Vibz — Privacy Policy

Version: 1.0.0 Effective date: 2026-09-17 Last updated: 2026-09-19 Operator: Midwest Technical Training & Consulting INC, a Missouri corporation ("Vibz", "we", "us").

This Privacy Policy explains how Vibz ("we", "us") collects, uses, and shares information when you use the Vibz mobile apps, website, and related services (the "Service").

1. Information we collect

1.1 Information you give us

Account info: phone number, display name, profile photo, status, date of birth (used to enforce minimum age), the friend code you choose.
Your content: posts, comments, captions, messages, photos, videos, voice / video call participation, stickers you create, and channels you publish or follow.
Teen social access information, where enabled: adult/minor link requests, approvals, declines and revocations; the adult's age-and-authority attestations; teen safety acknowledgement; relationship status; and the social-capability settings selected by the linked adult. This control does not collect companion-view activity, message copies, call content, or decryption keys for adult review.
Contacts, only if you allow it: if you give the app permission to read your contacts, it reads the phone numbers saved in your device's address book and sends them to our servers so we can tell you which of your contacts already use Vibz. Your device sends numbers that fit the North American ten-digit format, which covers the United States, Canada, Jamaica, and other countries that share the +1 country code. A number in any other format is skipped on your device and is not sent. On our servers each number is converted into a scrambled value using a key only we hold, compared against our users in memory, and then discarded when the request finishes: we do not store the numbers from your address book, we do not write them to our logs, and we do not give them to anyone else. What we keep is the result of the match only — a record that your account and a matched account are connected, with no phone number attached to it. We use those records to suggest people you may know. The same match also names calls: our reply tells your device which Vibz account a number your device sent us belongs to, so your phone can recognise a Vibz call as coming from someone already saved in your contacts. That matching happens on your device, against your own address book — the names and photos saved in your contacts are never sent to us, and we never see them. On iPhone, Vibz calls are recorded in your phone's own Recents call history whether or not contacts permission is on, and this match is what lets those entries carry the name you have saved for that person instead of their Vibz name; those entries sit in your phone's call history outside the Vibz app, and you clear them there. While contacts permission is on, your device refreshes them about once a day. You can turn contacts permission off at any time in your device settings, and the rest of the Service works without it.
Private names you give other people (aliases): you can give another Vibz user a custom name that only you see — for example, "Mom" instead of the name on their profile. We store the name you choose on our servers, together with which account it is for, so it shows up on every device you sign in to. An alias is visible only to you: it is never shown to the person you named or to anyone else, and we do not use it for advertising. You can change or clear an alias at any time, and clearing it deletes it from our servers. Your aliases are included when you download your data. This is separate from the Use names from my device contacts setting, which is off unless you turn it on: when it is on, the app shows the name saved in your phone's contacts for people you are matched with, and those names stay on your device and are never sent to us.
Support: the contents of any email or in-app form you send us.

1.2 Information collected automatically

Device + technical: device model, OS, app version, locale, timezone, language, push token, app-instance identifiers used for push delivery, a one-way hash of a device identifier (the Android device ID, or an identifier the app creates and keeps in the iPhone Keychain), keyed with a secret only we hold and used only to recognise the phone an account was last used on so that a reinstall on the same phone can keep the account, optional crash reporting and app-integrity attestation, and limited network/request data used to deliver and secure the Service.
Usage: what public content you view and interact with in the feed (impressions, watch progress, likes, comments, follows, "not interested" feedback), and message delivery and read state. If you enable optional crash reporting, Firebase Crashlytics also receives crash and error details, basic app and device state, and the Vibz account identifier used to correlate a report with a support request.
Network and location: our infrastructure processes IP addresses and may retain them in limited security or access logs. We do not use them to build a location profile, and we do not collect precise GPS location.
Third-party SDKs: we do not use third-party advertising SDKs. Google Firebase supports authentication, push notifications, optional crash reporting, and app integrity. Cloudflare RealtimeKit handles camera, microphone, and network connection details during voice and video calls. These services do not receive your message contents.
Optional Firebase Crashlytics reporting is off by default. You can enable or disable it with the Share crash reports toggle under Profile → Account Settings → Account → Privacy → Diagnostics. A change takes effect the next time you open Vibz. Disabling it stops that device from sending further Crashlytics reports; reports already sent are not recalled.
Service diagnostics are separate from the optional Crashlytics switch. When phone verification fails, Vibz sends our servers the phone number attempted, failure stage and reason, app version, platform, and limited technical context so we can secure and troubleshoot sign-in. The phone number is encrypted in the diagnostic record and also converted to a keyed value used for lookup. We also keep limited authentication, security, encryption-delivery, and call events needed to operate and protect the Service. Authorized staff can enable a time-limited diagnostic capture for a specific account when investigating a serious technical problem; depending on the problem, it may include account, device, message or conversation identifiers, event stages, app/platform version, errors, and limited technical state. These server-side records are access-controlled, and our retention target is 7 days, after which a scheduled sweep removes them, unless they must be preserved longer for legal, safety, or security reasons. They are not controlled by the optional Crashlytics switch.

