1. Summary
- We collect only what’s needed to run your prompt library: the basics of your Google account and the content you save.
- Your prompts are private to your account. We don’t sell your data, show ads or use tracking scripts.
- You can delete your account and all of its data at any time from Settings.
- You can access, correct and delete your data, get a copy of it, and use your other GDPR rights (see GDPR compliance).
2. Information we collect
Account information from Google
When you sign in with Google, we receive your name, email address, profile picture URL and a Google account identifier, along with Google’s confirmation that your email address is verified. We never see your Google password. Google is used only to confirm who you are: we don’t store Google access or refresh tokens, and we don’t access any other data in your Google account.
Content you create
The prompts you save (titles, descriptions and text), their version history and notes, and how you organize them: collections, categories, tags, favorites, pins, archive status and saved views.
Usage information
How many times you’ve copied each prompt and when you last used it, so the app can show your most used and recently used prompts, and when items were created and updated.
Messages you send us
If you use the contact form, we receive your name, email address, the topic, subject and message. If you’re signed in, your account ID is included so we can find your account.
Technical information
To keep the service secure and available, our servers process your IP address and basic request details, such as your browser type and the pages you request. IP addresses are used for rate limiting in memory and aren’t stored in our database. Our hosting provider may keep standard server logs for a limited time.
3. How we use information
- To provide the service: signing you in, storing and showing your library, and making it available on all your devices.
- To keep it secure: preventing abuse with rate limits, protecting against attacks and investigating problems.
- To respond to you: answering messages you send through the contact form.
- To keep it reliable: diagnosing errors. Our logs are designed not to include your prompt content or authentication tokens.
We don’t use your prompts to train AI models, and we don’t sell your information or use it for advertising.
4. GDPR compliance
Here’s how we meet the requirements of the GDPR and the UK GDPR. Privacy is built in by design: we collect only what the service needs, never see your Google password or store your Google access tokens, encrypt data in transit and keep every library isolated to its owner.
Who is responsible for your data
The data controller is the person or organization that operates this website. You can reach us about anything related to your data through the contact form.
Why we process your data
- To provide the service you signed up for (contract, Art. 6(1)(b) GDPR): your account, your library and signing you in.
- Our legitimate interests (Art. 6(1)(f)): keeping the service secure, preventing abuse (for example with rate limits) and answering messages you send us.
- Legal obligations (Art. 6(1)(c)): when the law requires us to keep or disclose information.
We don’t use your data for advertising or profiling, and we don’t make automated decisions that significantly affect you (Art. 22).
Your rights
Under the GDPR, you have the right to:
- access your personal data and get a copy of it (Art. 15);
- correct inaccurate data (Art. 16); you can edit most of it yourself in the app;
- erase your data (Art. 17); you can delete your account from Settings at any time;
- restrict how we use your data (Art. 18);
- data portability: receive the data you gave us in a machine-readable format (Art. 20);
- object to processing based on our legitimate interests (Art. 21).
To use any of these rights, send a request through the contact form and choose “Account or data request”. Requests are free. We reply within one month (or let you know within that month if a complex request needs up to two more), and we may ask you to confirm that the account is yours first.
Service providers and transfers
Our hosting, database and email providers process personal data only on our instructions, under data processing agreements (Art. 28). When data leaves the European Economic Area or the UK, it’s protected by an adequacy decision or standard contractual clauses (see International transfers).
Data breaches
If a personal data breach is likely to put your rights at risk, we’ll notify the competent supervisory authority within 72 hours of becoming aware of it, and tell you directly without undue delay if the risk to you is high (Arts. 33 and 34).
Complaints
If you’re unhappy with how we handle your data, please contact us first so we can put it right. You also have the right to lodge a complaint with a data protection authority, such as the one in the EU country where you live or work, or the UK Information Commissioner’s Office (Art. 77).
7. How long we keep information
- Your account and content are kept until you delete them or delete your account.
- Deleted prompts are removed immediately and permanently. Version history keeps the 100 most recent versions of each prompt.
- Sessions end when you sign out, or after 14 days without use.
- Contact form messages are kept in our email for as long as needed to handle your request.
- Server logs kept by our hosting provider are deleted on its regular schedule.
8. Your rights and choices
- See and update your data: everything you’ve saved is visible and editable in the app.
- Delete your data: Settings → Delete account permanently removes your account and all of its content.
- Sign out everywhere: Settings → Sign out everywhere ends your sessions on every device.
- Everything else: for a copy of your data, or to restrict or object to how it’s used, send a request through the contact form. See GDPR compliance for all your rights and how quickly we respond.
9. Security
We use industry-standard safeguards, including encrypted connections (HTTPS), revocable database-backed sessions, HttpOnly and Secure cookies, a strict Content Security Policy, per-account data isolation and rate limiting. No method of transmitting or storing data is completely secure, so we can’t guarantee absolute security.
Prompts are stored as plain text, so please don’t save passwords, API keys or other secrets in them.
10. Children
Prompt Gallery isn’t directed to children under 13, or the minimum age required in your country, and we don’t knowingly collect their personal information. If you believe a child has given us personal information, please contact us and we’ll delete it.
11. International transfers
Our service providers may process information in countries other than yours, including outside the European Economic Area and the UK. When they do, the transfer is protected by an adequacy decision (an official finding that the destination country protects personal data adequately) or by standard contractual clauses, such as those approved by the European Commission and their UK equivalents.
12. Changes to this policy
We may update this policy from time to time. When we do, we’ll change the “Last updated” date above and, for significant changes, let you know in the app or by email before they take effect.
13. Contact us
Questions or requests about your privacy, including requests to use your GDPR rights? Use our contact form and choose “Account or data request” as the topic.