Your words. Your privacy.
Your posts are anonymous to other visitors. That doesn't mean perfect anonymity. What you write is public, so leave out identifying or sensitive personal details.
Who runs the bucket?
Vent Bucket is operated by John Halley. For privacy requests: johnhalleyirl@gmail.com.
What we store
We store your vents, comments, reactions, reports and optional future-app interest. A random, signed browser cookie lets you manage your own content without an account. The cookie is inaccessible to page scripts and lasts up to 180 days. The database stores a keyed hash rather than the cookie identifier. Guest identifiers are never shown publicly.
For security, we use short-lived rate-limit counters and a daily changing hash of a deployment-provided IP address. We don't put raw IP addresses into the application database. Hosting and security providers may process request information under their own policies.
Why we process it
We process your contributions to provide the service you request, and limited technical data for our legitimate interests in security and moderation. Optional analytics use your consent. Don't post personal data about someone else or sensitive personal information about yourself.
Optional, limited measurement
If you allow it, we count page visits, TikTok and UTM referrals, composing, submissions, viewing, comments, reactions, category filters, shares, app interest and returning visits. We never include vent or comment text. A random per-visit identifier in session storage deduplicates our own events; a simple “visited before” flag enables return counts.
Our own analytics records are removed after 90 days by scheduled maintenance. Browser Do Not Track and Global Privacy Control preferences disable optional measurement. You can change your choice below. Withdrawing consent stops future collection; previously collected aggregate activity can't be linked back to your guest cookie.
With your permission, Google Analytics also measures page visits, traffic sources, device information and approximate location derived from request information. It uses optional browser cookies lasting up to 60 days to recognise visits. We send fixed page labels, limited campaign tags and the referring website's domain. We never send your vent or comment text, guest cookie, post IDs, private account pages, or full query strings. Automatic form and content tracking and advertising features are disabled. Google processes this information under its own privacy policy. Google Analytics data retention is controlled separately in our Analytics property. Turning off optional metrics stops Google Analytics collection and removes its cookies on this browser. Reports cover only visitors who allow measurement.
Keeping and deleting your words
Public and held contributions stay until you delete them or we remove them. Deletion immediately clears the text and guest association from live content records. Deleted record shells are removed after 30 days. Resolved reports are retained for up to 180 days, and moderation decisions for up to one year, subject to any necessary legal retention.
Security counters expire within minutes and are cleared by daily maintenance. Essential guest cookies expire after 180 days. Interest is retained until withdrawn or the experiment ends. Database backups can retain older data for the configured provider backup period; they aren't publicly accessible.
Visit your words to check statuses, delete individual posts or comments, download your contributions, or erase all content, reactions and interest associated with this browser. Clearing cookies or changing devices may prevent us from verifying earlier ownership.
Services we use
Supabase stores data and authenticates administrators; Vercel hosts the app; Cloudflare Turnstile helps prevent bots. Google Analytics provides optional traffic measurement. Your browser contacts Cloudflare for a security check and Google only if you allow analytics. Data processing locations and transfer safeguards depend on the operator's provider configuration. No guest registration is required, and we don't sell your words or use them for advertising.
Your rights
Where GDPR applies, you may request access, correction, deletion, restriction or portability, and object to relevant processing. You can withdraw analytics consent at any time and complain to your data protection authority. See the Irish Data Protection Commission's guide to your rights. Contact us with enough information to locate the content, without sending unnecessary identity documents.