Privacy

What is collected

• Your email address. Sign-in is by one-time magic link, so an email address is the only account identifier. It is stored by the authentication service and shown back to you on your account page. It is never shown to other users and never appears on a public prompt.
• The prompts you write. Title, body, tags, and target model, plus the timestamps and the visibility setting you chose for each one.
• Sharing records. Which share links exist for your prompts, whether each has been revoked, and which accounts have claimed one.
• Ordinary server logs. The hosting provider records request metadata (IP address, timestamp, path, user agent) for operating and securing the service.

Who can see your prompts

• Private (the default) — only you.
• Share link — anyone who has the link and signs in can claim permanent read access, until you revoke the link.
• Public — visible to anyone on the internet, listed in the Explore gallery, and eligible to appear in search engines and AI assistants. Treat anything you mark public as published. Don’t put secrets, credentials, or personal information about anyone in a prompt you publish.

Cookies

Only strictly necessary cookies are set: the session cookie that keeps you signed in and the short-lived verifier used while a magic link is being exchanged. They are HttpOnly and, in production, Secure. There are no analytics, advertising, or cross-site tracking cookies — which is why you are not asked to accept a cookie banner. Signing out clears the session cookie.

Processors and where data is held

• Supabase — hosts the Postgres database and the authentication service, and sends the magic-link emails. The project’s database region is US East.
• Vercel — hosts and serves the application, and keeps the request logs described above.

Both are United States companies, so data is stored and processed in the United States. No data is sold, and none is shared with anyone beyond these two providers.

Retention and deletion

Your prompts are kept until you delete them; deletion from the app removes the row from the database. Your account and everything attached to it can be removed on request — open an issue at the project’s issue tracker from the address you signed up with, and say what you want removed. The same route works for asking what is stored about you or for a copy of it.

Changes

If this notice changes materially, the date at the top changes with it.