Prompt Secure›Privacy Policy

Privacy Policy

Effective date: October 31, 2026 · Nexum

1. Who We Are

Prompt Secure is operated by Nexum (Nexum Grzegorz Łopatka), a sole proprietorship registered in Poland (NIP: PL7262529449), hereinafter referred to as "we," "us," or "the Company." Contact: hello@promptsecure.app

2. Scope of This Policy

This Privacy Policy applies to the Prompt Secure Android application, the Chrome Extension, and the website at promptsecure.app.

The Chrome Extension is in preparation and not yet publicly available in the Chrome Web Store; the data practices described below already apply to its test versions.

3. What Stays on Your Device

Your AI provider API keys (OpenAI, Anthropic, or others) are never uploaded to our Supabase infrastructure.

Your prompt/response history, Notepad content, and clipboard history are not part of automatic Cloud Sync — signing in does not upload them. They can still leave your device if you manually export or share them, or if you send a request to an AI provider; for example, the local JSON export described in section 8 can include history logs containing prompt/response text and costs. They can also leave your device if you explicitly report an AI response (section 4.7), which sends a short excerpt of that response, not your full history.

These stay on your device unless you sign in, share, export, or send a request to an AI provider:

• Your prompts, templates, and their content — reach our infrastructure if you sign in (Cloud Sync starts automatically, see 4.1), publish a prompt to the community (4.5), or add it to a Team Vault (4.6); they can also leave your device via an AI request or a manual share or export, without an account.
• Your knowledge base documents — reach our infrastructure once you sign in, since Cloud Sync starts automatically (4.1).

Smart Context (Chrome Extension)

Smart Context is an optional feature and is off by default. Chrome may separately ask you to allow access to the current site before a read succeeds. When you are signed in and have explicitly turned it on in the extension's Settings, it reads whatever name, job title, and company are available on the page you currently have open — locally, on your device — to suggest values for prompt template variables. Turning it off clears any detected context already shown in the panel and prevents new reads from starting; a read already in progress may still finish, but its result is discarded rather than shown. Turning Smart Context off does not revoke site access already granted in Chrome; you can revoke it in Chrome's extension settings. This detected page data reaches our infrastructure only if you save it as part of a prompt that Cloud Sync uploads (4.1); it reaches an AI provider only if you include it in an AI request you initiate.

Our use of information received from Chrome APIs complies with the Chrome Web Store User Data Policy, including the Limited Use requirements.

4. Data We Collect and Process

4.1 Account Data (Optional)

An account is optional — your local vault, search, and templates work fully without one; signing in is required for Cloud Sync, Team Vaults, and community features. If you create an account, we collect your email address and account timestamps. Your password is processed for authentication over an encrypted connection and stored as a hash, never in plain text. Signing in starts Cloud Sync automatically, on Free accounts as well as paid plans — there is no separate sync switch. Cloud Sync stores your prompts and knowledge base documents in a Supabase database hosted in the EU, protected by row-level security that keeps your private synced data readable only by you — separately from the Team Vault (4.6) and community-published (4.5) content you deliberately choose to share. Sync is one of the ways your prompt content reaches our infrastructure; publishing to the community (4.5) and Team Vaults (4.6) are others.

If you are signed in and save a monthly AI budget limit in the Android app or Chrome extension, its value is sent to our Supabase infrastructure and associated with your account. In the Android app, turning off or removing the limit on your device does not delete a previously saved cloud value. That value remains in our active database until it is replaced by a new value or your account deletion succeeds.

4.2 Purchase Data

Purchases are processed by Google Play, which handles your payment details directly. RevenueCat and our backend process account and purchase identifiers, the product or plan you purchased, entitlement status, and relevant dates (such as expiration) to activate and maintain your Premium subscription. We never receive your payment card details or billing address.

4.3 Website Analytics

Our website does not use cookies or third-party tracking scripts. Cloudflare may collect basic access logs for security purposes, governed by Cloudflare's privacy policy.

4.4 Support Communications

If you contact us, your email and message are used to handle your inquiry. This correspondence is processed by Apple iCloud Mail for delivery and storage.

