Privacy Policy

This describes what Word Vomit actually collects, why, and what you can do about it. It’s written to be accurate rather than exhaustive. If something here seems to leave a question unanswered, email support@wordvomit.net and ask directly.

What we collect

• Your email address, used to sign you in and to send you the messages described below.
• What you write, along with word counts, timestamps, tags, and whether you reached your goal that day.
• Preferences you set: timezone, when your writing day starts, your word goal, whether you want reminder emails, an optional display name, and an optional username. Setting a username creates a public page at /u/your-username showing your streak and word counts, never your writing. Leave it blank and no such page exists.
• If you answered it, the optional “how did you find us” question shown once at sign-in.
• Basic technical logs generated by our hosting providers (roughly: IP address and request timing). This is standard for any website, not something we specifically collect or analyze ourselves.

We run one analytics tool, Vercel Web Analytics, which counts page views so we know whether anyone is showing up. It sets no cookies, doesn’t follow you to other sites, and never sees a word of what you write. We don’t sell data, and we don’t read your entries for any purpose beyond making the app work. There is currently no feature that has an automated system read your writing, and if that ever changes, this page will say so before it happens.

Who it’s shared with

Three infrastructure providers, and no one else:

• Supabase hosts the database and handles sign-in. Your entries live in a Supabase Postgres database, protected by row-level security so that even a bug in our application code can’t serve your data to another account.
• Vercel hosts the application itself, and provides the page-view analytics described above.
• Resend delivers the emails we send you: the welcome message, and the optional reminder when you start a day’s writing without finishing it. They receive your email address and the contents of those messages, never your entries. You can turn the reminders off in Settings.

If we ever add a payment processor, it will be added here, by name, before it handles anything of yours.

How long we keep it

For as long as your account exists. Deleting a single entry removes it immediately. Deleting your account (Settings → Danger zone) removes everything (your profile, every entry, every backup snapshot) permanently and immediately, with no recovery window. There is no soft-delete.

Your rights

• Export everything you’ve written at any time, as Markdown or JSON, from Settings.
• Delete your account and all associated data at any time, from Settings.
• Correct or ask about anything we hold on you by emailing support@wordvomit.net.

Security

Sign-in is by email link, Google, or an optional password. If you set a password it is stored only as a salted hash by our auth provider, not in plain text. Access to your entries is enforced by row-level security policies in the database itself, not just application code, so a bug in a page can’t leak someone else’s writing.

Children

Word Vomit isn’t directed at children, and we don’t knowingly collect information from anyone under 13.

Changes to this policy

If this changes in a way that matters (a new sub-processor, a new use of your data), the date at the top will update and we’ll try to flag it prominently rather than let it be a quiet edit.

Contact

support@wordvomit.net. A real inbox, checked by a real person, because that’s currently the entire team.