VibeFlow Privacy Policy

Effective date: 14 August 2026 · Last updated: 11 October 2026

This Privacy Policy describes how VibeFlow (“VibeFlow”, “we”, “us”) collects, uses, discloses and protects your information when you use the VibeFlow website at sxagg.com and the VibeFlow mobile application, and explains your privacy rights. By using the Service you agree to the collection and use of information in accordance with this Policy.

1. Personal data we collect

While using our Service we may ask you to provide certain personally identifiable information that can be used to contact or identify you. This data is used to provide and improve the Service.

• Account and profile data — name, email address, profile photo and the account identifier from the login provider you used.
• Content you create — posts, comments, stories, messages, media you upload, and any optional place tag you attach to them.
• Location data — see section 4, which describes this in full.
• Anonymous submissions — what a page's submission form records about the person sending a post is described in full in section 5.
• Usage and device data — app version, device model, operating system version, and diagnostic logs used to keep the Service running.

2. Information from third-party social media services

The Service lets you sign in with an existing social media account.

• Supported third-party login providers include Facebook, Instagram and Google.
• If you grant us permission, we may collect personal data already associated with your social media account — such as your name, email address, activity data and analytics associated with that account.

3. Tracking technologies and cookies

• Cookies or browser cookies: a small file placed on your device. You can refuse all cookies in your browser settings, though this may affect Service functionality.
• Purpose: cookies let us remember your preferences and login details so you do not have to re-enter information on every visit.
• Advertising cookies (Google AdSense): the website uses Google AdSense to show ads. Third-party vendors, including Google, use cookies to serve ads based on your prior visits to this website or other websites. Google's use of advertising cookies enables it and its partners to serve ads to you based on your visits to this site and/or other sites on the Internet.
• What Google receives: the ad script runs in your browser, so Google receives information such as your IP address, cookie identifiers and the address of the page you are viewing, and handles it under its own policy — see How Google uses information from sites that use its services.
• Analytics cookies (Google Analytics): the website uses Google Analytics to count visits and see which pages are read. It sets cookies that tell one browser from another, and receives the address and title of the pages you view — not your account details or anything you submit. It does not run on the anonymous submission forms.
• Your choices: press “Decline” in the cookie notice to turn analytics off and keep ads non-personalised, or reopen the notice at any time with Cookie settings. You can also opt out of personalised advertising from Google in Ads Settings, or from participating third-party vendors at aboutads.info.

4. Location Data

The VibeFlow mobile app collects and uses device location. Every location feature is optional and off until you turn it on, and the app remains fully usable if you never grant the permission. This section states exactly what is collected, why, who it is shared with, how long we keep it, and how to switch it off.

4.1 What we collect

• Approximate location (network-based, ACCESS_COARSE_LOCATION).
• Precise location (GPS-level, ACCESS_FINE_LOCATION).
• Background location (ACCESS_BACKGROUND_LOCATION together with a location foreground service) — collected only if you separately choose the “Always allow” sharing mode described in 4.2.

Location is read only while you are using one of the features below, and only after you have granted the Android location permission.

4.2 Sharing your location with friends (Friends map)

• Location sharing is off by default. When you turn it on, your current coordinates and a coarse place label (for example “Petaling Jaya, Malaysia”) are stored on our servers.
• Your position is shown only to your mutual follows — people you follow who also follow you back. It is shown to nobody while sharing is off. This rule is enforced on our servers, not only in the app.
• “While using the app” mode (the default): your position is refreshed when you open the app or the map.
• “Always allow” mode (background location): your position is updated in the background roughly every 2 minutes, or after about 150 metres of movement. This mode is separately opt-in, and while it is running Android displays a permanent notification reading “Location sharing on”. You can return to “While using the app” at any time.
• Restricted areas: you can define up to 10 zones (for example home or workplace). While you are inside one, your position is hidden from everyone. This is applied on our servers, so it holds even if the app is out of date.
• Retention: we store only your most recent position — each update overwrites the previous one; we do not build a location history from it. A stored position stops being shared with anyone once it is more than 7 days old.

4.3 Place tags on posts and stories

• Adding a place to a post or story is optional and happens only when you choose it while composing.
• A place tag is stored with that content and is visible to everyone who can see the content.
• A story tagged with a place also appears on VibeFlow's story map, which is visible to all signed-in VibeFlow users for as long as the story is live (24 or 48 hours, as you chose when posting).
• Deleting the post or story removes the place tag with it.

4.4 Community rides

• When you request a ride, your pickup coordinates and your chosen destination are stored with the ride request and shown to drivers browsing nearby open requests.
• Once a ride is confirmed, and until it is completed or cancelled, your position is sent approximately every 12 seconds and shown to the other party on the trip map so you can see each other approaching. This stops as soon as the ride ends.
• Pickup and destination coordinates remain attached to the ride record as part of your trip history.

