Privacy

Last updated: October 2026.

Vibistic TL;DR needs no account, and its own server stores nothing about what you read. It shows a visitor counter and uses Cloudflare Web Analytics (both described below), and remembers your light or dark choice, and the tickers you follow if you use the watchlist, in small cookies. Here is exactly what happens.

Your AI key

If you add an AI key, it stays only in this browser: for this tab, unless you tick Remember on this device, which keeps it in your browser's local storage. When you ask for a summary, your browser sends the document's text and your key directly to the AI provider you chose. That request never passes through Vibistic's servers, so we cannot see or store your key. You can check this yourself in your browser's Network tab. Your provider's own terms and privacy policy apply to what you send it.

What our server does

Our server fetches public documents and data from the source you chose (for example the SEC at sec.gov) on your behalf, converts a document to plain text, and sends that text to your browser. It identifies itself to the source as that source requires (the SEC's fair-access policy, for one). Fetched data may be cached to avoid asking a source for the same thing twice: briefly for SEC filings, and for up to a week for the titles, authors and abstracts of arXiv papers, which arXiv asks sites to fetch through one shared, rate-limited gateway. Nothing about you is stored with it. We do not log what you look up.

The visitor counter

This app shows a small counter with two numbers: how many people have ever visited it, and how many are on it right now. To count a visit only once per visitor rather than once per page view, a shared Vibistic server computes a one-way cryptographic hash of your IP address and your browser's user-agent string, combined with a secret value only that server knows. That hash (never your raw IP address) is what gets stored, alongside which app it belongs to and when it was first seen.

This hash is a pseudonymous technical identifier, not an anonymous one in the strictest sense, and we want to be precise rather than say "no data is collected" when that would not be accurate. It cannot be reversed into your IP address or user-agent without the secret value, it is never linked to an account (there are none), never linked to what you look up or read here, and it is used for nothing beyond this aggregate count. No cookie is set and nothing is stored in your browser for this feature.

This is a best-effort, decorative counter, not a precise analytics platform: the same person can be counted more than once (a change of network or device looks like a new visitor), and several people sharing one connection can be undercounted.

Separately, your IP address is briefly checked, in memory, against a rate limit before this app fetches anything from a source for you, and before a visit is counted: standard protection against automated flooding. These checks do not write your IP address to any database or log.

Cloudflare Web Analytics

To see how many people visit and which pages they read, we use Cloudflare Web Analytics. Cloudflare already hosts this site, and adds its small analytics script to each page. That script uses no cookies or local storage, doesn't fingerprint your browser, and doesn't follow you across other sites. It sends Cloudflare things like the page you viewed, the site that linked you here, your browser and device type, your country, and how fast the page loaded, and we only ever see those as totals, never as a record of you. It's never used for advertising. Cloudflare describes it here.

Theme preference

Clicking the light, dark or system icon in the header saves your choice in a small cookie named vibistic-theme. It stores only which of those three you picked, and it is shared across every Vibistic subdomain, so the choice looks the same everywhere in the portfolio. It is set only when you click the icon (or once, to carry over an older saved preference), and it is never used for tracking or analytics.

Trending indicators on arXiv papers

On "New on arXiv", the upvotes from Hugging Face Daily Papers and the points from Hacker News are read by Vibistic's own server about once an hour, as public counts. Nothing about you is sent to either site when you open the page. If you click one of these badges, your browser goes to that site, under its own terms.

Vibistic AI chat

The Vibistic AI chat beside each page answers questions about what is open: a filing, a fund's holdings report, a paper, or the page itself. Vibistic doesn't store your messages or keep a record of your conversation; it lives only in the open page and is gone when you leave it. The one exception is an answer you choose to share publicly (see "Shared findings" below).

With no API key saved, the free built-in AI answers. Your question, and a reference to the page you are on, go to Vibistic's own server, which looks the page up itself and sends your question together with the page's text to Cloudflare Workers AI, a model (IBM Granite) run on Cloudflare's own network, which processes it under Cloudflare's own terms. The free AI gives each visitor 2 messages a day, and the site as a whole a daily allowance. To count them, Vibistic keeps a number for the day and, for each visitor, a number under a scrambled form (a keyed hash) of your network address and the date. The address itself is not stored, the key that scrambles it is a secret kept apart from the counts, and every count is deleted after the day ends (UTC). Your message is not kept with any of it. If the site's daily allowance runs out, the owner gets an email that says how many messages and visitors it was, nothing about any of them.

