LEGAL
Privacy Policy
EFFECTIVE AND LAST UPDATED: JULY 16, 2026
Short version. ColorfulVibe is local-first.
- Terminal sessions, project files, prompts, agent output, and vault values are not uploaded to ColorfulVibe.
- The license service receives only the information needed to issue licenses, activate devices, prevent abuse, and deliver private installers.
- We do not sell personal information, use behavioral advertising, or place analytics cookies.
1. Scope and controller
This Policy applies to the ColorfulVibe Windows application, the website at colorfulvibe.com, the license service, protected installer downloads, and support interactions (together, the “Services”). Cumulonimbus LLC, a California limited liability company, owns and operates ColorfulVibe and is the controller or business responsible for the personal information described here. Services you separately choose to run through ColorfulVibe, such as an AI provider or source-code host, operate under their own privacy terms.
2. Information that remains local
The desktop application runs terminal sessions through pseudo-terminals on your computer. ColorfulVibe does not operate a cloud service that receives your terminal content, project files, repositories, working directories, prompts, agent responses, snippets, recipes, local preferences, dictation audio, or locally generated Whisper transcripts.
Vault values are stored through the operating-system keyring. They may be used locally for an action you initiate, such as a Secured Run, but they are not sent to the ColorfulVibe license service. Phone Remote traffic is served by your computer over the network path you choose; ColorfulVibe does not relay that terminal traffic through its cloud service.
When an AI agent you run makes an API call to its provider, that request goes directly from your computer to that provider under your own account and keys. ColorfulVibe is a conduit and does not proxy, intercept, receive, or log that agent traffic or the provider’s responses.
3. Device capabilities you can turn on
Two optional features change what the application does on your computer. Both are off until you enable them, and both are described here in full because they are the kind of capability you should not discover by accident.
Dictation hotkey. Enabling dictation installs a system-wide low-level keyboard hook on Windows. The hook exists so your chosen shortcut works when the ColorfulVibe window is not focused. It compares each key against the shortcut you configured and does not record, store, or transmit your keystrokes. Turning dictation off removes the hook immediately; closing the application removes it as well. Speech is transcribed by a Whisper server running on your own computer, so dictation audio and the resulting transcripts stay on your machine.
Phone Remote. Pairing a device starts a local HTTPS server on your computer, listening on port 7799 across your network interfaces so a paired device can reach it over your LAN or your own private network. It is not running until you pair a device, each paired device holds its own access token that you can revoke individually, and the traffic goes from your device to your computer without passing through the ColorfulVibe service.
4. Information we process
| Category | Examples | Purpose |
|---|---|---|
| Customer and transaction | Email address, order reference or internal label, license status, device allowance, expiration, and support communications. | Issue and administer a license, provide support, prevent fraud, and maintain required business records. |
| License and device | Peppered license-key digest, pseudonymous device digest, activation identifier, signed-certificate metadata, app version, and activation timestamps. | Authenticate the license, enforce device limits, enable offline use for the certificate period, and investigate abuse. |
| Download and service activity | Authorization event, request identifier, requested release, request time, IP address or a keyed network digest used for rate limiting, user agent, and security signals. | Deliver private installers, operate and secure the Services, diagnose failures, and protect customers. |
| Support and privacy requests | Your contact details, message, troubleshooting information you choose to provide, and records needed to verify and resolve a request. | Respond to you, verify request authority, resolve issues, and document compliance. |
The raw license key is used in transit to authenticate an activation or download but is not stored in the license database. The raw Windows machine fingerprint is transformed on the device and the resulting identifier is further keyed before database storage.
5. Sources
We obtain information directly from you, from the application when you activate or manage a license, from the download page, from a person or organization that purchases a license for you, from a payment or sales provider used for an order, and automatically from Cloudflare when it delivers or protects a request. We do not purchase personal-data lists.
6. Purposes and legal bases
Where a legal basis is required, we process information:
- to perform a contract, including issuing, activating, supporting, and delivering a purchased license;
- for legitimate interests in securing the Services, enforcing license limits, preventing fraud, maintaining reliability, and improving support, balanced against your rights;
- to comply with law, including accounting, tax, sanctions, dispute, and valid legal-process obligations; and
- with consent when we expressly ask for it for an optional purpose. You may withdraw consent prospectively at any time.