1.3 Information from third parties

Phone-number verification results from our verification provider (Firebase Authentication / SMS delivery partners).
Crash reports from Apple's and Google's own platform diagnostics, where your device's operating-system setting allows the platform to share them with developers. That setting is separate from optional Firebase Crashlytics reporting in the app, which is described in section 1.2 and is off until you enable it.

We do not sell your personal information.

2. How we use your information

Provide, secure, and improve the Service.
Personalize content and recommendations in the feed.
Rank, recommend, or limit content based on signals such as how recently it was posted, the channels you follow, likes and comments from other users, what you have already seen and how long you watched it, your "not interested" feedback, and whether an account is under 18 (see our Recommender & Feed Transparency page).
Authenticate you and protect against fraud, spam, and abuse.
Moderate content and enforce our Terms of Service.
Comply with law, respond to legal process, and prevent harm (including reporting CSAM to NCMEC as required by US 18 USC §2258A).
Send you transactional messages (security alerts, account notices) and, only if you opt in, marketing messages.

We process your information to perform our contract with you (operating your account), for our legitimate interests (security, abuse prevention, product improvement), to comply with legal obligations, and with your consent (for tracking, marketing, optional integrations).

3. Sharing

We share information with:

Other users, in the way the Service is designed to display it (your posts, comments, profile, etc.).
Service providers that process data on our behalf under contract: hosting, storage and content delivery, push notifications, phone verification, optional crash reporting, calling infrastructure, app attestation, support tooling, and cloud-backup integrations. A list of current categories appears in §10.
Law enforcement / legal requests, where required by valid process or to prevent imminent harm.
Business transfers (acquisition, merger, sale) — we will tell you in advance if your data would move to a different controller.
Linked adult accounts, where teen social access controls are enabled, receive the link status and can manage the minor account's allowed social capabilities. They do not receive the minor's message contents, call content, communication copies, or activity-monitoring data.

We do not share your contact list or message contents with third parties for advertising. Section 1.1 explains what happens to address-book numbers when you turn contacts permission on, and section 5 explains how long the resulting match records are kept.

4. Encryption

All traffic between the app and our servers uses HTTPS (TLS 1.2+).
Direct messages between users are end-to-end encrypted (E2EE) using the Signal protocol. We hold ciphertext only; we cannot read your messages.
Media you send in DMs — photos, videos, voice notes, and file attachments — is also E2EE: the bytes are encrypted on your device before upload and only the recipient can decrypt them.
Group chats come in two visibilities, chosen at creation time and immutable thereafter:
Private groups are end-to-end encrypted and are not discoverable in search, discovery, or recommendations. The per-message content key is wrapped to each eligible current member's device so only those members can decrypt; Vibz holds ciphertext only. Restricted accounts (under 18) cannot join or access private groups.
Public groups (and public groups that require admin approval to join) are encrypted in transit (HTTPS / TLS 1.2+) but are not end-to-end encrypted. Vibz stores public-group content in server-readable form so we can review abuse reports, support discovery and search, enforce the Community Guidelines, and keep the Service safe. Anyone may join public groups, including restricted accounts, subject to our safety rules.
Voice and video calls are routed through Cloudflare RealtimeKit and are encrypted in transit (TLS / DTLS-SRTP). Calls are not end-to-end encrypted. We do not record or store the audio or video content of your calls; a basic call record (participants, start/end time, status) is kept to a retention target of 30 days, after which a scheduled sweep deletes it.
Channel and feed content is tiered. Content you publish to the public feed, or to the public tab of a channel, is not encrypted at rest: we store it and serve it in readable form, and the hosting, storage, and content-delivery providers we use can read it. That is deliberate—it lets us display, rank, and moderate public content. Non-public channel content (private, subscriber-only, and mutual posts), all vibes, and the captions on that content use end-to-end encryption, as described in section 4.1. Profile-photo storage depends on the upload format; Vibz can stop serving the associated object when a profile image is removed. Group photos are stored in readable form.
Custom personal stickers that you send in DMs and PRIVATE groups are end-to-end encrypted at rest, the same way as photos, videos, voice notes, and files. Stickers from our built-in catalog (default and downloadable packs we host) are public content by design and are not E2EE; everyone who has access to the catalog gets the same files.
Public posts are not end-to-end encrypted because the Service must be able to display them to other users and moderate them. Your use of public groups, channels, and the public feed does not affect the privacy of your personal messages, which continue to be end-to-end encrypted.

