Privacy Policy

Last updated: 10/16/2026

This Privacy Policy explains what information Vidbyte Inc., a company registered in New Jersey, United States ("Vidbyte," "we," "us," or "our"), collects when you use the Vidbyte website at vidbyte.pro, the Vidbyte API, the vidbyte-cli command-line tool, and the Vidbyte agent skills and plugins that install and run it (together, the "Service"). It also explains how we use that information, who we share it with, how long we keep it, and how to contact us about it.

1. Information We Collect

  • Account information. You sign in with Google, which is the only sign-in method. Google shares your email address, first and last name, and profile picture with us. We store these, create a username from the part of your email address before the "@", and create a personal workspace for your account.
  • Content you submit. This includes the prompts, topics, learning goals, and preferences you enter; the roadmaps, quick hits, quizzes, exams, projects, and questionnaires you create, with your answers, scores, and the feedback we generate; your Socratic and tutor conversations, including notes the tutor writes about your progress (such as topics you have mastered or misconceptions it noticed); your research questions, research settings, and the research results we produce for you; and the learning profile and personalization preferences you choose in your settings. When you attach a document, your browser reads it and sends us only the extracted text. The exception is Chat, where an attached image or PDF is sent to us in full.
  • Voice tutor. The voice tutor is currently available only to a limited set of accounts. If you use it, your microphone audio is streamed to our voice providers to turn speech into text, and the conversation transcript is saved to your account. We do not record or store the audio itself.
  • Agent requests from vidbyte-cli, the API, and agent skills. When you run the Suggestion Agent (for example with vidbyte-cli agents suggest run, or through an agent skill that runs it for you), the CLI sends us your goal, the context you provide, the contents of files you pass with --files, the files and images you attach, and, if you use a project, the project's title, description, and the feedback you saved on earlier suggestions. When you start a research run from the CLI or the API, we receive your research question and settings. When you use the planning tool in the CLI's MCP mode, we receive your request text.
  • API keys and CLI sign-in. When you create an API key, we show the full key to you once. We store only a keyed hash of it, the first 2 and last 3 characters so you can recognize it, its name, and when it was last used. When vidbyte-cli checks your key (for example during vidbyte-cli login), our server records a sign-in session with your username, email address, and plan.
  • Payments and usage. Payments are processed by Stripe on Stripe's own checkout page, so we never receive your full card number. We send Stripe your email address and account ID, along with any referral or promo code you enter. We store your Stripe customer ID, invoice and payment IDs, amounts, purchase and subscription history, and your account balance. For each API or agent request that uses your balance, we record which API key and route were used, the model and provider, the number of tokens, and the cost.
  • Messages and affiliate applications. If you use the contact form (available when you are signed in), we receive your name, email address, optional phone number and company, and your message. We store it and email it to our team's inbox. If you apply to the affiliate program, we receive your email address, affiliate code, social media handles, main platform, and audience description, which are emailed to our team. We store your affiliate code and status, your referral and commission records, and the payout details you give us.
  • Technical and security information. Our website's security service checks each request, including your IP address and request headers, to block attacks and automated traffic. We keep short-lived request counters, tied to your account or to a hashed form of your IP address, to enforce rate limits. When a request uses an invalid API key, we record the IP address and user agent that sent it, for security review. Our hosting providers keep standard server logs, which include IP addresses. On the chat page, we record how long you spend on the page.
  • Error reports. When something breaks in your browser or on our servers, our error-monitoring provider receives a report with technical details, such as the page or API route, your browser type, and where the error happened, and it samples about 10% of requests to measure performance. We configure it not to send default personal information such as cookies or IP addresses, and to remove our own secret keys and any AI provider key you supply. A report about a server error can include up to about 10 KB of the request that failed, which can contain content you submitted. We also keep a record of failed website actions, which can include what you submitted at the time.
  • Analytics. We use Vercel Web Analytics, which counts page views without using cookies. Our pages also load fonts from Google Fonts, so your browser sends your IP address and browser information to Google when a page loads.

2. Cookies and Browser Storage

  • Sign-in cookie: keeps you signed in for up to 7 days. Short-lived cookies are also set while you sign in with Google.
  • Security cookie: a csrf-token cookie that protects form submissions and lasts 100 minutes.
  • Browser storage: the site saves a few items in your browser's local or session storage, such as dismissed pop-ups, display preferences, an unsent research prompt, and audio you have already played. These stay in your browser.
  • We do not use advertising cookies or third-party tracking cookies.

3. How We Use Information

  • To provide the Service, including creating your account and generating the results you ask for.
  • To process payments, keep your balance, and bill API and agent usage.
  • To protect the Service, prevent abuse and fraud, and enforce rate limits.
  • To answer your messages and run the affiliate program.
  • To find and fix errors, and to understand in aggregate how the Service is used so we can improve it.
  • To comply with legal obligations.

4. AI Model Providers

Vidbyte uses AI models from other companies to generate results. To do that, we send them the content needed for your request. Each provider processes it under its own terms and privacy policy.