7. Cookies and similar technology
We use one strictly necessary, encrypted-signature download authorization cookie after a valid license is submitted. It is marked Secure and HTTP-only, is limited to installer-download paths, and expires after about five minutes. The website does not store license keys in browser storage and does not currently use advertising, analytics, or cross-site tracking cookies. Because we do not sell or share personal information for cross-context behavioral advertising, there is no sale or targeted-ad profiling for a Global Privacy Control signal to opt out of.
8. Disclosures and processors
We disclose information only as reasonably necessary to:
- Cloudflare, which provides DNS, website and Worker delivery, D1 database, R2 object storage, request security, rate limiting, and operational logging;
- payment and commerce providers selected for an order, which process payment and transaction information under their own policies;
- professional advisers and authorities when necessary for legal, security, tax, audit, insurance, or dispute purposes; and
- a successor in a merger, financing, acquisition, reorganization, or sale, subject to appropriate confidentiality and notice requirements.
We do not sell personal information, share it for cross-context behavioral advertising, or disclose it for third parties’ independent direct marketing. Claude Code, Codex, custom agents, Git providers, Tailscale, and other tools you independently configure are not our processors for the licensing service; your relationship with them is separate.
9. Retention
We retain customer, license, activation, and lifecycle records while a license is active and afterward only for as long as reasonably necessary for support, security, fraud prevention, accounting, dispute resolution, and legal obligations. Retention depends on license status, last activity, transaction requirements, and whether a dispute or legal hold exists. Support and privacy-request records are retained long enough to resolve and document the request. We delete or anonymize information when the applicable purpose ends and no overriding obligation requires retention.
10. Security
Safeguards include TLS, private installer storage, one-way keyed digests, Ed25519-signed device certificates, short-lived scoped download authorization, strict input validation, rate limits, access controls, and administrative secrets that are rotated for sensitive operations. No system is perfectly secure. Please report a suspected vulnerability or unauthorized license use to security@colorfulvibe.com.
11. Your privacy rights
Depending on where you live, you may request access, a portable copy, correction, deletion, restriction, or an explanation of personal information we process. You may object to certain processing, withdraw consent where consent is the basis, and appeal a denied request. We will not discriminate against you for exercising a privacy right.
California residents may also request the categories and specific pieces of personal information collected, sources, purposes, and recipients. We have not sold or shared personal information for cross-context behavioral advertising and have not used or disclosed sensitive personal information for purposes requiring a right to limit during the preceding 12 months. We voluntarily accept the core requests above even when a particular state-law threshold does not apply to ColorfulVibe.
EEA, UK, and Swiss residents may also complain to their local data protection authority. License validation is automated, but it is not intended to make a decision producing legal or similarly significant effects; contact support for human review of an activation denial.
Submit a request to privacy@colorfulvibe.com. State the right you want to exercise and the email associated with the purchase. Do not send a full license key, vault secret, government ID, or project files. We may ask for proportionate information to verify your authority and protect the license holder. An authorized agent may submit a request where law permits, subject to proof of authority.
12. International processing
Cumulonimbus LLC and its providers may process information in the United States and other countries where they operate. Those countries may have different privacy laws. Where required, we rely on recognized contractual or other lawful transfer safeguards and provide the mandatory protections applicable in your home jurisdiction.
13. Children
The Services are professional developer tools and are not directed to children under 13. We do not knowingly collect personal information from a child under 13. Purchasers and license holders must be at least 18 or the age of legal majority where they live. If you believe a child supplied information, contact us so we can investigate and delete it as required.
14. Changes and contact
We may update this Policy when practices or laws change. We will post the revised version and date here and provide additional notice when legally required. Privacy questions and complaints may be sent to privacy@colorfulvibe.com; other support requests may be sent to support@colorfulvibe.com. Our mailing address is Cumulonimbus LLC, 1968 S. Coast Hwy #5331, Laguna Beach, CA 92651, United States.