiries and improving the Service

4. Retention Periods

Two things may not disappear immediately. First, posts and comments store the nickname used at the time of writing so lists can render without extra lookups. Second, dance data is stored as immutable, content-hashed assets that other posts may reference. In those cases we first sever the link to your account (the author identifier) and periodically purge assets that are no longer referenced.

5. Sharing and Processors

We do not sell your personal information. The following providers may process information as needed to operate the Service, verify purchases, and deliver rewarded ads that you choose to watch.

Service data and the API server run in the United States region (us-west1, Oregon). Firebase and social sign-in verification may also take place on the providers' global infrastructure. Data processed outside Korea includes your account identifier, email address for email accounts, authentication tokens, purchase status, ad or device identifiers, crash and error diagnostics, and Service usage data.

If you are in the EEA or the UK, we process your data to perform our contract with you (providing the Service) and on the basis of our legitimate interest in keeping the Service secure. You may contact us to exercise your access, rectification, erasure, and objection rights.

6. Your Rights

• Access and correction: Your nickname, currency balance, saved dances, posts, and purchase history are visible in My Page. Nicknames cannot be changed after the initial registration because they must stay unique.
• Deletion: You can delete dances, posts, comments, and reactions yourself in the app.
• Web usage analytics consent: On your first web visit, you can allow or deny analytics. We send no web Analytics data before you choose or after you deny it. You can withdraw or grant consent at any time through Analytics settings at the top of the web Home screen.
• Ad privacy choices: Where this option is available, revisit your choices under My Page → Settings → Ad privacy settings.
• Account closure: You can close your account yourself under My Page → Settings → Delete account. Deleting your account removes your account record along with your posts, comments, reactions, saved dances, purchase history, and block list, and releases your nickname for reuse. If you cannot reach the app, contact us at the address below and, after verifying your identity, we will delete your account and related data within 10 days and confirm the result.
• Restriction and withdrawal of consent: Contact us to request this; note that it may limit your ability to use the Service.
• A legal representative or authorized agent may exercise these rights on your behalf.

7. Deletion Procedure

Once the retention period ends or the purpose of processing is fulfilled, we delete the data without delay. Electronic records are removed from the database in a manner that prevents recovery, and copies remaining in backups are removed as those backups rotate out.

8. Security Measures

• Clients never access the database directly; every read and write goes through the server API.
• All traffic is encrypted with HTTPS.
• The server verifies each request with its own JWT and permits access only to data you own.
• Secrets such as service account keys are kept out of the repository and managed separately.
• Access to production data is limited to the minimum number of people.

9. Children

The Service is not intended for children under 14, and we do not knowingly collect their personal information. If we learn that we have collected data from a child under 14, we delete the account and its data without delay.

10. Contact

• Privacy officer: VibeStep operator
• Email: eyedealisty@gmail.com

Send privacy questions, access or deletion requests, and complaints to the address above and we will respond in good faith.

11. Remedies (Korea)

If you need help with a privacy matter, you may also contact:

• Privacy Infringement Report Center — 118 / privacy.kisa.or.kr
• Personal Information Dispute Mediation Committee — +82-1833-6972 / www.kopico.go.kr
• Supreme Prosecutors' Office Cyber Investigation Division — 1301
• National Police Agency Cybercrime Report — 182 / ecrm.police.go.kr

12. Changes to This Policy

If we add to, remove from, or revise this policy, we will announce it in the app or on this page at least 7 days before it takes effect — at least 30 days ahead when the change materially affects your rights.

• Announced: September 9, 2026
• Effective: September 16, 2026
• Last updated: November 7, 2026 — added how the microphone is handled for Make by humming