Privacy Policy

Effective: April 18, 2026 · Personal / MVP project

This Privacy Policy explains what personal data My Personal Prompt Engineer collects, how it is used, who processes it, and what rights you have. We operate this Service as a personal project at mypersonalpromptengineer.com; there is no registered company at this stage.

Short version: We collect your Google account name and email to log you in. We log which optimization tier you use (not your prompt text). Your prompt text is sent to OpenAI for processing but is not stored in our database. Your session history lives only in your browser.

1. Data We Collect

Data you provide via Google Sign-In (OAuth 2.0):

Email address
Display name
Profile picture URL (provided by Google)

We use Google OAuth via Supabase Auth. Google transmits these fields to us upon successful authentication. We do not receive or store your Google password.

Usage logs we record:

Which optimization tier you selected (Fast, Pro, or Master) and the timestamp of each request — linked to your user ID.
We do not log the content of your input prompts or the AI-generated outputs in our database.

Data collected automatically by infrastructure:

IP address & request metadata (browser type, operating system, referring URL, request timestamps) — recorded by our server and by Supabase's infrastructure as a standard part of operating any web service. This data may be retained in server logs for up to 90 days for security and debugging purposes.
Google's own data collection: When you sign in with Google, Google processes authentication data according to Google's Privacy Policy. We have no control over what Google collects on its own infrastructure.

Data we explicitly do NOT collect:

Payment or billing information (no payments at this stage).
The text content of your prompt inputs or AI outputs (not stored server-side).
Sensitive personal data (health, biometric, financial account details, etc.).

2. Cookies & Local Storage

We use essential functional cookies and browser storage only — no advertising or tracking cookies of any kind. Specifically:

Authentication session (Supabase Auth — localStorage): Supabase stores your session token (a signed JWT) in your browser's localStorage to keep you signed in across page refreshes. This is strictly necessary for the Service to function and cannot be disabled without breaking authentication.
Session History (sessionStorage): Your input prompts and AI-generated outputs shown in the "Session History" panel are stored in your browser's sessionStorage. This data never leaves your device, is not sent to our servers, and is automatically deleted when you close the browser tab. We have no access to it.

We do not use third-party analytics scripts, advertising pixels, or fingerprinting tools at this stage.

3. How We Use Your Data

Authentication: Email and name are used to create and identify your account.
Service operation: Your access token is verified on every API request to confirm you are a signed-in user.
Usage analytics: Aggregate tier usage logs help us understand which features are used and detect abuse.
Security: Server logs (IP, request metadata) are used to investigate suspicious activity.

We do not use your data for advertising, profiling, or any purpose other than operating the Service.

4. OpenAI — Text Processing

When you submit a prompt, its text is transmitted over an encrypted HTTPS connection to our server, which forwards it to OpenAI's API for processing. OpenAI processes this text according to its own Privacy Policy and Usage Policies. We do not store the prompt text in our database after the response is returned to your browser.

By using the Service you acknowledge and consent to your prompt text being processed by OpenAI in this manner. Do not submit prompts containing sensitive personal data, confidential information, trade secrets, or any information you would not be comfortable sharing with OpenAI.

5. Third-Party Services

Service	Purpose	Data Involved
Supabase	Auth & database hosting	Email, name, avatar URL, usage logs, IP (via server)
Google (OAuth)	Authentication identity provider	Email, name, profile picture (sent by Google on sign-in)
OpenAI	AI prompt processing	Prompt text (in transit only; not stored in our DB)

6. Data Retention

Account data (email, name): retained while your account exists, plus up to 90 days after deletion.
Usage logs (tier, timestamp): retained for up to 24 months, then deleted.
Server / IP logs: up to 90 days for security purposes.
Prompt text: not stored in our database; cleared from your browser automatically on tab close.

7. Your Rights & Data Deletion

Regardless of where you are located, you may contact us at any time to:

Access the personal data we hold about you.
Correct inaccurate data.
Delete your account and all associated data — we will remove your email, name, and usage logs within 30 days of your verified request.
Restrict or object to certain processing of your data.

To make a request, email mypersonalpromptengineer@gmail.com from the address associated with your account, with the subject line "Data Request — [your email]". We will respond within 30 days.

EU/EEA users (GDPR): The rights above correspond to Arts. 15–22 of the General Data Protection Regulation. You also have the right to lodge a complaint with your local data protection supervisory authority if you believe we have not handled your data lawfully.

California residents (CCPA/CPRA): The rights above satisfy your rights under the California Consumer Privacy Act. We do not sell or share your personal information for cross-context behavioural advertising.

8. Security

All data is transmitted over HTTPS. Authentication is handled by Supabase, which issues short-lived signed JWTs and applies Row Level Security policies so each user can only access their own records. We follow reasonable industry-standard security practices, but no system is perfectly secure and we cannot guarantee the absolute security of your data.

9. Children

The Service is not directed at children under 13. We do not knowingly collect personal information from anyone under 13. If you believe a child has created an account, contact us at mypersonalpromptengineer@gmail.com and we will delete it promptly.

10. Changes to This Policy

We may update this policy as the project evolves. We will post the revised version at mypersonalpromptengineer.com/privacy-policy with an updated effective date. Continued use of the Service after the revised date constitutes acceptance.

11. Contact

Privacy questions or data requests: mypersonalpromptengineer@gmail.com