Privacy Policy

This Policy is a legally binding disclosure made by KiteHouse Labs, LLC to users of the Service ("you" or "your"). By accessing or using the Service, you acknowledge that you have read, understood, and agree to be bound by this Policy. If you do not agree, you must not use the Service. This Policy applies to all users across all domains we operate and describes our practices regarding the collection, use, disclosure, and retention of information, including personal information as defined herein.

For purposes of this Policy: "Personal Information" means information that identifies, relates to, describes, or is capable of being associated with an identified or identifiable individual. "Service" means the websites, applications, and related services operated by the Company. "Processing" means any operation performed on Personal Information, including collection, storage, use, disclosure, or deletion. Other capitalized terms used herein have the meanings given in this Policy or in our Terms of Service.

We operate a single, unified account system across all domains we own or operate. There is no option for separate accounts per domain. By creating an account on any domain, you consent to account and data synchronization across all of our domains. Domains covered. This Policy applies to all domains and services operated by the Company, including Vibez.lol, Perhaps.gay, and any other domains we own, operate, or acquire (including subdomains). Synchronization. One account is used across all domains; credentials and profile data are synchronized automatically; account deletion affects all domains. We do not maintain separate databases or user segments per domain. Data is stored in unified infrastructure serving all domains.

We collect information that you provide directly, information collected automatically through the Service, and information obtained from third parties. Information you provide: Account and registration information (e.g., name, email address, username, password, profile details), profile content (e.g., biography, profile picture, social links), content you create or upload, payment-related information (processed by third-party payment processors), communications you send to us, and survey or feedback responses. Information collected automatically: Device and technical information (e.g., IP address, browser type, operating system, device identifiers), usage data (e.g., pages viewed, features used, session duration), approximate location (e.g., derived from IP address), cookies and similar technologies, server and access logs, and analytics data. Information from third parties: We may receive information from OAuth and sign-in providers (e.g., Google, GitHub, Discord), analytics and infrastructure providers, payment processors, and publicly available sources, in each case as permitted by applicable law and the policies of such third parties.

We Process collected information to: (a) provide, maintain, secure, and improve the Service; (b) create and manage your account and authenticate you; (c) send service-related communications, transactional messages, and (where you have consented) marketing communications; (d) analyze usage, conduct product analytics, and personalize your experience; (e) detect, prevent, and address fraud, abuse, and security incidents; (f) comply with applicable laws, regulations, and legal process; (g) enforce our Terms of Service and other policies; and (h) conduct internal business operations, audits, and planning. Processing is based on consent, contract performance, legitimate interests, or legal obligation as applicable.

We may share information with: (a) Service providers and subprocessors who perform services on our behalf (e.g., hosting, database, email, payment processing, analytics, support, security)—such parties are contractually or legally required to protect information and use it only for the purposes we specify; (b) Law enforcement, government authorities, and legal process—we will disclose Personal Information and other data to police, law enforcement agencies, and other government or regulatory bodies when we receive a valid legal request (e.g., subpoena, court order, search warrant, formal request in connection with an investigation) or when we believe disclosure is required or permitted by law to protect rights, safety, or property or to comply with legal obligations; we do not require advance notice to you before making such disclosures; (c) Successors in connection with a merger, acquisition, bankruptcy, or other transfer of assets; and (d) Other parties with your consent or at your direction. We may share aggregated or de-identified information without restriction. Information you make publicly available on the Service may be viewed, copied, or shared by third parties; we are not responsible for such third-party use. We do not sell your Personal Information as stated in Section 3.

We and our service providers use cookies, web beacons, local storage, and similar technologies ("Tracking Technologies") for essential operations (e.g., authentication, security, load balancing), performance and analytics (e.g., understanding how the Service is used), functionality (e.g., preferences and settings), and, where applicable, advertising and measurement. You may control certain Tracking Technologies through your browser settings; disabling some may limit functionality. By continuing to use the Service, you consent to our use of Tracking Technologies as described in this Policy and in our cookie disclosures.

We use third-party analytics tools that may record how you interact with the Service, including session replay and related behavioral analytics. Specifically, we use PostHog (and potentially other providers) to capture session replays—recordings of user sessions that show how users navigate and interact with our pages—along with event data, feature-flag usage, and product analytics. This helps us improve the Service, debug issues, and understand user experience. Session replays may capture information displayed on your screen during your session (e.g., UI elements, clicks, scrolls); we configure our providers to avoid or mask sensitive input fields where feasible. Data collected for session replay and analytics is processed in accordance with this Policy and the privacy policies of our analytics providers. For more information, see PostHog's privacy policy linked in Section 16 (Third-Party Services and Subprocessors).