4.1 Private content, keys, device changes, and backups

What is end-to-end encrypted. Private vault posts, subscriber-only and mutual channel posts, all vibes, and the captions on that content are end-to-end encrypted on your device before they are uploaded. Information we need to run the Service, such as account and post identifiers, timestamps, the audience you chose, and delivery and access records, is not end-to-end encrypted. In ordinary operation Vibz stores only ciphertext and the public key material needed to route encrypted grants, so we cannot read that content or its captions.

Your keys. The keys that unlock this content are created and stored on your device, and are included in your backups. Vibz does not hold these keys and cannot reset or replace them. If you explicitly attach a subscriber-post content key with a report, authorized moderation may decrypt that reported target for trust-and-safety review; that targeted, user-initiated exception does not give Vibz a general key or access to other end-to-end encrypted content, and it is not an account-recovery key.

Backups. We encrypt your backups to protect them if your device is stolen, and we store the key to your encrypted backup securely on our servers. We store only that key. The backup file itself stays on your device or in your own Google Drive or iCloud account, and is encrypted before it leaves your device. To get the key back, you verify that you own your phone number by SMS. Vibz does not receive your backup files. Backups stored in your cloud account are also subject to your provider's terms and privacy policy.

What a backup contains. A backup contains the keys for your end-to-end encrypted content and, in a chat backup, your chat history as stored in the app on your device: your messages and conversations, and the photos, videos, voice notes, files, and personal stickers saved with them. You can choose to leave videos out of chat backups.

Where backups are stored. Backups are stored only in places you control:

On your Android phone. The app makes a nightly backup to your phone's own storage, in the Download/Vibz/backups folder. The folder stays on the phone if you uninstall Vibz, and you can copy it to a new phone. Other people or apps with access to your phone's files could copy the backup, but they cannot open it without signing in to your Vibz account or having your recovery key.
In your own cloud account, if you turn it on. Cloud backup to your Google Drive (Android) or iCloud (iOS) is optional, never required, and it is your choice whether to turn it on. The copy kept there is held under that provider's terms and privacy policy as well as ours. On Android the app uses the private app-data folder of the Google Drive account you connect.

Backups are sent from your device directly to your phone's storage or your cloud account. They do not pass through Vibz servers, and Vibz does not receive your backup files, their plaintext contents, or your recovery key.

How backups are protected. Backups are always encrypted on your device. The key that opens them (your backup key) is kept on our servers, encrypted, and linked to your Vibz account. We store only that key. We release it only to your own account, and only after you verify that you own your phone number by SMS. Vibz does not receive your backup files. A backup can be restored only to the Vibz account that made it. Restoring a cloud backup also requires access to the same Google or Apple account the backup was saved to.

Recovery key (optional). You can create a recovery key in Chat Backup settings as an extra layer of protection. It is a code generated on your device, shown to you once, that you write down or save yourself, and it can also open your backups. Vibz never sees it and does not store it. If you lose it, you can create a new one, which stops the old one from working on backups made after that point.

Changing phones. When you change phones, you can (1) transfer from your other phone with the in-app phone-to-phone transfer (by QR code), or (2) restore from a backup by signing in to your account (and, for a cloud backup, using the same Google or Apple account). If neither is available, signing in starts a new account; see "If your account can't be recovered" below. A phone-to-phone transfer moves your keys, not chat history. Chat history is restored only from a backup made on the same platform (on Android, from your phone's storage or Google Drive; on iOS, from iCloud); a transfer between iOS and Android does not move chat history.

If you lose your phone without a backup. Whether to turn on cloud backup is your choice, and we recommend it. If you lose your phone and have no backup you can restore and no other phone to transfer from, you permanently lose access to the end-to-end encrypted content protected by those keys and to any chat history that is not in a backup. Vibz and our providers cannot restore the keys or the content.