  • xAI (Grok): roadmaps, quick hits, Sandbox quizzes, exams, projects, and questionnaires, answer grading, Socratic conversations, the tutor, and research runs send your prompt and the content the task needs (such as your answers, attached text, or research context) to xAI.
  • OpenAI: Suggestion Agent requests are relayed through our servers to OpenAI under Vidbyte's account, with OpenAI's response-storage option turned off.
  • Our model API: if you, or software you run such as the Vidbyte SDK, call our model API, we forward your request to the provider you choose: OpenAI, Anthropic, Google (Gemini), xAI, DeepSeek, or Moonshot AI (Kimi). If you supply your own provider key, it passes through our server for that request only and is not stored.
  • TypeSafe: the planning tool in the CLI's MCP mode and managed Jev agents send your request to TypeSafe through our API.
  • Search and web tools: research runs send search queries written from your question to Exa and ask Firecrawl to fetch web pages. Roadmap creation sends search queries written from your learning goal to Parallel.
  • Speech: if you play audio for a roadmap module, the module text is sent to Speechify to create the audio. The voice tutor streams audio through LiveKit, which uses AssemblyAI for speech recognition and Inworld for the tutor's voice; the tutor's replies themselves come from xAI.

5. vidbyte-cli and Vidbyte Plugins

  • Installing vidbyte-cli downloads it from PyPI, which is run by the Python Software Foundation under its own privacy policy.
  • vidbyte-cli talks to our API at vidbyte-backend.onrender.com. It has no telemetry, usage analytics, crash reporting, or automatic update checks. It contacts a server only when you run a command that needs one.
  • Your Vidbyte API key is stored in your operating system's keyring (such as Windows Credential Manager or the macOS Keychain). If no keyring is available, the CLI saves it to a file that only your user account can read, and only after you agree. vidbyte-cli logout removes it.
  • The CLI sends only the files you name. It does not scan your repository. It saves a record of each agent run, including the options you gave and the output, in its data folder on your computer; these records are not sent to us.
  • Some commands use services you connect with your own credentials, such as OpenAI (including Codex, which runs on your computer and sends your task and the files it reads to OpenAI), GitHub, Linear, Slack, Browserbase, and other AI or email providers you log in to. That data goes directly from your computer to the service you chose; Vidbyte does not receive it. These credentials are stored in your operating system's keyring.
  • Some Vidbyte agent skills read local files, such as the session history of coding agents on your computer, remove secrets, email addresses, and home folder paths they detect, and send a summary through the Suggestion Agent. That summary is handled as described for the Suggestion Agent above.

6. Service Providers We Share Information With

Besides the AI providers in section 4, these companies process information for us to run the Service:

  • Vercel: hosts the website and provides Web Analytics.
  • Render: hosts our API servers.
  • MongoDB Atlas: hosts our database.
  • Inngest: runs research jobs in the background and holds their intermediate steps.
  • Upstash: stores short-lived rate-limit counters.
  • Arcjet: checks website requests for attacks and automated traffic.
  • Sentry: receives error reports and performance samples.
  • Stripe: processes payments.
  • Google: provides sign-in, serves our web fonts, and hosts our team's email inbox, which receives contact form and affiliate messages.
  • Resend: delivers contact form and affiliate messages to our team, and internal security alerts that can include an account ID and IP address.
  • Supabase: stores public statistics about social media creators that our team uses for partnerships. It does not receive information about Vidbyte users.

We may also disclose information if the law requires it, to protect the rights and safety of our users or of Vidbyte, or as part of a merger, acquisition, or sale of our business.

7. What We Do Not Do

  • We do not sell your personal information.
  • We do not share your personal information for advertising, and we do not run advertising trackers.
  • We do not use your content to train AI models.

8. How Long We Keep Information

  • We keep your account information and content for as long as your account exists, unless you ask us to delete it (section 9). The Service does not yet have a self-service way to delete your account.
  • When you delete a research thread, research result, roadmap, quick hit, or Socratic conversation in the app, it is removed from your account view but stays in our database until your data is deleted at your request. When you revoke an API key, we keep the disabled key's record (its hash, not the key).
  • We keep billing, payment, and usage records as permanent financial and audit records.
  • We keep security records, such as records of requests that used an invalid API key, for as long as we need them for security review.
  • Some information is deleted automatically: the sign-in cookie after 7 days; CLI and agent-skill sign-in sessions after 30 days; learning modules created by a Vidbyte agent skill without an account after 7 days; model answers we keep so a retried request is not charged twice, after about 15 minutes; and rate-limit counters within a few hours.

9. Your Choices and Rights

  • You can ask us to access, correct, or delete your personal information by emailing contact@vidbyte.pro from the email address on your account. Depending on where you live, you may have additional rights under local law, and we will honor them.
  • You can revoke API keys at any time in your API key settings.
  • You can remove your stored Vidbyte key from your computer with vidbyte-cli logout.
  • You can block or delete cookies in your browser, but you will not be able to stay signed in without the sign-in cookie.

10. Security

We use HTTPS, store API keys only as keyed hashes, and keep secret keys out of error reports. vidbyte-cli keeps your keys in your operating system's keyring. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

11. Children

The Service is not directed to children under 13, and our Terms of Service do not allow children under 13 to use it. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has given us personal information, contact us at contact@vidbyte.pro and we will delete it.

12. Where Information Is Processed

Vidbyte is based in the United States, and we process information in the United States. Our service providers may process it in other countries where they operate.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will change the "Last updated" date above, and we will notify you of significant changes by email or within the Service.

14. Contact Us

For questions or requests about this Privacy Policy or your information, contact Vidbyte Inc. at contact@vidbyte.pro.