Privacy Policy

The data controller is VibeDojo — operated with Cardinal (“we”, “us”), Italy. For any privacy question or request, contact us at hello@kryptonite.gg. We have not appointed a Data Protection Officer because we are not required to; the contact above handles all data-protection matters.

We do not intentionally collect special categories of data. Please don't include them in uploads, reports or Studio prompts.

Where we rely on legitimate interests, we have balanced them against your rights; you can object at any time (see section 10). We do not carry out automated decision-making that produces legal or similarly significant effects on you. Automatic moderation (for example hiding a sound after several malware reports) is always subject to human review on request.

When an AI agent uses the MCP server or the REST API, we receive only the request it sends: the tool or endpoint called and its parameters (for example a search query or a sound ID), plus your API key or the agent's network address. We never receive the rest of your conversation with the agent. Avoid putting personal data in search queries.

A local MCP server you run on your own machine does not send us anything except the catalog requests it makes on your behalf.

• Account data: as long as your account exists; deleted within 30 days of account deletion (backups roll over within a further 30 days).
• Sessions: until they expire or you sign out (sessions last up to 7 days and are refreshed while you use the site).
• Quota counters and sign-in rate-limit entries: kept per day and deleted after at most 90 days.
• Uploads: until you or we remove them. Upload consent records are kept for as long as the sound is online and for up to 10 years after removal, the Italian limitation period for contractual claims, to prove what was accepted.
• Reports, copyright notices and counter-notices: up to 3 years after the case is closed.
• Studio conversations: not stored by us beyond the session; model providers may retain them for a short period (typically up to 30 days) for abuse monitoring under their own terms.
• Technical logs: short-term, normally no more than 30 days.

We don't sell or rent personal data and we don't share it for advertising. We use the following service providers, who act as our processors under data-processing agreements:

We may also disclose data where required by law or by a competent authority, to enforce our Terms, or to protect the rights, property or safety of users, rights holders or the public. In a copyright dispute, a counter-notice — including the contact details it contains — may be forwarded to the person who filed the original notice, as described in our DMCA Policy.

Some providers are located in, or access data from, the United States. Transfers rely on the EU–US Data Privacy Framework where the provider is certified, and otherwise on the European Commission's Standard Contractual Clauses with supplementary measures. You can request a copy of the relevant safeguards by writing to hello@kryptonite.gg.

We only use strictly necessary cookies (for sign-in and security) and a local-storage entry that remembers your cookie choice. Optional analytics run only with your consent. Details are in the Cookie Policy.

We use encryption in transit (HTTPS), hashed passwords and API keys, salted hashing of IP addresses for quotas, access controls on our systems, and a sanitising re-encode of every uploaded file. No system is perfectly secure; if a personal-data breach is likely to put you at risk, we will notify you and the supervisory authority as required by law.

Under articles 15–22 GDPR you have the right to:

• access your personal data and get a copy of it;
• have inaccurate data corrected;
• have your data erased (“right to be forgotten”), including by deleting your account;
• restrict processing in certain cases;
• receive your data in a portable, machine-readable format;
• object to processing based on legitimate interests;
• withdraw consent at any time (for analytics, via the “Cookie settings” link in the footer), without affecting prior processing.

Send requests to hello@kryptonite.gg. We reply within one month (extendable by two months for complex requests) and may ask you to verify your identity. You also have the right to lodge a complaint with a supervisory authority — in Italy the Garante per la protezione dei dati personali — or with the authority of your country of residence or work.

The Service is not directed at children under 14. If you are below the age of digital consent in your country, you may create an account only with your parent's or guardian's consent. If you believe a child has given us personal data without such consent, contact us and we will delete it.

We will post any changes here and update the “Last updated” date. If changes are significant — for example a new purpose or a new category of processor — we will tell you in advance on the site or by email.