4.5 Choosing your content region

• A one-off, optional approximate reading, matched to the nearest supported region, so the app can show content relevant to where you are.
• The result is saved on your device only. These coordinates are not transmitted to our servers.

4.6 Who your location is shared with

• Other VibeFlow users, only as described above: your mutual follows on the friends map, anyone who can see content you place-tagged, and your counterparty during an active ride.
• Mapbox — we send coordinates to Mapbox to convert them into a place name, to search for destinations, and to calculate driving routes and estimated arrival times. Mapbox processes them under its own privacy policy.
• We do not sell your location data, do not share it with data brokers, and do not use it for advertising, profiling or any purpose unrelated to the features above.

4.7 Your controls

• Turn the sharing toggle off on the Friends map. Your pin disappears from every friend's map immediately and no further positions are collected.
• Choose “While using the app” instead of “Always allow” to end all background collection.
• Add restricted areas to keep chosen places permanently hidden.
• Revoke the permission at any time in Android Settings › Apps › VibeFlow › Permissions › Location. The rest of the app continues to work.
• Delete a post or story to remove the place tag attached to it.
• To have the location data we hold about you erased, email support@sxagg.com and we will action your request within 30 days.

5. Anonymous submission forms

Anyone can send a post to a community page through its submission form (addresses beginning sxagg.com/s/ or sxagg.com/submit/) without creating an account. On these forms, anonymous means that your name is not asked for and readers of the page are never shown who sent a post. It does not mean that nothing is recorded: the page's admins and VibeFlow can see the details listed below. This section states exactly what the form records, who sees it, how long it is kept and how to have it removed.

5.1 What the form records when you submit

• What you write and attach — the text of your submission and any images, GIFs or videos you add.
• Your email address, where the page requires one or you choose to give one. Most pages require it. Some also ask you to confirm the address with a code we email to it.
• Your device's location (GPS coordinates), where the page requires it: your browser asks for permission, and the form cannot be sent without it. Where the page does not require it, the form still sends your position if your browser has already been allowed to share location with this site, and sends nothing otherwise.
• Your IP address and browser details (the browser's user-agent string and any forwarding headers added by a proxy), recorded with every submission.
• An approximate location worked out from your IP address — country, region, city and the name of your internet provider.
• The time you submitted, and your answers to the two tick-boxes on the form (email transcript, terms).
• A private access key — eight characters, created for your submission and shown to you when it is sent. It is the only way to prove later that a submission is yours, so keep it.
• The result of automated screening — what each moderation engine scored on your text and on each image or video frame.

The form does not ask for your name, and you do not sign in to submit.

5.2 Who can see it

• Readers of the page see only what the page publishes: your text and media. Your email address, IP address and location are never published, and are not part of what is sent to Facebook or Instagram.
• The page's admins see your submission together with your email address, your IP address, the approximate location and internet provider worked out from it, and — where your device's location was sent — a map link to those coordinates. Admins who have switched on email alerts also receive each new submission by email, with the email address you gave.
• VibeFlow staff can access the same records where needed to run the service, investigate abuse or answer a lawful request.
• We do not sell this data, and we do not use your submission, email address or location to target advertising.

5.3 Why these details are recorded

• To keep spam, floods and automated abuse off the forms.
• So that a page's admins can recognise and block repeated abuse from one source.
• So that the page and VibeFlow can act when a submission threatens or harms someone — including by answering a lawful request from the police, a regulator or a court. An anonymous form is not a shield for unlawful posts.

5.4 Other companies that process it

• OpenAI and DeepInfra (which hosts Meta Llama 4 Scout) are sent the text and media of a submission for moderation screening. A further classifier for images and video frames runs on our own servers.
• ip-api.com is sent your IP address and returns the approximate location and internet provider described above.
• Meta (Facebook and Instagram) receives the text and media of a submission when the page's admins publish it.
• Amazon Web Services (Simple Email Service) delivers the emails described below, and so processes your email address.
• Stripe and Billplz process the payment if you pay to boost a post.
• Google — when the form pages show Google AdSense ads, what Google's ad script receives is described under Tracking Technologies and Cookies. Google Analytics does not run on the submission forms.
• Some of these companies process data outside Malaysia.

5.5 What your email address is used for

• If you tick Receive Email Transcript: a copy of your submission with its access key, and a notice when it is published. If you leave it unticked, we send you neither.
• A one-time code, on pages that ask you to confirm your address.
• Updates about a boost payment, if you make one and give an address for them.
• We may also write to it with service announcements — for example a change of the site's address, or a notice that our emails were delayed — and occasional product news. To stop these, email support@sxagg.com with the subject “Unsubscribe”.
• We stop writing to an address that bounces or reports our mail as unwanted.