With your own API key saved (in AI settings), your question and the page's text go straight from your browser to the AI provider you chose, never through Vibistic's servers, and that provider processes them under its own terms. The key stays in this browser.

If you use the microphone button, your browser's own speech recognition turns your voice into text. In Chrome and Edge that sends the recorded audio to your browser vendor's speech service (for example Google), not to Vibistic; you are told this once before the first recording.

Shared findings

"Share" under a Vibistic AI answer lets you publish a finding: the answers you pick (with the questions they answered), a title, an optional one-line takeaway and an optional note you write. You see exactly what will be public before you share. Vibistic stores that, with a reference to the page it is about and the date, and shows it on a public page that anyone with the link can read. It is not listed or offered to search engines. Nothing else is shared: not your AI key, your other messages, your notebook or anything that identifies you. Vibistic checks each shared answer's quotes against the page's text again when you share.

Your browser keeps the list of findings you shared, with a code that lets you delete each one (in this browser's local storage, not in Backup). Deleting removes the finding; a copy can stay in Cloudflare's cache for up to five minutes. Anyone can report a finding (a reason only, nothing about them), and reported findings are reviewed and removed if they break the rules. Sharing and reporting are limited per visitor and per day, counted as numbers only.

"Continue in Vibistic AI" on a finding opens its page with the shared answers shown in your chat. Your own questions are answered from the page as usual, in your own session, and are not shared.

Your notes

"Your notes", beside the Vibistic AI chat, is one notebook for the whole site. What you write is saved in this browser's local storage and nowhere else, and is lost if you clear this site's data, unless you turn on Backup. Export saves a copy as a file (.txt, .pdf or .docx) on your device; Import reads a file you pick, in your browser.

Reviewed papers and papers given to the chat

The arXiv papers you mark as "Reviewed" are saved in this browser's local storage (their arXiv ids only), and in your backup if you turn Backup on. The papers you tick "Add to Vibistic AI" are kept for this browser tab only; their ids are sent to our server, which looks up the titles and abstracts it has already saved for them (it never asks arXiv for them), for the chat.

A paper's PDF you attach to the chat

With your own AI key, you can attach a paper's PDF (one you downloaded) to the Vibistic AI chat on that paper's page. Your browser reads the file and sends its text, with each question, only to your AI provider. The file and its text are never sent to Vibistic, are not saved, and are gone when you remove the PDF or leave the page. The free built-in AI cannot use an attached PDF.

Backup (optional)

Backup is off unless you turn it on. When you do, your browser creates a recovery code that you keep; it is never sent to us. From that code your browser derives three values: one to find your backup on our server, one to prove you may change it, and one that locks the key your notes are encrypted with. Your notes are encrypted in your browser (AES-256-GCM) before anything is sent. Our server (Cloudflare KV) then holds only the encrypted notes, the locked key, the derived lookup value and the derived change token: nothing we can read your notes with. With Backup on, this browser also keeps the backup's lookup value, change token and last sync time in local storage, and the unlocking key in this browser's IndexedDB in a form that cannot be copied out, so it can update the backup a few seconds after you change your notes. Restore, on any device, needs your recovery code; if you lose it, nobody can recover your backup. Turning Backup off asks our server to delete it. Only the notes and the ids of the arXiv papers you marked as reviewed are ever backed up: never your AI key or settings, your watchlist, or anything else.

Watchlist

When you follow a ticker (the Follow button on a company page, or the box on the SEC filings and 13F holdings tabs), the list of tickers you follow is saved in a cookie named tldr-watchlist in your browser, for up to 400 days. It holds only those tickers (at most 20), nothing else. There is no account, and we keep no copy of your list. Like any cookie for this site, your browser sends it along with your requests to tldr.vibistic.com, but our server does not read or record it: to show the panels, the page itself sends the tickers to this site to look up their recent filings and fund reports, and those lookups are not stored with anything that identifies you. To remember which updates you have already seen (the "New" markers), the page also keeps a short list of them in your browser's local storage. Removing every ticker deletes the cookie, and clearing this site's data removes both.

Not advice

Summaries are written by an AI model and can be wrong or incomplete. Figures shown without an AI come from the source's own data, but nothing here is investment, legal, tax or medical advice. Always check important details against the original document, which every summary links to.