Privacy Policy

This describes what Word Vomit actually collects, why, and what you can do about it. It’s written to be accurate rather than exhaustive. If something here seems to leave a question unanswered, email support@wordvomit.net and ask directly.

What we collect

• Your email address, used to sign you in and to send you the messages described below.
• What you write, along with word counts, timestamps, tags, and whether you reached your goal that day.
• Preferences you set: timezone, when your writing day starts, your word goal, whether you want reminder emails, an optional display name, and an optional username. Setting a username creates a public page at /u/your-username showing your streak and word counts, never your writing. Leave it blank and no such page exists.
• If you answered it, the optional “how did you find us” question shown once at sign-in.
• Signup-abuse signals recorded on a new account’s first login: an HMAC hash of your IP address rather than the address itself, a normalized email address and domain, and flags for disposable domains, repeated addresses, and repeated IP hashes. These are used for abuse monitoring, not advertising.
• If you pay or donate, your Stripe customer and subscription IDs, membership status, and lifetime donation total. Stripe handles your card details; Word Vomit never sees or stores them.
• Basic technical logs generated by our hosting providers (roughly: IP address and request timing). This is standard for any website, not something we specifically collect or analyze ourselves.

Vercel Web Analytics counts page views so we know whether anyone is showing up. It sets no cookies and doesn’t follow you to other sites.

Our own conversion funnel records product events such as guest milestones, signup, a first saved entry, return visits, and sharing. A random analytics ID stored in your browser links these events; it is not your account ID. Event properties are limited to things like numeric milestones, word-goal choices, link sources, share styles, and days since the first entry. They never include entry text, tags, prompts, or email addresses. These events live in Supabase for 90 days and are then deleted. Abuse-prevention quotas also keep a purpose-specific HMAC hash of your IP address for up to 24 hours, never the raw address.

We don’t sell data, and we don’t read your entries for any purpose beyond making the app work. There is currently no feature that has an automated system read your writing, and if that ever changes, this page will say so before it happens.

Who it’s shared with

The service providers that run Word Vomit:

• Supabase hosts the database and handles sign-in. Your entries live in a Supabase Postgres database, protected by row-level security so that even a bug in our application code can’t serve your data to another account.
• Vercel hosts the application itself, and provides the page-view analytics described above.
• Resend delivers the welcome message, unfinished-entry reminders, and the optional streak reminders and weekly recaps. They receive your email address and the contents of those messages, never your entries. You can change these email preferences in Settings.
• Stripe handles checkout, donations, memberships, and card details. Word Vomit receives only the billing identifiers and status needed to provide your membership.
• Google handles sign-in if you choose Continue with Google.
• Cloudflare provides the Turnstile anti-bot challenge when that protection is enabled on the sign-in page.

How long we keep it

For as long as your account exists. Deleting a single entry removes it immediately. Deleting your account (Settings → Danger zone) removes your profile, every entry, every revision, and your signup-abuse record from the live database immediately, with no recovery window or soft-delete. Infrastructure backups can retain deleted data for a limited period until those backups rotate.

Your rights

• Export everything you’ve written at any time, as Markdown or JSON, from Settings.
• Delete your account and all associated data at any time, from Settings.
• Correct or ask about anything we hold on you by emailing support@wordvomit.net.

Security

Sign-in is by email link, Google, or an optional password. If you set a password it is stored only as a salted hash by our auth provider, not in plain text. Access to your entries is enforced by row-level security policies in the database itself, not just application code, so a bug in a page can’t leak someone else’s writing.

Entries are not end-to-end encrypted. The app and its hosting infrastructure process readable text so they can save, search, revise, and export your journal. Only your account can open that text through the product.

Children

Word Vomit isn’t directed at children, and we don’t knowingly collect information from anyone under 13.

Changes to this policy

If this changes in a way that matters (a new sub-processor, a new use of your data), the date at the top will update and we’ll try to flag it prominently rather than let it be a quiet edit.

Contact

support@wordvomit.net. A real inbox, checked by a real person, because that’s currently the entire team.