Your music.
Your data.

Web beta · updated October 31, 2026

What stays on your device

Saved songs, collections, queue and settings are stored in your browser. There is no Vibefy web account or analytics. Clearing browser data removes this library. Export a backup in Settings first. The web player does not read your native Vibefy profile or Spotify credentials.

What goes to the server

Search queries, public playlist IDs and the recording you request are sent to our Vercel-hosted API. It requests public metadata from YouTube / YouTube Music and lyrics from LRCLIB. Public playback uses the official YouTube embedded player, loaded directly in your browser. YouTube receives information needed to serve playback and may apply its own cookies, ads and privacy settings. Your IP address and request details may appear in the hosting provider's operational logs. Direct audio proxying is disabled by default on Vercel because YouTube refused server extraction. Local development supports bounded audio ranges. No permanent server-side audio library is stored.

External services

Cover art is loaded from Google's image servers; fonts from Google Fonts. Downloads and source code are hosted by GitHub. These providers receive the network information needed to serve those resources and apply their own policies. We do not receive your passwords.

Desktop updates

Checks use GitHub HTTPS. Downloads must match the release asset's size and SHA-256 digest and the checksum manifest. Installing saves your layout, closes the app, and launches Setup in the current installation folder. Installers are not code-signed. Hash verification does not protect against compromise of the publisher's GitHub account.

Listen Together

Starting or joining a web Jam connects to PeerJS Cloud for signalling and Google STUN for connection setup. These services receive network information and session identifiers. Recording metadata, timing and play/pause state are exchanged over a direct encrypted WebRTC data channel. Audio and Spotify credentials are not sent between participants. Invite links grant access to the session; share them privately. Sessions have no permanent server-side history.

Controls

Settings in the web player let you export or clear your saved library and clear the app shell cache. No offline audio download is promised. Use the GitHub issue tracker to report a problem without posting tokens, private logs or passwords. Security reporting instructions are in the repository's SECURITY.md.