Privacy Policy

Vibes Music • Effective Date: November 6, 2026 • Developer: Titan Xtrm • Contact: munnyverma116@gmail.com

This Privacy Policy describes how Vibes Music collects, uses, and handles data when you use the mobile application and backend services.

1. Data Processed by the Application

Account & Profile: Handle name, cryptographic public identity keys, and optional display avatar created by you.
Peer Messages & Voice Notes: Messages are encrypted on the sending device before transmission. The backend server acts only as an encrypted relay and does not hold message decryption keys.
Music Library & Playback: Liked tracks, recently played items, custom playlists, and downloaded audio tracks are stored locally on your device in private application storage.

2. Google Drive Integration (drive.appdata Scope)

      Limited Application Storage Access:

      Vibes Music requests the non-sensitive scope https://www.googleapis.com/auth/drive.appdata solely to store and restore your encrypted application backups directly in your own Google Drive account.

Implemented behavior for Google Drive integration:

Isolated Application Folder Only: Access is restricted strictly to the hidden Application Data Folder (appDataFolder) dedicated to this app. Vibes Music cannot read, modify, browse, or delete any personal documents, spreadsheets, images, or files in your Google Drive.
Client-Side Encryption: Before backup data is uploaded, the app encrypts your messages and library metadata on-device using PBKDF2-HMAC-SHA256 (100,000 iterations) and AES-256-GCM using your locally configured recovery key. The encryption key and plaintext backup files are not transmitted to or stored on Vibes Music backend servers.
User Storage Ownership: Encrypted backup files exist solely on your device and in your personal Google Drive account.
Revocation and Deletion: You can delete your remote backup from Google Drive at any time via the in-app "Delete Remote Backup" option (which instructs the Google Drive API to delete files from the application data folder). You may also revoke the application's access via your Google Account Permissions. Remote file deletion is subject to Google Drive API completion and standard Google Drive trash/lifecycle behavior.

3. Data Sharing

We do not sell, rent, or trade personal data. We do not incorporate third-party advertising SDKs or cross-site tracking tools in the application.

4. Security Controls

Data transmitted between the client and backend uses TLS 1.3 encryption. Secret recovery keys are stored locally on-device in platform secure storage (Android Keystore / SecureStore).

5. Contact Information

For questions or assistance regarding this Privacy Policy, contact munnyverma116@gmail.com.