Privacy Policy

Privacy Policy

Last updated: May 3, 2026

1. Introduction

PrompX ("we," "our," or "us") operates the PrompX web application, iOS application, Chrome extension, and desktop application (collectively, the "Service"). This Privacy Policy explains how we collect, use, and protect your information when you use our Service.

2. Information We Collect

2.1 Account Information

When you create an account, we collect your email address, username, and password. Passwords are securely hashed and never stored in plaintext. You may optionally provide a display name and profile image.

If you sign in with Google, we receive your name, email, and profile picture from your Google account. We do not receive or store your Google password.

If you sign in with Apple on iOS, we receive an Apple-issued identity token and, on first sign-in only, your name and email (which Apple may relay or hide behind a privacy-relay address at your choice). We do not receive your Apple ID password.

2.2 User Content

We store the prompts, collections, tags, and other content you create within the Service. This content is stored on our servers to sync across your devices. If you attach images to prompts, the image files are stored on Amazon S3.

2.3 Usage Analytics

We collect product usage analytics such as feature usage patterns, session information, and notification interactions, processed by PostHog and (on iOS) by OneSignal. Analytics data is linked to your account so we can improve features for real users, but it does not include the content of your prompts. We do not use this data for advertising and we do not share it with data brokers.

2.4 Payment Information

Web and desktop subscriptions are processed by Stripe. iOS subscriptions are processed by Apple via In-App Purchase, with subscription state synchronized through RevenueCat. We do not store credit card numbers, bank account details, or other payment credentials on our servers. We only store identifiers issued by these providers (Stripe customer ID, RevenueCat app user ID) and your current subscription status.

2.5 Push Notifications (iOS)

If you enable notifications on iOS, we use OneSignal to deliver push notifications through Apple Push Notification service (APNs). OneSignal stores a per-device push token and a per-user identifier we generate from your PrompX account ID (prompx_user_<id>) so we can target notifications to your account. OneSignal collects basic device information (OS version, locale, time zone) and notification interaction data (delivery, open). OneSignal does not receive the content of your prompts. You can disable notifications at any time in iOS Settings.

We never enable OneSignal data collection until you accept the in-app notification prompt. If you decline, OneSignal stays inactive on your device.

2.6 Crash Reports and Diagnostics

We use Sentry to capture crash reports and error diagnostics so we can fix bugs. Sentry receives an error trace, your PrompX account ID and email (so we can follow up if needed), and standard device context (OS version, app version, device model). Sentry does not receive the content of your prompts.

3. How We Use Your Information

We use the information we collect to:

  • Provide, maintain, and improve the Service
  • Authenticate your identity and manage your account
  • Sync your prompts and settings across devices
  • Process payments and manage subscriptions
  • Send transactional emails (account verification, password resets)
  • Analyze usage patterns to improve the product

4. Chrome Extension

The PrompX Chrome extension:

  • Stores your authentication token locally in Chrome storage to keep you signed in
  • Reads selected text on webpages only when you explicitly use the "Save to PrompX" context menu
  • Injects prompts into AI chat platforms only when you click "Inject"
  • Does not track your browsing history or monitor your activity
  • Does not collect or transmit any data from pages you visit unless you initiate an action

5. Data Sharing

We do not sell, trade, or rent your personal information to third parties. We share data only with the service providers we use to operate the Service:

  • AWS — infrastructure, hosting, image storage (S3), and transactional email (SES)
  • Stripe — payment processing for web and desktop subscriptions
  • Apple — In-App Purchase processing for iOS subscriptions
  • RevenueCat — synchronizing iOS subscription state across devices
  • OneSignal — push notification delivery on iOS (only after you opt in)
  • Sentry — crash reporting and error diagnostics
  • PostHog — product usage analytics
  • Google and Apple — sign-in providers (only if you choose to use them)

None of these providers are permitted to use your data for cross-app advertising or to sell it to data brokers.

We may disclose information if required by law or to protect the rights, safety, or property of PrompX or its users.

6. Data Security

We take reasonable measures to protect your data, including:

  • Passwords are hashed with bcrypt before storage
  • All data is transmitted over HTTPS/TLS
  • Authentication tokens are signed with JWT and have configurable expiration
  • Database access is restricted and credentials are stored securely
  • Rate limiting is applied to authentication endpoints

7. Data Retention

We retain your account information and content for as long as your account is active. If you delete your account, we will delete your personal data within 30 days, except where we are required to retain it for legal or compliance reasons.

8. Your Rights

You have the right to:

  • Access the personal information we hold about you
  • Update or correct your account information
  • Delete your account and associated data
  • Export your prompts and content

To exercise any of these rights, contact us at support@prompx.app.

9. Cookies

The PrompX web application uses local storage (not cookies) to store your authentication token. We do not use advertising or cross-site tracking cookies. We set one first-party cookie, px_attr, on prompx.app for 90 days. It records how you first found us (campaign parameters in the link, the referring site, and the page you landed on) and is attached to your account if you sign up, so we can see which channels bring people to PrompX. Our analytics provider (PostHog) may also set a first-party cookie holding an anonymous identifier.

10. Children's Privacy

PrompX is not intended for children under 13 years of age. We do not knowingly collect personal information from children. If you believe a child has provided us with personal data, please contact us and we will delete it.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by posting the updated policy on this page and updating the "Last updated" date. Your continued use of the Service after changes constitutes acceptance of the updated policy.

12. Contact Us

If you have questions about this Privacy Policy, please contact us at support@prompx.app.