If your account can't be recovered. If you sign in on a phone with no way to recover your account (no transfer from another phone and no backup), and you do not keep it on the same phone as described below, signing in starts a new account on your phone number. The previous account is closed immediately: it is signed out on every device, hidden from other users, and removed from contact matching, but its data is not deleted yet. For 30 days it can be recovered with its backup, its recovery key, or a transfer; recovering it removes the new account. After 30 days the closed account is deleted exactly as if you had deleted it yourself (see "Deleted account" in section 5), including the retention of moderation, safety, and legally required records. Content that can't be decrypted can't be restored. An account that has been inactive for 45 days or more is treated the same way when its phone number signs in on a device with no recovery path.

Keeping your account on the same phone. If you sign in again on the phone your account was last used on, with no backup and no other phone to transfer from, you can keep your account instead of starting a new one. We recognise that phone by the hashed device identifier described in section 1.2. The app creates new keys, and your profile, public posts, connections and conversations stay. Your private, subscriber-only and mutuals posts made before then can't be opened with the new keys: they are hidden from everyone, you included, for 30 days, and restoring a backup that has the old keys in that time brings them back. After 30 days they are deleted with their media, unless a safety report or legal hold preserves them.

We first preserve content required by an open safety report or a media-moderation/legal hold for up to one year from when preservation begins (or the applicable statutory start), or longer where law requires. A held encrypted object may remain unreadable without a separately reported content key; a hold preserves bytes and evidence, not a promise that Vibz can decrypt them.

Unsubscribing, blocking, or being removed from a channel ends access to all of that channel's posts: Vibz stops returning feed rows, key grants, and signed media URLs, and the app purges its cached copies. This cannot revoke ciphertext or keys that a modified client already downloaded, and the access guarantee also depends on CDN expiry enforcement. Do not treat a prior download as recalled merely because your subscription ended.

5. Retention

We keep your information only for as long as we need it. The periods below are the retention targets our systems apply. Deletion is carried out by scheduled clean-up jobs, so a record can persist past its stated period until the next sweep removes it. A legal hold, a safety investigation, or a security incident can extend any of them. Indicative retention:

