Privacy Policy

Account info, only if you sign in. Getting an API key requires signing in with Google. We receive your name, email address and avatar URL via our authentication provider, Supabase — nothing else from that account. You never need to sign in to view the site, read the docs or use an embed.

API key data. We store a one-way SHA-256 hash of your API key (what every image request is actually checked against), a masked preview (e.g. ttk_ab12…9f3d), its status, and when it was created — tied to your account. We also store an AES-256-GCM encrypted copy of the full key so you can reveal it again later from the account menu instead of only ever seeing it once; the secret used to decrypt it is kept separately and is never stored in the same database, so a database leak on its own wouldn't expose usable keys. Regenerating your key replaces the hash and the encrypted copy and immediately invalidates the old one.

Pro waitlist email, only if you join. If you join the Pro waitlist on the pricing page, we store that email address and when you joined, only to tell you when Pro opens.

Sites that embed Vizyble. When a page embeds a Vizyble word, the visitor's browser tells us which website it's on. We store that website's domain name (e.g. example.com) and when it was first and last seen, to count how many sites use Vizyble. We don't store anything about the visitor.

IP address, briefly. Requests to the API, the waitlist and the MCP server are checked against rate limits keyed to the requester's IP address (or API key). The counter is stored in our rate-limit service, Upstash, and expires on its own within 24 hours. Our host, Vercel, keeps short-lived request logs that can include IP addresses, for security and debugging. IP addresses are never written to our database.

The word/text you render. Whatever text and style parameters you send to the API (word, font, flowerSize, and so on) is used only to generate that one image, in memory, for that one response. We don't log, store, or review the words people render.

A theme preference. Whether you're using light or dark mode is saved in your browser's localStorage. It never leaves your device.

Cookies. Signing in sets a Supabase session cookie so you stay signed in between visits. Google Analytics sets its own analytics cookies (such as _ga) on this site. We don't use advertising cookies. Embeds on other websites never set cookies.

Analytics. We use Vercel Analytics (cookieless), Google Analytics and PostHog to count page views and a few actions (such as copying a snippet or signing in), and to see errors on the site, so we can tell which parts help people. These services process your IP address and device information to do this. PostHog keeps an anonymous identifier in your browser's localStorage, not in a cookie. We don't send your name, email or API key to any of them.

• To create and authenticate your account when you sign in.
• To issue, validate, and let you regenerate your API key.
• To enforce rate limits and prevent abuse of the free-tier API.
• To render the images your requests ask for — a one-time, in-memory operation.

Vizyble runs on these third-party services, which process data on our behalf:

• Vercel — hosting and Vercel Analytics.
• PostHog — product analytics and error monitoring. See PostHog's Privacy Policy.
• Google — a sign-in provider, if you choose it, and Google Analytics. See Google's Privacy Policy.
• Supabase — hosts authentication and the api_keys, waitlist and embedding-site tables. See Supabase's Privacy Policy.
• Upstash — short-lived rate-limit counters. See Upstash's legal and privacy documents.

We don't sell data, and we don't share it with anyone else.

Your account and API key hash are kept until you ask us to delete them or you stop signing in. Regenerating your key immediately invalidates the old one, but the account row itself just gets a new hash — nothing lingers under the old key. Rate-limit counters expire within 24 hours. Waitlist emails are kept until Pro opens or you ask to leave. Embedding-site domains are kept while the site keeps using Vizyble. Rendered images are never written to disk or a database — each request produces a fresh image and nothing is retained afterward.

• Sign out at any time from the account menu — this clears your session cookie.
• Reveal your API key again anytime from the account menu.
• Regenerate your API key to invalidate the old one immediately.
• Email hello.vikasip@gmail.com to request that your account and key be deleted entirely, or to leave the Pro waitlist.

API keys are never stored in plaintext. A one-way SHA-256 hash is what every image request is checked against, and a separate AES-256-GCM encrypted copy is what lets you reveal your key again later — its decryption secret lives outside the database, so a database leak alone doesn't hand out usable keys. The underlying database table has row-level security enabled, and all reads/writes go through server-side code using a service-role connection, never directly from a browser.

Vizyble is not directed at children, and we don't knowingly collect data from anyone under 13.

Vizyble is a young, actively evolving product, so this policy will change as the product does. We'll update the “Last updated” date above whenever it does; material changes will be called out on this page.

Questions about this policy or your data? Email hello.vikasip@gmail.com.