Privacy that begins by asking for nothing about you.

BS Bucket is an independent research and education initiative operated by Veritas Human Edge (“we”, “us”). It collects workplace stories to find the common problems and turn them into help for managers. This notice describes how we handle personal information under the Privacy Act 1988 (Cth) and the Australian Privacy Principles.

Public-bucket stories can be submitted without providing your name, email or creating an account. Stories shared through a team bucket’s link need none of these either.

If you create a team bucket, or are added to one as a moderator, we ask for your email to verify your access and manage the bucket. We send a one-time sign-in code to that address each time you sign in.

When you share a story on the public site, we store:

• the text of your story;
• if you choose to give them, your general job level and your country;
• the date and time it arrived;
• what our reviewers decide about it: approved or rejected, any reason or note they add, and themes tagged by our reviewers and our AI service.

The record of a story holds no name, email address, IP address, device or account. Our team reads every story before it is used, and removes or discards stories that contain names or other identifying details.

A team bucket is a private space an organisation creates for its own people. It has its own link, which the organisation shares with its team.

“Private” means the bucket is not listed or searchable on BS Bucket, and only its own moderators read its stories. It does not mean the link is secret: anyone who has the link can share a story, and a link can be forwarded. Our operators can technically access stored data to run, secure and support the service.

BS Bucket does not ask you to provide an IP address. Like every website, our servers receive it with each request. We use it only to limit repeated sending and sign-in attempts: we keep a one-way, keyed fingerprint of it, never the address itself, for the length of the limit (between ten minutes and one day). It is not stored with your story.

Our hosting, security and anti-spam providers may process or retain IP addresses or related technical information when operating and protecting the service. Their handling is also subject to their own privacy practices.

• Vercel

  Hosting

  Vercel (a United States company) hosts the website. Our server code runs in its Sydney, Australia region; its global network delivers pages from the location nearest you. It receives every request, including your IP address.

  Vercel privacy policy

• Supabase

  Database and sign-in

  Supabase stores our database in Sydney, Australia, and runs sign-in for bucket owners and moderators.

  Supabase privacy policy

• Cloudflare Turnstile

  Bot check

  Cloudflare Turnstile (United States) checks that a story comes from a person, not a bot. It processes your IP address and browser information to do so.

  Turnstile privacy addendum

• OpenAI

  Theme tagging

  OpenAI (United States) tags themes in stories on the public site and in paid team buckets, after a person has approved them. It receives the story text only: not your level, country, IP address or any account.

  OpenAI privacy policy

• Resend

  Email

  Resend (United States) delivers our emails, such as sign-in codes and notices to bucket owners. It receives the recipient’s email address.

  Resend privacy policy

• Stripe

  Payments

  Stripe (United States) takes payment for paid team buckets.

  Stripe privacy policy

Because of these services, information may be sent to or handled in the United States and other countries where they operate.

We use no advertising or analytics cookies, and no third-party tracking scripts. If you sign in to run a bucket, we set cookies that keep you signed in. The story form keeps a short fingerprint of your last story in your browser tab, so the same story is not sent twice by mistake; it is gone when you close the tab. Cloudflare Turnstile may use its own browser storage to do its check.

We review, redact, tag and count stories to find repeated workplace problems, and publish insights drawn from many stories: themes, word counts and educational material. Public word patterns appear only once at least 3 approved stories share them. We don’t publish individual stories word for word, and we never sell, rent or give stories to employers, advertisers or data brokers. A team bucket’s stories are used to give that organisation its own insights; they are not added to the public site.

• Stories are kept until we delete them, or until their bucket is deleted. In a team bucket, owners and moderators approve or reject stories but cannot delete them; our staff delete a story on a valid report.
• A free Starter bucket and its stories are deleted 90 days after it is created, unless it is upgraded to Team before then. We email its owners 14 days before. We keep a record that an account has used its free Starter bucket, even after the bucket is deleted, so that each account has only one.
• If payment for a paid bucket stops, including when a plan cancelled under Manage payment reaches the end of the month paid for, the bucket takes up to 50 stories a month and keeps its AI for 14 days. It is then deleted, with its stories, unless it is paid for again. We email its owners when the 14 days begin.
• An owner can delete a bucket at any time from its Settings. It is deleted at once, and a paid plan stops straight away, with no refund for the rest of the month.
• When a bucket is deleted, its stories, team, settings, word counts and insights are deleted for good, and any paid subscription is cancelled.
• A bucket closed before this change takes no new stories, its owner and moderators can still read and download what it holds, and it is deleted on the date its owners were given, unless it is upgraded or paid for again first.
• Accounts of bucket owners and moderators are kept until you ask us to delete them.
• Deleted data may remain in our database provider’s backups for a limited period before it is overwritten.

To ask us to remove a story, email us and quote enough of it for us to find it. Because we don’t know who wrote any story, we cannot look it up by person, and we cannot confirm that a story is yours. When we delete a story it is removed from word counts; insights or materials already published from many stories cannot be recalled.

If a story names or identifies someone, contains something harmful, or you want a decision about a story reviewed, or you have a privacy concern, email us. In a team bucket you can also tell that bucket’s owner.

If you run a bucket, you can ask for the personal information we hold about you, or ask us to correct or delete it. If you are unhappy with how we handled your information, contact us first; we will respond within 30 days. If you are still unhappy, you can complain to the Office of the Australian Information Commissioner.