In effect from 23 October 2026.
The short version
We don't keep what you type to the portfolio assistant. We keep anonymous daily counts to enforce limits, and we delete them after a week. No ads, no tracking across sites, nothing sold. Visitors have no accounts; the only accounts are for people the owner invites to see a few shared pages, and what we keep about them is listed under "If you were invited".
Who runs it
VeryBad.Dog is run by VeryBadDog LLC, Alex’s company, a Delaware limited liability company operating in Washington State. Contact: privacy@verybad.dog.
What we collect
- Messages to the assistant. They are sent to our AI provider to generate a reply and then discarded by this site. We store no transcript.
- Daily counters. A one-way, scrambled code made from your IP address and a key that changes every day, plus how many messages it sent that day and how many of them the assistant refused. We can't turn the code back into your address, and codes from different days can't be linked. Once they are more than 7 days old they are deleted, the next time anyone uses the assistant.
- Sign-in limits. If you use the invitation or sign-in pages, the same kind of scrambled daily code is counted in 15-minute windows to stop abuse. Deleted after 2 days.
- Site totals. How many requests the assistant served, what they cost, and how many messages it refused of each kind (such as requests for code), per day, with no link to any visitor.
- Page views and performance. Vercel Web Analytics counts page views and Vercel Speed Insights measures how fast pages load. Neither sets a cookie. Vercel tells visits apart with a code made from the request, which it discards after a day, and doesn't track you across sites.
- Game events. Bone Yard may send anonymous gameplay events through the same analytics, such as a run starting or ending. Every value is a number in a broad range or one of a few fixed words: no identifier, score, name or save leaves your browser.
- Game saves. Bone Yard and Off Leash keep your progress and best scores in your own browser's storage. They aren't sent to us.
We don't collect names, emails or accounts from visitors. The two sign-ins on this site are the owner's and, for people the owner invited, the one described below.
We use what we collect only to run the site, answer the assistant's questions, enforce its limits, keep the site secure, and meet legal obligations. We don't use it for advertising or profiling.
If you were invited
The owner can invite someone by email to see a few chosen pages. If that is you:
- What the owner entered. Your email address and a display name, when inviting you.
- What we store. Your email address, your display name, which shared pages you can see, your sign-in sessions (when each started and was last used), your sign-in requests (kept only as one-way codes, never the code we mailed you), and a log of which shared pages you opened and when. No IP address and no device details. The log is kept for at most 180 days; older lines are deleted automatically.
- Who else handles it. Supabase holds the database. Resend delivers the sign-in emails; its logs hold the recipient and the message for its own retention period. Vercel hosts the site; its request logs are kept for its own retention period. Each provider's privacy policy is linked under "Who else handles it".
- Cookies. One essential cookie keeps you signed in. A second, short-lived one exists only while you sign in; it holds a one-way code made from your email address, not the address.
- Deleting it. "Delete my account" on your account page, or ask the owner. It removes everything this site holds about you at once. Resend's and Vercel's logs expire on their own schedules.
Who else handles it
- Hosting and analytics: Vercel, which serves the site and its server functions and runs the analytics above (privacy policy).
- Database: Supabase, which holds the counters above and, for invited people, what "If you were invited" lists (privacy policy).
- Email: Resend, which delivers sign-in emails to invited people only (privacy policy).
- AI provider: Anthropic, which processes assistant messages to generate replies. Under its commercial terms it doesn't train its models on them and keeps them only for a limited period (privacy policy).
We don't sell or share personal information for advertising, and we have no advertising partners.
We may also disclose information when the law requires it (for example, a valid court order), when it's needed to protect the site, its users or others from harm or abuse, or to our own lawyers and advisers. If the site or the company ever changes hands, what we hold would pass to the new owner, who would have to keep to this policy for it or tell you first.
How long we keep it
- Messages to the assistant: not kept by this site at all.
- Daily counters: 7 days, then deleted the next time the assistant is used. Sign-in limits: 2 days, then deleted at the next twice-weekly clean-up.
- Site totals: kept, since they identify nobody.
- An invited person's details: until the account is deleted. Their sign-in requests go once they are used or expired and a day old, ended sessions 30 days after they end, and the access log after at most 180 days.
- Game saves and the colour-scheme choice: in your browser until you clear them.
- Our providers' own logs: their retention periods, linked above.
Security
The site is served only over HTTPS. Its pages never connect to the database; only our own server does, and an invited person's rows are locked to them by the database itself. Sign-in codes and links are stored only as one-way codes, and the private area needs the owner's own sign-in. No system is perfectly secure, so we can't promise that nothing will ever go wrong. If a breach affects your information, we'll tell you as the law requires.
Where it's processed
We're in the United States, and the site's server and database run in the western United States. Vercel's network may answer your request from a server near you, and our providers may process data in other countries under their own terms. If you visit from outside the United States, your information is handled in the United States, where privacy laws may differ from yours.
Other sites
Links to other sites (including our providers' policies above) take you to pages we don't run. Their own privacy policies apply there.
Cookies
Visitors get no cookies. The owner's sign-in uses one essential cookie, plus a short-lived one during the GitHub sign-in itself. An invited person's sign-in uses one essential cookie, plus a short-lived one while signing in (see "If you were invited"). The game and the colour-scheme toggle may use your browser's local storage. Blocking cookies in your browser only stops signing in; the rest of the site works without them.
Your choices
Don't want your messages processed by an AI provider? Don't use the assistant; the rest of the site works without it. You can clear the game's local storage from your browser at any time.
Do Not Track and Global Privacy Control. We don't sell or share personal information, use it for targeted advertising, or track you across sites, so there is nothing for these signals to switch off. Everyone gets that by default, whether or not their browser sends them.
Your rights
You can ask what we hold about you, or ask us to correct or delete it, by writing to privacy@verybad.dog. For most visitors the answer is nothing that identifies you: the counters can't be traced back to you. Invited people can also delete their account themselves, as above. We answer within 30 days.
Some US states give their residents privacy rights by law, such as to know, access, correct, delete, get a copy, and opt out of sale or targeted advertising. We offer the same requests to everyone, wherever you live. We may ask you to write from the email address we hold so we know the request is yours, and someone you authorise in writing can ask for you. If we turn a request down, we'll say why, and you can ask us to look at it again. We won't treat you differently for asking.
Children
The site isn't directed at children under 13, and we don't knowingly collect personal information from them. If you think a child has given us any, write to privacy@verybad.dog and we'll delete it.
Changes
We'll update the date and the change log when this changes. A change takes effect when it is posted here.
Change log
- 2026-10-23: added the sign-in limits, what we use information for, legal and change-of-ownership disclosures, how long we keep each thing, security, where it's processed, other sites, Do Not Track and Global Privacy Control, US state requests, and more on children.
- 2026-10-23: in effect. Added Speed Insights, the game's anonymous events, Off Leash's browser storage, the sign-in cookie, links to each provider's policy, and how to ask about your data.
- 2026-10-16: invited viewers: what is kept about them, who handles it, their cookies and how to delete it.
- 2026-10-15: first draft.
Portions adapted from General Legal's templates, CC0.