Privacy Policy
Last updated: 14 June 2026
This policy explains what data PromptOS collects, why, and your choices. We aim to collect the minimum needed to run the service.
1. Data we collect
- Account data: name, email, and optionally phone, address, and date of birth you provide at sign-up.
- Authentication: a hashed password (PBKDF2) and, if you enable it, an encrypted two-factor secret. We never store passwords in plaintext.
- Usage data: your prompts, generated output, run traces, token/cost usage, and audit events needed to operate, bill, and secure the service.
- Billing data: plan, credit balance/ledger, and payment references. Card details are handled by Stripe and never reach our servers.
2. How we use it
To provide and improve the service, route and bill AI runs, prevent abuse and fraud, provide support, and meet legal obligations. We do not sell your personal data.
3. Third-party processors
- AI providers (e.g. Anthropic, OpenAI-compatible endpoints) process the prompt text you submit on paid/online runs. Secrets are masked before egress.
- Stripe processes card payments.
- Hosting/database providers store the data above.
The offline engine and local models run without sending your prompt to any third party.
4. Security
We use encryption in transit (HTTPS), hashed passwords, field-level encryption for sensitive secrets (API keys, 2FA secrets), role-based access control, and audit logging. No system is perfectly secure, but we take reasonable measures to protect your data.
5. Retention & your rights
We keep data while your account is active and as needed for legal/financial records. You can view your audit trail, export your prompts, and delete your account from Settings; deletion removes your personal data subject to records we must retain by law.
6. International transfers
Your data may be processed in countries where our providers operate. We rely on those providers' safeguards for such transfers.
7. Contact
Privacy questions or requests: see Support.