Privacy and local data
Vibe Bar has no telemetry pipeline or hosted plaintext analytics backend. Local-provider and remote-Probe usage analysis happens on your active Core. The optional hosted account/control service manages workspace, device, enrollment, Relay-directory, and audit metadata; it cannot decrypt usage.
What it reads
Vibe Bar reads only the supported credential, quota, cookie, session, and local usage inputs needed by enabled provider integrations.
- CLI credential and session files are read-only inputs; Vibe Bar does not rewrite provider-owned auth or conversation files.
- Browser import reads supported browser cookie stores and reduces the result to the fields required for the chosen provider.
- The AntiGravity integration inspects the local process to discover its language-server connection.
- Raw secrets should never appear in logs or shared diagnostics.
- Provider status comes from the corresponding status service.
See Providers and data for the provider-level map.
What it stores
Derived application state stays under:
~/.vibebar/
├── settings.json
├── quotas/
├── cost_snapshots/
├── scan_cache/
├── service_status.json
├── cost_history.json
├── subscription_history.json
├── fill_timeline.json
├── forecast_timeline.json
├── remote_core.json
├── remote_usage.sqlite3
└── mini_window_geometry.jsonVibe Bar-owned cookies and provider secrets live inside one versioned Keychain Vault rather than one prompt-generating Keychain item per secret.
The local directory is created with owner-only directory permissions, and files written through the local store use owner read/write permissions. Legacy plaintext cookie files under ~/.vibebar/cookies/ are migration-only: current builds move usable values into Keychain and delete the old files.
What each file is for
| Path | Contains |
|---|---|
settings.json | Non-sensitive preferences, visibility, ordering, regions, and plan variants |
quotas/ | Last usable derived quota snapshots |
cost_snapshots/, cost_history.json | Derived local cost summaries and history |
scan_cache/ | Incremental metadata used to avoid rescanning unchanged local logs |
subscription_history.json | Completed quota-window history |
fill_timeline.json, forecast_timeline.json | Observations and the forecast shown at each observation |
service_status.json | Cached public provider status |
remote_core.json | Non-secret workspace, Relay, and registered-Probe metadata |
remote_usage.sqlite3 | Core-decrypted, source-aware remote fact ledger and consumer cursor |
mini_window_geometry.json | Floating-window position and display metadata |
Deleting ~/.vibebar/ resets non-Keychain local state to first-run behavior. It does not delete provider-owned CLI files or necessarily remove Vibe Bar-owned Keychain credentials. Prefer the in-app clear/delete actions when you want a targeted reset.
Privacy Mode
Privacy Mode clears derived cost data and keeps cost history off disk while it is enabled. Retention is configurable, and Settings → Cost Data also provides a manual clear action.
The retention selector offers Forever, 30 days, 90 days, 1 year, and 3 years. It applies to both cost history and subscription fill history. Clearing cost data removes derived cost history, snapshots, and scan cache, not the original CLI records.
Privacy Mode does not silently delete an enrolled workspace's remote fact ledger, and Disconnect removes the binding/credential but deliberately keeps already decrypted facts. A dedicated in-app remote-ledger purge is not yet available; quit Vibe Bar and remove ~/.vibebar/remote_usage.sqlite3 only when you explicitly intend to erase that local history.
Remote Probe encryption
Probe batches are encrypted to the workspace's active Core before leaving the observed machine. Relay stores ciphertext locally and the hosted control database stores metadata only. Machine selection and cost aggregation happen after decryption on the Core. See Remote Probes for the install, update, retention, and Web/iOS freshness model.
Why App Sandbox is disabled
Vibe Bar intentionally runs without the macOS App Sandbox. Browser-cookie import and the local AntiGravity language-server probe require capabilities the sandbox blocks.
This does not change the project's least-access rule: read only the provider inputs needed for an integration, write application state only under ~/.vibebar/ and the Vibe Bar Keychain Vault, and never log raw secrets.
The sandbox is disabled because browser-cookie import needs access to browser cookie databases and their Keychain-backed decryption material, while the AntiGravity probe needs local process inspection. Both workflows are blocked by the App Sandbox. The trade-off is wider technical filesystem access, which is why the open-source project enforces narrow read paths and a single application-owned persistence root.
Before sharing an issue
Share versions, timestamps, route-health states, sanitized errors, and whether an expected path exists. Replace usernames in paths with <you> and trim log snippets to the relevant sanitized lines.
Sharing diagnostics
Never paste API tokens, session cookies, JWTs, Keychain values, full auth files, browser cookie exports, personal email addresses, organization IDs, or complete unsanitized session logs into a public issue.
See Troubleshooting for a safe diagnostic checklist.