4.5 Prompts You Publish to the Community

Not active in this version. The community library is disabled in the current release, so publishing a prompt through the community library is not available yet. This section describes how it will work once the feature ships, and applies from that moment on.

If you choose to publish a prompt to the community library, its title, category and full content become publicly readable by anyone, including people without an account. We also store a counter of how many times it was copied. Your email address is never shown. Publishing is always an explicit action — nothing is published automatically. You can withdraw a published prompt at any time from the app, which removes it from the public library.

4.6 Team Vaults

If you create or join a Team Vault, prompts you add to it become readable by every member of that team for as long as they remain members. The team owner can remove any prompt from the shared library and can delete the entire team, which removes the shared library for everyone. Leaving a team ends your access to its content; prompts you had already copied into your own vault remain yours.

4.7 Reporting an AI Response

If you sign in and explicitly press Send on the in-app control for reporting an AI response, we send an AI-response report to our infrastructure. This report contains at most 500 characters of the previewed AI response excerpt, a reason code, the surface you reported it from, and the model name if one is available — it does not separately attach your full prompt/response history, API keys, or other vault fields, but the previewed response excerpt may itself contain sensitive information, so review it before pressing Send. Nothing is sent unless you take this explicit action. The report is stored in our Supabase database, hosted in the EU, as a row linked to your authenticated account and the time it was created, so that we can receive and assess it. This is an exception to the general rule in section 3 that your prompt/response history only leaves your device via export, share, or an AI-provider request.

4.8 Account Email Delivery (Resend)

Transactional account messages triggered by Supabase Auth — for example an email confirmation or a password-recovery message, depending on which account flow is enabled in a given release — are delivered through our provider Resend (operated by Plus Five Five, Inc.). That message includes your email address, the email body with a one-time action link or code, depending on the account flow, and delivery metadata. We do not attach vault prompts, AI response history, provider API keys, or the account password through this route. Resend stores message content and delivery logs in the United States, independent of the EU sending region we use, with a standard 30-day retention period. Transfers are governed by Resend's Data Processing Addendum and Standard Contractual Clauses: resend.com/legal/dpa.

This is separate from the Apple iCloud Mail inbox described in section 4.4, which handles correspondence you write to us directly — Resend only sends automated account messages that Supabase Auth triggers.

5. Local-First Architecture

• On-device storage: All prompts are stored in a local database on your device. The app does not encrypt that database; API keys are kept separately in secure device storage (section 3).
• BYOK model: Your AI requests go directly from your device to OpenAI or Anthropic — they do not pass through our servers.
• Offline-first: The local vault, search, and templates function fully without an internet connection; AI features, Cloud Sync, Team Vaults, and community features need one.
• No tracking: We do not include analytics SDKs, advertising SDKs, or behavioral tracking.

6. Third-Party Services

• OpenAI / Anthropic — when you send prompts using your API key. Their privacy policies govern this data.
• Supabase — cloud database, EU-hosted, for optional sync, monthly AI budget limits (section 4.1), and for AI-response reports (section 4.7).
• Google Play / RevenueCat — for purchase processing.
• Cloudflare — website hosting and DNS.
• Apple iCloud Mail — for support correspondence.
• Resend — transactional account email triggered by Supabase Auth (for example confirmation or password recovery, depending on which flow is enabled); see section 4.8.

7. Data Retention

• Local data: retained until you uninstall the app or delete it manually.
• Cloud account data: retained until you delete your account.
• AI-response reports: stored as a row in our active Supabase database, linked to your account; when your account deletion succeeds, that row is deleted from the active database (see below).
• Support emails: retained while needed to handle the request and, where applicable, related disputes or legal obligations.
• Accounting documents: we use inFakt for accounting. Documents subject to legal retention duties may remain after account deletion for the period required by applicable law, depending on the type of document. They are separate from the subscription/entitlement records in RevenueCat and our database, which we delete or request erasure of when you delete your account (see below).
• Account emails sent via Resend (section 4.8): message content and delivery logs are retained by Resend for a standard 30 days.

