Privacy Policy

Version 2026-10-21 · Effective 21 October 2026

MyVibe is an app for anonymous first-impression feedback on photos, given by real people. This policy explains what we collect, why, who can see it, how long we keep it and how you can get it removed. "We" means TPAI Games, the operator of MyVibe. Questions: support@myvibe.my.

1. Who can use MyVibe

MyVibe is only for people aged 18 or older. We ask for your date of birth when you set up your account and do not let younger people continue. If we learn that an account belongs to someone under 18, we delete it.

2. What we collect

Account: your e-mail address and password (stored only as a secure hash by our authentication provider), and records of sign-ins and security events.
Profile details you enter: display name, date of birth, gender, country, language, and your settings (for example whether your age is shown, which countries you want to rate, notification preferences).
Photos you upload (1–3 per profile) and the description choices you make for a profile. A profile message, if you are a member.
Ratings: the ratings you give (a photo score, an age guess, first impressions and tags, and how long you took) and the ratings you receive. With each rating we store a snapshot of the rater's gender, age range, country and level, so that results can be grouped without naming anyone.
Activity and safety records: which profiles were shown to you, skips, reports and blocks you make or receive, moderation decisions and appeals, your level and points.
Membership: if you subscribe, your subscription status and dates from the app store and our subscription provider. We never receive your card details.
Device: a push notification token and your device language, if you turn on notifications.
Error reports: technical details when the app or our servers fail (app version, operating system, what went wrong). We remove e-mail addresses, IDs and similar details from these reports before they are sent, and we do not attach your account to them.
IP address: it reaches our servers whenever the app or the website connects, and is used for security and to limit abuse. The sign-in service records it in its security log, our providers keep it in their logs for a short time, and for requests made without an account we store only a salted hash of it, for at most two days. We do not use it to find out where you are.
Requests you send us through our website, including the e-mail address you give us.

We do not use advertising, we do not track you across other apps or websites, and we do not sell your personal data.

3. How we use it

to run the service: show your photos to raters, collect ratings and show you your results;
to keep MyVibe safe: review photos and messages before they appear, handle reports, detect suspicious rating behaviour, enforce our rules and handle appeals;
to manage your account, levels and membership, and to send you notifications you have turned on;
to fix problems and prevent abuse (for example rate limits);
to meet legal obligations and answer your requests.

4. Who can see what

Your photos are shown to other signed-in users only while your profile is public and only as rating cards dealt to them. Rating cards do not show your name, except the card someone opens from an invite link you shared. Members can open a short profile view from a card they were shown.
Ratings are anonymous. Nobody can see who rated whom. You see your own results as totals and averages, and only once enough people have rated you. You may choose to show some of your results to members; those are rounded, and nothing is shown before a minimum number of ratings.
Invite links: anyone who has your invite link can see your display name and your first approved photo on our website.
Our moderation team can see photos, messages, reports and account records when reviewing content or reports. Staff accounts must use two-step verification.
Service providers who process data for us (section 5).

5. Service providers

We use these providers to run MyVibe. They process data only on our behalf:

Supabase — database, sign-in, file storage and server functions (the current service runs in Singapore);
Sightengine — automated photo moderation (your photo is sent for analysis);
Anthropic — automated text or photo moderation, if enabled;
Expo, Google Firebase Cloud Messaging and Apple Push Notification service — push notifications;
Sentry — error reports;
RevenueCat, Apple and Google — subscriptions and payments;
our e-mail delivery provider — sign-up and password e-mails;
our website hosting provider.

Some of these providers are located outside your country, including in the United States and the European Union. We use them under contracts that require them to protect your data.

6. How long we keep data

Your account and everything in it until you delete the account. When you delete it, your account, profiles, photos and personal details are deleted immediately; photo files are removed from storage within minutes.
Ratings you gave stay after you delete your account, but without any link to you. They only count towards other people's totals and averages.
Reports you made stay after you delete your account, without your name, so that our moderation history stays complete.
Records of moderation decisions about your account (what was decided, when and by whom) stay after you delete it, for safety and legal reasons.
Rejected photos: the file is deleted 30 days after the rejection (later only if an appeal is still open). We keep a fingerprint of the file and the reason, so that the identical file cannot be uploaded again.
Links to photos that the app has already received stop working within a few minutes (never more than an hour), or when the file is deleted.
Rate-limit counters: 2 days.
Requests sent through our website: 180 days after we close them.
Push tokens: until you sign out, turn off notifications or the token stops working.
Backups: our database provider keeps backups for a limited period (currently up to 7 days), after which deleted data is gone from backups too.
Security logs: our authentication provider keeps a log of sign-in and account events, including your e-mail address, for security and audit purposes, also after the account is deleted.

7. Your choices and rights

Change your profiles, photos and settings in the app at any time. To correct your account details (name, date of birth, gender or country), write to us.
Delete your account in the app (Settings → Account → Delete account) or through our website.
Hide a profile, choose whether your age is shown, and turn notifications on or off.
Ask for a copy of your data, or object to how we use it, through our request form or by e-mail. We answer within 30 days.

Depending on where you live (for example under Malaysia's Personal Data Protection Act or the EU General Data Protection Regulation) you may have further rights, including the right to complain to a data protection authority.

8. Security

Data is encrypted in transit. Access is limited by database rules so that users only reach their own data, staff use two-step verification, and photos are served only through short-lived links. No system is perfectly secure; if a breach affects you, we will tell you as the law requires.

9. Changes

When we change this policy we update the version at the top. If a change matters for how we use your data, the app asks you to read and accept the new version.

10. Contact

E-mail support@myvibe.my or use our request form.