5.6 How long it is kept

• A submission and everything recorded with it — email address, IP address, location, screening results and media files — are kept for as long as the page's admins keep the submission, whether it is waiting, scheduled, published or archived.
• When a submission is deleted — by you, with your access key, before it is published, or by an admin — it moves to the page's deleted list. After 30 days there, or sooner if an admin destroys it, it is removed from the page and its admins can no longer restore it. It is then held privately for a further 30 days, in which only our support team can restore it at the request of the page's admins, and after that it is erased permanently, together with its media files and technical records — up to 60 days in all. A submission with a paid boost, or with a payment still under review, is not erased automatically.
• A post already published to Facebook or Instagram remains there, under Meta's policies, until the page's admins remove it.
• Web server access logs (IP address, time and the address requested) are kept for 14 days.
• A session cookie is set when you open a form and lasts up to 7 days.

5.7 Reading a page and commenting

• Opening a form page is counted once a day per browser session towards the page's daily view figure. No name or IP address is stored with that count.
• To comment on a post from a form page you sign in — with Google, Facebook, or an email address and password. We store your name, email address, profile picture and, for email sign-up, a hashed password. Your name and picture are shown with your comments. Your email address is not shown.

5.8 Boosting a post

• Paying to mark a submission as Priority is optional. We record the amount, the payment method, the payment processor's reference, the time, and an email address if you give one for updates.
• Card and online-banking details are entered on the payment processor's own pages and never reach our servers.
• If you pay by DuitNow QR and upload a receipt, the image is kept until our payments desk has checked it and for a limited period afterwards — currently 30 days — and is then deleted.

5.9 Withdrawing a submission, and your rights

• While a submission is waiting to be published, enter your access key in the form's recall panel to withdraw it immediately.
• Once it is published, or if it has been held for review, the same key opens a private thread with the page's admins, where you can ask for the post to be removed. Messages and files you send there are stored with the submission and can be read by the page's admins and, where needed, VibeFlow staff.
• To ask what we hold about a submission, to have it corrected or erased, or to withdraw consent to our holding your email address or location, email support@sxagg.com with the access key or the email address used. Because there is no account, we need one of them to find the record. We act on these requests within 21 days.
• You may also complain to Malaysia's Personal Data Protection Commissioner.

6. How we use your personal data

• To provide and maintain our Service, including monitoring usage patterns and system health.
• To manage your account: registering you as a user and granting access to Service functionality.
• To contact you: by email, telephone, SMS or push notification about updates, security alerts and other important communications.
• To manage your requests: handling and responding to enquiries and support tickets.
• For other purposes: data analysis, identifying usage trends, evaluating promotional campaigns, and improving the Service.

7. AI moderation and third-party processing

• To provide AI moderation, submitted content is processed by third-party AI providers including OpenAI and DeepInfra (which hosts Meta Llama 4 Scout).
• Content is transmitted to these providers solely for moderation screening and is not retained by them on our behalf beyond the processing window.
• Mapbox processes location coordinates for the map, search and directions features described in section 4.
• Google Firebase Cloud Messaging processes a device token in order to deliver push notifications.
• VibeFlow does not sell submission content or personal data to any third party.

8. Security of your personal data

The security of your personal data is important to us. However, no method of internet transmission or electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your personal data, we cannot guarantee absolute security.

9. Links to other websites

Our Service may contain links to third-party websites that we do not operate. If you click a third-party link you will be directed to that site. We strongly advise you to review the privacy policy of every site you visit, as we have no control over and assume no responsibility for their content or practices.

10. Deleting your account and data

1. Log in to your account using your credentials.
2. Go to sxagg.com/login and find the account deletion button in the navigation bar.
3. Select the option to delete your account or request data deletion.
4. Follow the prompts to confirm your deletion request.

You may also email support@sxagg.com from your registered address to request deletion of your account or of a specific category of data, including location data.

11. Children and young people

• A submission form does not ask for the sender's age, and we do not verify the age of the people who use one.
• The Service is intended for a general audience. It is not directed at children under 13, and we do not knowingly collect personal data from them.
• Some community pages that use VibeFlow serve school communities. What such a page publishes is decided by its own admins.
• If you are a parent or guardian and believe a child has sent personal data through a submission form, or has created an account, email support@sxagg.com and we will remove it.

12. Contact us

Questions about this Policy can be sent to support@sxagg.com, or through the Contact Us page. See also our Terms & Conditions.