Privacy policy

• Account data: your email address, your public handle, and — only if you sign in with Google — the name and avatar image that Google provides.
• Content you create: prompts you submit, votes, favorites and collections. Published prompts, public collections and your handle are visible to everyone; your email is never shown publicly.
• Moderation records: decisions about submitted prompts (including rejection reasons) and administrative actions are kept in an internal audit log.

We only use functional cookies, strictly necessary to provide what you ask for. They require no consent under the ePrivacy rules, and we set no analytics or third-party cookies whatsoever:

• locale — your language preference (English/Spanish), kept for 1 year.
• theme — your dark/light preference, kept for 1 year.
• a session cookie — keeps you signed in after you log in.
• legal_notice_dismissed — remembers that you closed the informational notice, kept for 1 year.

We measure page views with our own first-party system. For each view of a public page we store only: the path of the page, the interface language, the referring site's hostname (only when you arrive from another site), and a two-letter country code when our hosting provider supplies one.

We never store your IP address (not even hashed), your browser's user-agent, your user id, or any identifier that could single you out — which also means we count views, not visitors. Analytics records are deleted after 90 days. Private pages (your account, favorites, collections and admin areas) are not measured at all.

We only send transactional email: the 6-digit sign-in codes you request, and the result of moderation when a prompt you submitted is approved or rejected. Delivery is handled by Resend acting as our processor. There is no newsletter and no marketing email.

• Account and content data: kept while your account exists.
• Page view analytics: 90 days.
• Sign-in codes: minutes (they expire in 10 minutes and are stored hashed).

Under the GDPR you can request access, rectification, erasure, portability or restriction of your personal data, and object to processing. Write to privacy@promptvault.app from your account's email address. Account deletion is currently handled manually through that address (a self-service option is planned); we will remove your account and personal data without undue delay.

If this policy changes, we will update this page and its "last updated" date. Substantial changes will be highlighted on the site.