Deleting your account. You can delete your account at any time, directly in the mobile app: Settings → Account → Delete account. This also requests erasure of your subscriber record with RevenueCat, the purchase-management service we use for subscriptions, which processes that request asynchronously on their side. When your account deletion succeeds, we remove your account, synced prompts, knowledge base documents, team memberships, AI-response reports, and subscription record from our active database. The app then clears the data stored locally on the device you deleted from; if that step is interrupted, it shows a recovery screen so you can complete it. Local copies on other devices, or in backups you made yourself, may remain until you remove them there. Instructions and an alternative request channel are available at promptsecure.app/delete-account. Deleting your account does not cancel a Google Play subscription — cancel it separately in Google Play.

8. Your Rights (GDPR)

If you are in the EEA, you have the right to access, rectify, erase, and port your data. The app provides a built-in JSON export for portability; this export is a plain, readable file that the app does not encrypt, so store and share it carefully. To exercise any right, contact hello@promptsecure.app. We respond within 30 days.

8.1 Legal Bases for Processing

We rely on the following legal bases under the GDPR for the processing described in section 4, depending on the purpose:

• Performance of a contract (Art. 6(1)(b) GDPR) — account creation and authentication, Cloud Sync, Team Vaults and community features you activate, and fulfilling your Premium entitlement after a purchase.
• Performance of a contract or your request (Art. 6(1)(b) GDPR) — handling support correspondence you send us.
• Legitimate interests (Art. 6(1)(f) GDPR) — security, fraud and abuse prevention, handling AI-response reports you submit, and defending against legal claims. We consider these interests proportionate to the limited data involved and balanced against your rights.
• Legal obligation (Art. 6(1)(c) GDPR) — retaining accounting and tax documents for the period required by Polish law.

Some features are optional and activated only by your own action, such as Team Vaults, community publishing, and Smart Context. Where we ask for your explicit opt-in before an optional feature processes additional data, that processing relies on your consent (Art. 6(1)(a) GDPR), and you can withdraw it at any time with future effect by turning the feature off or not using it again; this does not apply to processing we carry out on a contractual or legal basis as listed above.

8.2 What You Must Provide, and What Happens If You Don't

The local mobile vault, templates, and search work without any account or personal data. An email address and password are required only if you choose to create an account; without them, Cloud Sync, Team Vaults, community features, and Premium purchase fulfillment are not available, but the local app continues to work. We do not require any personal data to use the local-only features.

8.3 Your Rights in Full

If you are in the EEA or another jurisdiction with equivalent protections, you have the right to:

• Access the personal data we hold about you.
• Rectify inaccurate or incomplete data.
• Erase your data (see section 7 for how account deletion works in practice).
• Restrict our processing of your data in certain circumstances.
• Object to processing based on our legitimate interests, on grounds relating to your particular situation.
• Port your data to another provider in a structured, machine-readable format — see the in-app JSON export described above.
• Withdraw consent at any time where processing is based on consent, as described in 8.1.

To exercise any of these rights, contact hello@promptsecure.app. We respond within 30 days. If you believe our processing does not comply with the GDPR, you also have the right to lodge a complaint with a supervisory authority. In Poland, this is the Urząd Ochrony Danych Osobowych (UODO, the President of the Personal Data Protection Office), or the supervisory authority of your own EEA country of residence or work.

9. Data Security

• API keys encrypted in secure device storage using keys managed by Android's Keystore (hardware backing varies by device); in the Chrome extension, in extension-isolated local storage (see section 3)
• Cloud data encrypted in transit (TLS) and at rest
• Row-level security on all database tables
• Biometric authentication and PIN lock supported

10. Children's Privacy

Prompt Secure is intended for users aged 18 and over and is not directed at children. We do not knowingly collect data from anyone under 18. Contact us immediately at hello@promptsecure.app if you believe a child has provided personal information.

11. Changes to This Policy

Material changes will be communicated via a notice in the application or on our website. The effective date above reflects the most recent revision.

12. Contact

Nexum
ul. Kolejowa 2C lok. 9, 95-050 Konstantynów Łódzki, Poland
Email: hello@promptsecure.app