Privacy Policy

Who we are

Bucket (“we”, “us”) operates brokebucket.com. Bucket is an application agent: it stores memory about you (with your permission), drafts answers to forms, and may use a separate browser worker to fill portals after you review answers.

What we collect

• Account data: email, name, auth provider IDs (Google / GitHub)
• Profile facts from onboarding (phone, location, role, education, etc.)
• Memory you add: story text, resume paste, Claude / ChatGPT imports, chat messages
• Optional encrypted site credentials (usernames/passwords for apply portals)
• Optional connection metadata when you link Gmail, GitHub, Slack, or LinkedIn
• Application / fill session logs and drafts you generate in product
• Technical logs needed for security (IP truncated where feasible, timestamps)

How we use data

• Authenticate you and keep your workspace
• Retrieve relevant memory to draft form answers
• Run model calls (Claude / OpenAI) with retrieved context you authorize
• Drive the fill worker only after you start a fill and review drafts
• Improve reliability and prevent abuse (rate limits, fraud signals)

We do not sell your personal data. We do not use your memory to train public foundation models.

Encryption & security

Site credentials are encrypted with AES-256-GCM before storage. Decryption happens only server-side for authorized fill jobs. Passwords are never written to application logs. Database access for user tables is guarded by row-level security (RLS).

Retention

If you are inactive for 90 days, we purge personal memory, credentials, chat content, applications, and connection tokens associated with your account while keeping the bare account shell so you can return and rebuild. You may delete memory or request full account deletion via Settings or email.

Processors

We use infrastructure and APIs that may process data on our instructions: Supabase (auth/database), Vercel (hosting), Anthropic and OpenAI (model inference), and optional fill-worker hosting (Render/Railway) plus CAPTCHA vendors when you enable live fill.

Cookies & consent

Essential cookies keep you signed in. Non-essential analytics only run after you Accept on the consent bar. Reject keeps the product usable with essential cookies only.

Your rights

Depending on where you live, you may request access, correction, export, or deletion of your data. Contact us at privacy@brokebucket.com.

Children

Bucket is not directed at children under 16. Do not create an account if you are under that age.