Privacy policy

Last updated 8 September 2026.

DomainRiff.app is operated by an individual site owner in the United Kingdom. For any privacy question, contact the owner on X (@vibedcoder). We aim to reply within a few days.

What we collect

• Account data. When you sign in with GitHub or Google, we store the email address, display name and avatar your provider returns, plus the provider name and identifier. We never see or store your provider password.
• Riff data. The domain you riff, the AI-written ideas for it, which idea you chose, and the ownership proof token we give you. The domain name and your ideas stay private until you prove you own the domain, at which point the riff page becomes public. You can make a riff private again from its page at any time, and then only you can read it.
• Session cookie. One cookie keeps you signed in. It is strictly necessary and carries no tracking.
• Technical data. Standard web server logs (IP address, user agent, requested page) kept briefly for security and abuse prevention. We do not run analytics or advertising trackers.

How we use it

• To run your account and keep your riffs tied to you.
• To send a domain to DeepSeek for AI idea generation. We send only the domain name, never your email or other account details.
• To show the riff page publicly after you verify ownership, which is the point of the product. If you make a riff private instead, we stop serving it to anyone but you: it leaves the sitemap and the showcase, and other visitors only see a note that it is private.

What we share

• DeepSeek receives the domain name to generate ideas.
• GitHub or Google receive your credentials during sign-in; we never store them.
• Public riff pages are visible to anyone and can be shared by you on social platforms, which will receive whatever you choose to post there.
• We do not sell personal data.

Retention and deletion

Riff pages that are not verified are deleted 72 hours after the ideas are ready, or 14 days after the whole riff has been written for you if you picked an idea, and the domain cannot be riffed again for 7 days. Riffs you delete are removed at once (and the domain is locked from re-riffing for 30 days). Verified riff pages stay live until you ask us to remove them. Under UK data protection law you can ask us to access, correct, export or delete your personal data. Contact the owner on X (@vibedcoder). We will act within 30 days. You can also complain to the UK Information Commissioner's Office if you are unhappy with how we handle your data.