We retain Personal Information for as long as your account is active and as necessary to provide the Service, comply with legal obligations, resolve disputes, enforce our agreements, and for legitimate business purposes (e.g., backups, analytics on de-identified data). We may retain information after account closure or deletion to the extent required by law, for legitimate business purposes, or in backup or de-identified form. We are not obligated to delete all information upon account deletion. Retention periods may vary and may be updated at our discretion. Nothing in this section limits our ability to retain information as required or permitted by law.

We implement reasonable technical, administrative, and physical measures designed to protect Personal Information, which may include encryption in transit and at rest, access controls, and security assessments. No method of transmission or storage is completely secure; we cannot guarantee absolute security. You use the Service at your own risk. We are not liable for unauthorized access, loss, or disclosure of your information except to the extent required by applicable law. We may or may not provide notice of a security incident as permitted by law and our business judgment.

Depending on your jurisdiction, you may have rights to access, correct, delete, port, object to, or restrict Processing of your Personal Information, or to withdraw consent. To exercise such rights, contact us at privacy@kitehouse.us. We may verify your identity and may deny or limit requests where permitted by law (e.g., for legal compliance, legal defense, or when requests are excessive or unfounded). Response times and any fees for manifestly unfounded or excessive requests will be as permitted by applicable law. Certain information (e.g., already disclosed to third parties, aggregated or de-identified data, or data retained for legal or business purposes) may not be subject to these rights.

If you are a California resident, the California Consumer Privacy Act (as amended by the CPRA) may afford you additional rights, including the right to know, delete, correct, and port Personal Information, and the right to opt out of the "sale" or "sharing" of Personal Information. We do not sell Personal Information as defined under the CCPA (see Section 3). We may share information with service providers for business purposes as described in this Policy; such sharing is not a sale. You may submit requests to know, delete, or correct your information, or to limit use of sensitive personal information, by contacting privacy@kitehouse.us. We will not discriminate against you for exercising your privacy rights. CCPA rights are subject to applicable limitations and exceptions.

The Service is operated from the United States. If you are located outside the United States, your information may be transferred to, stored in, and Processed in the United States and other countries where we or our service providers operate. By using the Service, you consent to such transfer. We take steps intended to ensure an adequate level of protection for Personal Information transferred internationally, in accordance with applicable law.

The Service is not directed to individuals under the age of 13 (or the applicable minimum age in your jurisdiction). We do not knowingly collect Personal Information from children under 13. If you believe we have collected Personal Information from a child under 13, please contact us at privacy@kitehouse.us; we will take steps to delete such information in accordance with applicable law.

We engage the following categories of third-party services and subprocessors to operate the Service. Each may collect or Process Personal Information as described in their respective privacy policies. We are not responsible for their practices; we encourage you to review their policies.

• Vercel — Hosting, serverless functions, and optional web analytics. Privacy
• DigitalOcean — Database hosting (Managed PostgreSQL) for account and application data. Privacy
• Google — Sign-in (OAuth). We do not control data Google collects. Privacy
• GitHub — Sign-in (OAuth). We do not control data GitHub collects. Privacy
• Discord — Optional sign-in and profile/presence features. We do not control data Discord collects. Privacy
• Unosend — Transactional email (e.g., magic links, notifications). Privacy
• Stripe — Payment processing for Pro purchases. Privacy
• Cloudflare R2 — Object storage for user uploads (e.g., profile images). Privacy
• PostHog — Product analytics, feature flags, and session replay (see Section 9). Privacy
• Mapbox — Map imagery in login notification emails. Privacy
• Formspree — Support/contact form delivery. Privacy

We may use additional or alternate subprocessors (e.g., AWS S3 for storage, or other email or analytics providers) in some deployments; equivalent disclosures and obligations apply. The Service may contain links to third-party websites or services; this Policy does not apply to them, and we are not responsible for their privacy practices.

We may modify this Policy at any time at our sole discretion. Modifications are effective upon posting to the Service unless otherwise stated. We are not obligated to provide individual notice of changes. Your continued use of the Service after the effective date of any change constitutes your acceptance of the revised Policy. The current version will be available at this URL. Archived prior versions are provided for reference only and do not govern our relationship unless otherwise agreed in writing.