Category	Retention
Active account	Until you delete the account
Deleted account	Deletion runs immediately when you confirm it. Hard-deleted: your messages, posts, comments, follows, blocks, channel relationships, settings and interests, sessions, devices, encryption keys (including account-content keys), and the media files you uploaded, which are removed from our storage and not only unlinked. Your phone number is erased from your account record, not replaced with a placeholder. What remains is a tombstone row carrying no phone number and the name "Deleted user", kept so that safety reports and other people's conversations referencing the account remain actionable. Moderation, safety and security records about the account — enforcement history, reports, and anything we are required by law to preserve — are retained as described in the rows below
Closed account (when signing in starts a new account on the same phone number, described in section 4.1)	Kept, hidden, and signed out, for 30 days so it can be recovered with its backup, its recovery key, or a transfer. Then deleted exactly as a deleted account (row above). A link between the new and the closed account (account identifiers and dates only) is kept for the same 30 days, then removed
Delivered direct messages and private-group messages (E2EE ciphertext)	We do not retain message contents in the ordinary course: message bodies are purged from active servers about 24 hours after delivery, unless reported or preserved for legal, safety, or security reasons
Undelivered messages	If a message cannot be delivered immediately (for example, the recipient is offline), we keep it in encrypted form on our servers for up to 30 days while we try to deliver it, then delete it
Call records (participants, start/end time, status — never call audio or video)	Up to 30 days
Teen social access records, where enabled	Pairing codes expire after 10 minutes. Link requests, approvals/declines/revocations, adult attestations, teen safety acknowledgement, and capability settings are kept as needed to operate and audit the relationship and are handled by the account-deletion process, subject to legal, safety, and security retention requirements. No companion-review message copies, call content, or decryption keys are created.
Message metadata and tombstones (message ID, timestamps, delivery/read state, reaction/edit/delete state — never message contents)	Up to 12 months where needed for delivery, abuse prevention, edits, reactions, deletions, safety, and legal compliance
Contact-match records (which two accounts are connected — never a phone number, and never a copy of your address book)	Kept while your account exists, and deleted when you delete your account. We only act on a record your device has refreshed within the last 35 days, so a contact you remove from your address book stops affecting your suggestions within that window even while the record itself is still on file
Contact aliases (private names you give other people)	Kept until you change or clear the alias. Deleted when you delete your account, and deleted when the person you named deletes theirs
Sign-in, security, message-delivery state, and time-limited technical diagnostic records	Up to 7 days, unless preserved longer for legal, safety, or security reasons
Push notification delivery records (device token, message and conversation identifiers, delivery result)	Kept while your account exists, and removed when you delete your account
Stale device records	Deleted after 90 days of inactivity
Encrypted message key-delivery records for private groups	Kept with message metadata/tombstones where needed to deliver, sync, recover, or troubleshoot encrypted group messages; these records are wrapped to recipient devices and do not contain plaintext message content
Signal device public keys and one-time prekeys	Kept while the device/account is active; claimed one-time prekeys are pruned after about 90 days by default; old signed prekeys may be kept in limited history so delayed messages can still decrypt
Encrypted key and chat backup archives	Kept on your Android phone's storage (Download/Vibz/backups) and, if you turn on cloud backup, in your own iCloud (iOS) or Google Drive app-private folder (Android). The app keeps a small number of recent archives and deletes older ones automatically; you can also delete them yourself, and archives in your cloud account are subject to that provider's storage and retention controls. Archives are always encrypted on your device. Vibz does not receive the archives, their contents, or your recovery key
Hashed device identifier	Kept while your account exists, for up to 20 phones per account (the oldest is dropped past that), and deleted when your account is deleted. We never receive the raw device identifier
Posts held after keeping your account on the same phone (described in section 4.1)	Private, subscriber-only and mutuals posts made before then are hidden from everyone, you included, for 30 days so that restoring a backup can release them. Then they are deleted with their media, unless a safety report or legal hold preserves them. A record of the reset (dates and post counts, no content, keys or phone number) is kept until your account is deleted
Backup key (server-held)	Kept, encrypted, while your account exists, including while a closed account can still be recovered, and deleted when your account is deleted. We store only the key, never the backup file: the file stays on your device or in your own cloud account, and Vibz does not receive your backup files. We release the key only after you verify that you own your phone number by SMS
Backup key release records	We keep a record of each release of the key — the date, the session it went to, and the key version. It holds no phone number, no backup file and no key material. We use it to protect accounts against misuse of the recovery path, and we keep it after an account is deleted so it is still available for security and legal review
Private/subscriber-only media under an open safety report or legal/media-moderation hold	Up to one year from when preservation begins (or the applicable statutory start), or longer where law requires; the hold preserves the ciphertext and evidence even when no usable decryption key is available
Vibes (ephemeral moments)	A vibe stops being visible to the people it was shared with when its window closes — 24 hours by default, or 3 days if you choose that when you post it. Expiry is a change in who can see it, not a deletion: the vibe and its media stay in your own Previous moments archive, visible only to you and available for you to reshare, and are kept there until you delete the vibe or delete your account. Deleting a vibe removes its media from our storage, not only the link to it. The record of who viewed a vibe is kept with the vibe, and is removed when the vibe is deleted or when that viewer deletes their account
Public posts	Until you delete or your account is deleted
Public-group messages	Until deleted by the sender, removed by moderation, or the account/group is deleted
Moderation reports + decisions	Kept while needed to enforce our rules, handle appeals, and detect repeat abuse. Reports tied to a child-safety determination are kept as required by law
Server access logs	30 days
Server backup retention	35 days rolling; your encrypted phone-storage, iCloud, and Google Drive archives are controlled separately by you and are not this server retention row

Important encryption-retention note: deleting an encrypted message body from active servers does not immediately delete every supporting key or device record. Vibz keeps some encrypted key-delivery records, device public keys, prekey history, and locked account-key metadata longer than 24 hours so the Service can deliver delayed messages, support multi-device sync, prevent abuse, and troubleshoot encryption failures. These records are not plaintext message content and are not made available to linked adults for review. Your recovery key is not stored by Vibz. The backup key we store is described in section 4.1 and in the retention table above.

Your device may keep decrypted message bodies, media files, and media decryption keys in local app storage after the server copy is purged. You can remove that local copy by deleting the message, deleting the conversation, deleting your account, or clearing/removing the app data from your device.

6. Your rights

Depending on where you live, you may have the right to:

Access the personal data we hold about you.
Correct inaccurate data.
Delete your account and associated data (you can do this from inside the app).
Export your data ("data portability") — request a copy under Profile → Account → Privacy → Download my data.
Object to or restrict certain processing.
Withdraw consent for processing that relies on consent.
Lodge a complaint with your local data protection authority.

To exercise any right not directly available in the app, email privacy@marketvibz.com.

