Privacy Policy

Effective: July 20, 2026 · Personal / MVP project

This Privacy Policy explains what personal data My Personal Prompt Engineer collects, how it is used, who processes it, and what rights you have. We operate this Service as a personal project at mypersonalpromptengineer.com; there is no registered company at this stage.

Short version: We collect your Google account name and email to log you in. We log which optimization tier you use (not your prompt text). Your prompt text is sent to OpenAI for processing but is not stored in our database. Your session history lives only in your browser.

1. Data We Collect

Data you provide via Google Sign-In (OAuth 2.0):

Email address
Display name
Profile picture URL (provided by Google)

We use Google OAuth via Supabase Auth. Google transmits these fields to us upon successful authentication. We do not receive or store your Google password.

Usage logs we record:

Which optimization tier you selected (Fast, Pro, or Master) and the timestamp of each request — linked to your user ID.
We do not log the content of your input prompts or the AI-generated outputs in our database.

Data collected automatically by infrastructure:

IP address & request metadata (browser type, operating system, referring URL, request timestamps) — recorded by our server and by Supabase's infrastructure as a standard part of operating any web service. This data may be retained in server logs for up to 90 days for security and debugging purposes.
Google's own data collection: When you sign in with Google, Google processes authentication data according to Google's Privacy Policy. We have no control over what Google collects on its own infrastructure.

Data we explicitly do NOT collect:

Payment or billing information (no payments at this stage).
The text content of your prompt inputs or AI outputs (not stored server-side).
Sensitive personal data (health, biometric, financial account details, etc.).

2. Cookies & Local Storage

We use a mix of essential browser storage (required for the Service to function) and optional analytics cookies (active only after you opt in via the cookie banner). We do not use advertising cookies, remarketing pixels, or fingerprinting tools of any kind.

Essential — always active, cannot be disabled without breaking the Service:

Authentication session (Supabase Auth — localStorage): Supabase stores your session token (a signed JWT) in your browser's localStorage to keep you signed in across page refreshes.
Session History (localStorage): Prompts and AI-generated outputs shown in the "Session History" panel are stored in your browser's localStorage, scoped to your account and capped at the most recent 20 entries. This data never leaves your device — we have no access to it — and persists until you clear it yourself or sign into a different account on the same browser.
In-progress draft (localStorage): If you start typing a prompt before signing in, it is held in localStorage just long enough to restore it after you return from Google's sign-in flow, then cleared.
Cookie preference (localStorage): Your Accept/Reject choice below is itself stored in localStorage so we don't ask you again on every visit.

Optional — active only if you accept the cookie banner:

Google Analytics 4: We use GA4 to understand aggregate usage (which pages are visited, approximate device/browser type, general region derived from IP) so we can improve the Service. GA4 never sees your prompt text or AI outputs — those are never sent to Google. We use Google Consent Mode: analytics cookies are set only after you click "Accept" on the cookie banner. If you decline or haven't answered yet, Google may still receive an anonymous, cookie-less signal used only for aggregate statistical modeling — never for identifying you individually.

You can change your analytics choice at any time via the Cookie Preferences link in the footer of any page.

3. How We Use Your Data

Authentication: Email and name are used to create and identify your account.
Service operation: Your access token is verified on every API request to confirm you are a signed-in user.
Usage analytics: Aggregate tier usage logs, and (if you've opted in) Google Analytics, help us understand which features are used, detect abuse, and improve the Service.
Security: Server logs (IP, request metadata) are used to investigate suspicious activity.

We do not use your data for advertising, profiling, or any purpose other than operating the Service.

4. OpenAI — Text Processing

When you submit a prompt, its text is transmitted over an encrypted HTTPS connection to our server, which forwards it to OpenAI's API for processing. OpenAI processes this text according to its own Privacy Policy and Usage Policies. We do not store the prompt text in our database after the response is returned to your browser.

By using the Service you acknowledge and consent to your prompt text being processed by OpenAI in this manner. Do not submit prompts containing sensitive personal data, confidential information, trade secrets, or any information you would not be comfortable sharing with OpenAI.

5. Third-Party Services

Service	Purpose	Data Involved
Supabase	Auth & database hosting	Email, name, avatar URL, usage logs, IP (via server)
Google (OAuth)	Authentication identity provider	Email, name, profile picture (sent by Google on sign-in)
OpenAI	AI prompt processing	Prompt text (in transit only; not stored in our DB)
Google Analytics 4	Aggregate usage analytics (opt-in only)	Pages visited, device/browser type, approximate region — never prompt content

6. Data Retention

Account data (email, name): retained while your account exists, plus up to 90 days after deletion.
Usage logs (tier, timestamp): retained for up to 24 months, then deleted.
Server / IP logs: up to 90 days for security purposes.
Prompt text: not stored in our database; cleared from your browser automatically on tab close.

7. Your Rights & Data Deletion

Regardless of where you are located, you may contact us at any time to:

Access the personal data we hold about you.
Correct inaccurate data.
Delete your account and all associated data — we will remove your email, name, and usage logs within 30 days of your verified request.
Restrict or object to certain processing of your data.

To make a request, email mypersonalpromptengineer@gmail.com from the address associated with your account, with the subject line "Data Request — [your email]". We will respond within 30 days.

EU/EEA users (GDPR): The rights above correspond to Arts. 15–22 of the General Data Protection Regulation. You also have the right to lodge a complaint with your local data protection supervisory authority if you believe we have not handled your data lawfully.

California residents (CCPA/CPRA): The rights above satisfy your rights under the California Consumer Privacy Act. We do not sell or share your personal information for cross-context behavioural advertising.

8. Security

All data is transmitted over HTTPS. Authentication is handled by Supabase, which issues short-lived signed JWTs and applies Row Level Security policies so each user can only access their own records. We follow reasonable industry-standard security practices, but no system is perfectly secure and we cannot guarantee the absolute security of your data.

9. Children

The Service is not directed at children under 13. We do not knowingly collect personal information from anyone under 13. If you believe a child has created an account, contact us at mypersonalpromptengineer@gmail.com and we will delete it promptly.

10. Changes to This Policy

We may update this policy as the project evolves. We will post the revised version at mypersonalpromptengineer.com/privacy-policy with an updated effective date. Continued use of the Service after the revised date constitutes acceptance.

11. Contact

Privacy questions or data requests: mypersonalpromptengineer@gmail.com