Privacy Policy

Effective date: September 7, 2026  ·  Nexum Grzegorz Łopatka

1. Who We Are

Prompt Secure is operated by Nexum (Nexum Grzegorz Łopatka), a sole proprietorship registered in Poland (NIP: PL7262529449), hereinafter referred to as "we," "us," or "the Company."

Contact: hello@promptsecure.app
Website: https://promptsecure.app

2. Scope of This Policy

This Privacy Policy applies to:

• The Prompt Secure Android application (available on Google Play)
• The Prompt Secure Chrome Extension (available on Chrome Web Store)
• The Prompt Secure website at promptsecure.app

3. The Data We Do Not Collect

The following data never leaves your device and is never transmitted to our servers:

• Your prompts, templates, and prompt content
• Your AI provider API keys (OpenAI, Anthropic, or others)
• Your prompt history and AI conversation history
• Your knowledge base documents
• Your usage statistics and spending data
• Content you enter into the Notepad

API keys are stored exclusively in Android's hardware-backed Keystore (on mobile) or in chrome.storage.local (in the Chrome Extension), using platform-level encryption. They are never transmitted in any form.

4. Data We Collect and Process

4.1 Account Data (Optional)

Cloud synchronization and the Chrome Extension are optional features that require account creation. If you choose to create an account, we collect:

• Email address
• Encrypted password (we never store plaintext passwords)
• Account creation date and last login timestamp

Your prompts synced to the cloud are stored in a Supabase-backed database hosted in the European Union, associated with your user account. This data is protected by row-level security policies — only you can access your data.

4.2 Purchase Data

Purchases are processed exclusively through Google Play. We receive from Google Play only:

• Confirmation that a purchase was made and its type (monthly, yearly, or lifetime)
• Purchase status (active, expired, refunded)

We never receive your payment card details, billing address, or any other financial information. All payment processing is handled by Google LLC under their own privacy policy.

4.3 Website Analytics

Our website (promptsecure.app) does not use cookies or third-party tracking scripts. Cloudflare, our hosting and DNS provider, may collect basic access logs (IP address, request timestamp, user agent) for security and performance purposes. These logs are governed by Cloudflare's privacy policy.

4.4 Support Communications

If you contact us at hello@promptsecure.app, we retain your email and the content of your message for the purpose of responding to your inquiry. We do not share this with third parties.

5. Local-First Architecture

Prompt Secure is designed with privacy as a core architectural principle:

• On-device storage: All prompts and settings are stored in an encrypted local database (Isar) on your device.
• BYOK model: You bring your own API keys. Your AI requests go directly from your device to OpenAI or Anthropic — they do not pass through our servers.
• Offline-first: The application functions fully without an internet connection. Network connectivity is required only for AI features and optional cloud sync.
• No tracking: We do not include analytics SDKs, advertising SDKs, or behavioral tracking in the application.

6. Third-Party Services

When you use specific features, your data may be processed by the following third parties:

• OpenAI (openai.com) — when you send prompts using your OpenAI API key. Your prompts are sent directly to OpenAI's API. OpenAI's privacy policy governs this data.
• Anthropic (anthropic.com) — when you send prompts using your Anthropic API key. Same as above.
• Supabase — our cloud database provider, used for optional account and sync functionality. Data is hosted in the EU.
• Google Play / RevenueCat — for in-app purchase processing and validation.
• Cloudflare — our website hosting and DNS provider.

We do not sell, rent, or share your data with any other third parties for marketing or advertising purposes.

7. Data Retention

• Local data: Retained on your device until you uninstall the application or manually delete it.
• Cloud account data: Retained until you request account deletion.
• Support emails: Retained for up to 2 years, then deleted.
• Purchase records: Retained as required by applicable tax and accounting law (5 years in Poland).

8. Your Rights (GDPR)

If you are located in the European Economic Area, you have the following rights:

• Right of access — you may request a copy of the personal data we hold about you.
• Right to rectification — you may request correction of inaccurate data.
• Right to erasure — you may request deletion of your account and associated data.
• Right to data portability — you may request your data in a machine-readable format. The app provides a built-in JSON export function for this purpose.
• Right to object — you may object to processing based on legitimate interests.

To exercise any of these rights, contact us at hello@promptsecure.app. We will respond within 30 days.

9. Data Security

We implement appropriate technical and organizational measures to protect your data:

• API keys are encrypted using Android's hardware-backed Keystore
• Cloud data is encrypted in transit (TLS) and at rest
• Database access is protected by row-level security policies
• We do not store plaintext passwords
• The application supports biometric authentication and PIN lock

10. Children's Privacy

Prompt Secure is not directed at children under the age of 13. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us immediately at hello@promptsecure.app.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via a notice within the application or on our website. The effective date at the top of this document will always reflect the date of the most recent revision. Your continued use of the application after changes constitutes acceptance of the updated policy.

12. Contact

For any privacy-related questions or requests, please contact:

Nexum
ul. Kolejowa 2C lok. 9
95-050 Konstantynów Łódzki, Poland
Email: hello@promptsecure.app