7. Children

The Service is not directed to children under 13. We do not knowingly collect personal information from children under 13. If we learn we have collected such information without verifiable parental consent, we will delete it. Some jurisdictions set a higher minimum age (e.g. 14, 15, or 16) — those minimums are enforced where they apply.

For users between 13 and 17, we apply additional safety defaults: private profile by default, restricted DM and calling, limited discoverability, no private-group access, public-group access only where allowed by our safety rules, and no view-once or time-expiring secure media. Teen accounts do not receive adult-oriented recommendations.

Where teen social access controls are enabled, an eligible minor and adult account must both approve a link before the adult can allow specific social capabilities. The adult account's declared date of birth must indicate age 18 or older, and the adult attests that they are authorized to supervise the minor; Vibz does not verify identity or legal relationship through this flow. The link controls access only and provides no message, call, or activity monitoring. Age-restricted content, adult-oriented recommendations, view-once media, disappearing media, private groups, and other age-restricted features remain blocked.

Adults may enable Filter messages from strangers so direct messages from people they do not follow land in a separate Message Requests inbox without a notification or badge. From there, the adult can accept the conversation into the main inbox or decline it and delete the request.

8. International transfers

We are based in the United States. If you use the Service from outside the US, your information will be transferred to and processed in the US (and possibly other countries where our service providers operate).

If you use the Service from Jamaica, your information is transferred to and processed in the United States. That transfer is necessary to perform our contract with you: the Service is operated from US infrastructure and cannot be provided to you without it. By creating an account and using the Service you also consent to that transfer. Where a transfer to any other country is required, we rely on the same contractual necessity or on your consent, and we apply the safeguards described in Section 9 wherever your information is processed.

9. Security

We use industry-standard administrative, technical, and physical safeguards. No system is 100% secure. Vibz has no passwords: you sign in with your phone number and a one-time code, so the security of your account depends on the security of your phone and your phone number. We encourage you to lock your device with a passcode or biometric, keep control of your phone number (and contact your carrier immediately if you suspect a SIM-swap), and never share a Vibz verification code with anyone — we will never ask you for one.

If we discover a security incident affecting your information, we will notify you and the appropriate regulators as required by law.

10. Service providers (categories)

The current categories of third parties that process data on our behalf include:

Cloud hosting (US-based providers)
Media storage and content delivery (Cloudflare R2 / CDN)
Phone verification (Firebase Authentication and SMS delivery partners)
Push notification delivery (Apple APNs, Google FCM)
Real-time voice / video infrastructure (Cloudflare RealtimeKit)
Crash and error reporting (Firebase Crashlytics)
App attestation (Apple App Attest, Google Play Integrity via Firebase App Check)
Cloud backup storage integrations: Apple iCloud for iOS backups and Google Drive for Android backups. The app writes only its encrypted backup archives; on Android it requests the restricted drive.appdata scope and uses the user's private app-data folder. Archives are encrypted on your device before they are sent; iCloud and Google Drive receive only that ciphertext, never your plaintext chat history, private-media keys, your backup key, or your recovery key. You can delete the archives through the app's backup controls or the applicable cloud provider.

Vibz does not claim proactive image or video scanning at upload. Reports involving possible child sexual exploitation receive priority moderator review. After a moderator records a reportable determination, the backend queues the required CyberTipline submission and applies the appropriate preservation and takedown workflow. End-to-end encrypted content cannot ordinarily be inspected by Vibz. If a reporting user explicitly supplies a subscriber-post content key with the report, authorized moderation may decrypt only that reported target for review; this does not provide general access to end-to-end encrypted content.

The automated screening Vibz performs before publication is on text, not media: a keyword filter runs when you change your display name or profile status, when you upload a public post with a caption, and when you write or edit a comment. Captions on end-to-end encrypted content are not screened by this filter because Vibz cannot read them. The list is tiered, and a match does not always mean the same thing. A small set of child-sexual-abuse solicitation phrases is refused outright — the post, comment, or profile change is not saved. A separate list of severe slurs and explicit violent threats is not refused: that content is published, and an automatic report is filed at the same time so a person reviews it. Anyone who sees it can also report it. It is a keyword filter, not a general-purpose content classifier, and it does not read your end-to-end encrypted messages.

11. Changes

We may update this Policy. When we do, we will bump the version, post the updated version at this URL, and notify you in-app. For material changes affecting your rights, we will require you to accept the new policy before continuing to use the Service.

12. Contact

Privacy: privacy@marketvibz.com
Jamaican controller representative (Data Protection Act, 2020, section 3(2)): Damano McKenzie — dpo.jamaica@marketvibz.com