VibeTV shows your AI limits on a small display on your desk. This page explains what the device and the app do, what they read and where data goes.
In short
- The VibeTV holds no sign-ins and no passwords for your AI accounts.
- Your sign-ins stay on your computer. VibeTV doesn't send them to us.
- Only display data goes to the VibeTV: the provider name, percentages, reset times, token totals, the time and short status messages.
- The downloads are signed: Mac with an Apple Developer ID and notarised by Apple, Windows with the certificate of DreamyTales GmbH, the company behind VibeTV.
Check it yourself
You don't have to take our word for it. We give you or your IT team read-only access to the source code of the app and firmware, so you can check everything on this page yourselves. Email us at hello@vibetv.shop with the subject "Code review".
The foundation: CodexBar, open source
The core of VibeTV is reading your usage and limits from your AI providers. This part is based on CodexBar. CodexBar is open source (MIT licence) and its code is public on GitHub: github.com/steipete/CodexBar. This is exactly the part that works with your sign-ins. It reads them on your computer and only uses them to ask each provider for your usage.
- Mac: VibeTV ships the official CodexBar version unchanged and starts it only with its developer's valid signature.
- Windows: VibeTV uses Win-CodexBar, also open source (MIT licence), in our public fork github.com/marcus7989/Win-CodexBar.
The VibeTV app takes CodexBar's results and sends them to your display. The code of the VibeTV app and firmware is not public. On request you get read-only access (see above).
Hardware
- USB-C: The VibeTV uses a USB-to-serial chip (CH340). Your computer sees only a serial port ("USB-SERIAL CH340"). It never sees a keyboard, a mouse or a drive.
- Stored data: No AI accounts and no sign-ins. In WiFi mode the VibeTV stores your WiFi name, your WiFi password and a pairing key.
- Cable mode: The WiFi inside the VibeTV is switched off. Data comes only over the USB cable. You don't need WiFi.
- Setup: WiFi details, pairing and firmware updates go only over the USB cable. Current devices open no WiFi hotspot of their own and accept no firmware over WiFi.
- WiFi mode: We recommend running the VibeTV over the included USB-C cable rather than WiFi. Still: the VibeTV gets the display data from the app on your local network over HTTP on port 80. This connection is not encrypted. Every change to the device needs a 128-bit pairing key that the app gives the VibeTV over the USB cable during setup. Without this key the VibeTV rejects every change. Without the key only read requests work, and they change nothing: device info, status and the list of stored images. The key itself travels unencrypted on your local network.
- Internet: The VibeTV makes only one connection to the internet: in WiFi mode it gets the time from pool.ntp.org (time sync over SNTP, UDP port 123).
The app (Mac and Windows)
The VibeTV Control Center app runs on your computer. It gets your usage data and sends it to the VibeTV.
- Sign-ins and limits: The built-in open-source software CodexBar handles this (more above). It uses your existing sign-in with the AI providers you switch on, for example from your browser or from the files of tools like Codex and Claude Code. With it, CodexBar asks the provider for your usage.
- Token totals: Codex and Claude Code keep a log on your computer that also contains your conversations. CodexBar, the open-source foundation we build on, only counts the tokens in it. You can see exactly how here: github.com/steipete/CodexBar
- Agent status: Agent activity is off by default. With Agent activity switched on (Settings › Agent activity), the app shows whether tools like Claude Code, Codex or the Copilot CLI are working, done or waiting for you. For that it adds its own hooks to those tools and reads the session logs they keep on your computer. This stays on your computer: only the state, for example "working", and the tool's name go to your VibeTV. Switching Agent activity off removes the app's hooks again.
- Local service: The app runs a service that only your own computer can reach (127.0.0.1, port 47832). Other devices on your network can't reach it. Websites in your browser can't either, except the VibeTV web app at app.vibetv.shop.
- Finding the VibeTV on WiFi: If the app doesn't know the address of your VibeTV, it sends a short request to the addresses on your local network ("GET /hello" on port 80, at most 1,024 addresses). If you connect the VibeTV over USB-C, it doesn't do this.
- Support report: The app saves it as a file on your computer and removes passwords, keys and tokens first. It is never uploaded. You decide whether to send it to us.
- AI Theme Builder: Bring your own key. On a Mac the key is kept in the Keychain, on Windows it is encrypted with your Windows account, and it goes only to the provider it belongs to.
Where the app connects
| Destination | What for | When |
|---|---|---|
| The AI providers you switch on (for example chatgpt.com, claude.ai, cursor.com) | Read usage and limits (CodexBar) | Regularly, while the app runs |
| Status pages of these providers | Show outages (CodexBar) | Regularly |
| models.dev | Public price list for cost estimates (CodexBar) | From time to time |
| github.com, api.github.com | App and firmware updates | At start and during update checks |
| raw.githubusercontent.com | CodexBar's own update check (Mac only) | From time to time |
| app.vibetv.shop | Load the theme catalog and themes | When you open or install themes |
| api.openai.com | AI Theme Builder | Only if you use it with your own key |
| open.er-api.com | Exchange rate (CodexBar, Mac only) | Only if you choose a currency other than US dollars |
When you click "Sign in" in the app, the provider's sign-in page opens in your browser. The app doesn't send your usage data to us. As with any internet connection, each server sees your IP address.
Downloads and updates
- Mac: Signed with an Apple Developer ID (Team ID QJ36BU5499) and notarised by Apple.
- Windows: Signed with the code signing certificate of DreamyTales GmbH, the company behind VibeTV.
- Updates: The app installs only updates signed with our key. It checks firmware and themes with a SHA-256 checksum before it installs them.
- Checksums: Every release includes a checksums-v….txt file with the SHA-256 checksums of all files: github.com/DreamyTalesPAN/CodexBar-Display/releases.
- Firmware updates start only when you start them in the app. They run only over the USB cable.
For IT teams
We answer security questionnaires and technical questions, and we give read-only access to the source code of the app and firmware. Email us at hello@vibetv.shop, for code access with the subject "Code review". Our EU Declaration of Conformity also lists the cybersecurity standards EN 18031-1 and EN 18031-2.
Report a vulnerability
Email hello@vibetv.shop with the subject "Security". Please include the affected part and version (firmware, app, operating system), what an attacker can do and what access they need, and the steps to reproduce it. Please don't publish details before a fix is released.