Keys, privacy and storage

Your key

• Your API key is saved in this browser's local storage, one per provider. To keep it for this tab only, turn off Remember on this device in the key dialog: it's forgotten when you close the tab.
• The key dialog works with password managers, such as your browser's, 1Password or Bitwarden. Save the key there once, and it fills in the next time you need it.
• Requests go straight from your browser to the provider you chose. Vibr has no server in between and no account.
• Generated drafts run in a sandboxed frame that can't read your key or the rest of the page.
• If a provider echoes a key back in an error message, Vibr hides it before showing the message.

To remove one provider's key, pick that provider, open the key dialog and select Remove this key. Your other providers' keys stay saved. To remove every key at once, select Forget all keys.

What's sent where

• To your AI provider: your requests, the conversation so far, the current draft's code, and descriptions of any assets you mention (names, sizes, alt text and colors). Library images and videos themselves aren't sent. Reference images you attach to a request are, scaled down and without their metadata. Documents you attach are sent as their text and a few of their pictures.
• To Unsplash: photo searches, through this site, which holds the Unsplash key. When you use a photo, Unsplash is told, as its guidelines require.
• To Pixabay: video searches, through this site, which holds the Pixabay key.
• To CDNs: the design system packages a draft imports are loaded from public CDNs.
• To this site: anonymous usage counts (a draft finishing or failing, the first draft in this browser, a key being added and for which provider, opening the samples, which canvas tools you try (like Play, Compare or a preview language) and whether on a sample, saves, exports, imports, assets added, and the model and design system used) and error reports (which feature failed, an error code, the error's type, and a short error message with quoted text, code, links and key-like strings taken out). They never include your requests, your drafts' code, the names you give things, your files or your key. Visits are counted with Vercel Web Analytics, which doesn't use cookies.

Vibr won't build sexual content involving minors, pornography, or content made to show graphic violence. It answers those requests with "Nope." before anything is sent, so no model sees them and no key is spent. Library files that contain such requests aren't imported. Images and videos that read as explicit are turned away when you add them; that check runs on your device, and nothing is sent anywhere.

Where your work lives

Everything you make stays in this browser:

• Prototypes and settings are in local storage: your library, your provider and model choice, your interface and preview languages, and a few view preferences.
• Images, videos, fonts, type ramps, icon sets and themes are in the browser's IndexedDB storage.

Nothing syncs between browsers or devices. To move your work, export it and import it in the other browser. Clearing this site's data in your browser deletes your library, so export anything you want to keep first.