Data & Security
Where Vibeless stores your project data, what stays on your machine, what leaves it, and how sign-in credentials are protected.
Last updated:
Vibeless is a desktop app built local-first: your specs, decisions, and context live on your machine, and the MCP tools your agents call never leave it. This page covers the docs-side practicalities; the company-level posture lives on the security page, the privacy policy, and the sub-processor list.
Where your data lives
| Data | Location |
|---|---|
| Project database (specs, tasks, decisions, context graph, MCP token) | <project>/.vibeless/vibeless.db |
| Version history / event log | <project>/.vibeless/vibeless.version.db |
| Registered projects & account metadata | ~/.vibeless/registry.db |
| Sign-in session tokens (encrypted) | ~/.vibeless/auth.db |
| Runtime state for agent connections | ~/.vibeless/manifest.json |
| Local REST API capability token | ~/.vibeless/local-api.token |
| App logs | ~/.vibeless/logs/ |
Everything above is plain SQLite or JSON on your disk — you can inspect it, back it up, or delete it (see Uninstall & Updates before deleting).
How credentials are protected
Sign-in tokens in auth.db are encrypted with a per-machine key stored in your OS keychain —
Windows Credential Manager or macOS Keychain. Vibeless never stores
your password; authentication is handled by Clerk. The runtime manifest is written with
owner-only permissions (mode 0600), and each project's MCP token authenticates and scopes your
editor's tool calls to that one project.
What stays local
All 31 MCP tools execute entirely on your machine: they read your local project database and code topology, make no external LLM calls, and consume no credits. Your agent's conversation with Vibeless never transits our servers.
What leaves your machine
- AI features (VibeCoder, architecture generation, codebase imports, streaming assistants) send the relevant project content to our AI provider through our backend, metered by your plan's credits. Which providers are involved — and where — is on the sub-processor list.
- Account, billing, and licensing traffic goes to our identity and payment providers (Clerk, Stripe).
- Nothing else: no background code uploads, no telemetry of your repository contents.
Model training and AI request logs
Your content is never used to train AI models — not your specs, context documents, architecture docs, code, prompts, or the outputs you get back. Our AI provider (Anthropic) processes requests under commercial API terms that don't permit training on customer inputs or outputs, and no sub-processor is permitted to train on your content either.
We do retain AI request logs (the prompts sent and the outputs returned) to keep the Service running and secure, investigate abuse, meet legal obligations, and improve product quality — debugging failed generations, for example. "Product improvement" never means model training. These logs aren't routinely read by a person; access is limited to debugging, abuse investigation, or legal process. Logs are deleted when no longer needed, though ones tied to an active investigation, dispute, or legal matter can be kept longer. Full details are in the privacy policy.
What Vibeless writes outside its own directories
The Connected Agents installer writes your editor's MCP config and hook files, each wrapped in Vibeless-managed markers so removal is surgical. The full file-by-file audit — and how to remove everything by hand — is in Uninstall & Updates.
Reporting a vulnerability
Email security@vibeless.pro. The machine-readable disclosure policy is at /.well-known/security.txt.