1.Who we are#
PromptAbide (“PromptAbide”, “we”, “us”) is a website and browser extension for sharing AI prompts together with the results they produced, plus questions, answers and articles about working with AI. This policy explains how we handle personal data when you use www.promptabide.com, our API and the PromptAbide browser extension (together, the “service”).
We are the controller of your personal data (the “Data Fiduciary” under India’s Digital Personal Data Protection Act 2023). That means we decide why and how it is used.
- Operator
- PromptAbide
- Based in
- Noida, Uttar Pradesh, India
- Privacy contact (DPO role)
- hello@promptabide.com
- Grievance Officer
- The PromptAbide team · hello@promptabide.com
2.The short version#
- We collect what we need to run your account and the community: your account details, what you post, and basic device and security data.
- We do not sell your personal data, we do not share it for advertising, and we do not use advertising trackers or third-party analytics. Our own measurement of which links bring people here is tied to you only if you opt in.
- We use a small set of service providers (hosting, database, media storage, email, push notifications, sign-in and optional AI suggestions). Most are in the United States.
- What you publish publicly is public: anyone, including search engines and AI assistants, can read and copy it.
- You can download your data, fix it, or delete your account from Settings → Privacy & data, or by emailing hello@promptabide.com.
- You must be 18 or older to use PromptAbide.
3.What we collect#
We only collect data you give us, data created when you use the service, and data a sign-in provider sends us when you choose to sign in with it.
| Category | What it includes | Where it comes from |
|---|---|---|
| Account | Email address, username, name, profile picture, sign-in provider and provider account ID, a hashed password (only if you use a password), account role and status | You, or Google / GitHub when you sign in with them |
| Profile (optional) | Bio, location, website, cover image and whether your profile is private. The database has fields for phone number, date of birth, gender and address, but we do not collect them. | You |
| Devices and sessions | Device ID, device name and type, full browser user agent, IP address and last sign-in time for each signed-in browser or extension | Your browser, automatically |
| Activity log | Security and account events: sign-ins, sign-outs, publishing, likes, follows and profile changes, each with IP address and user agent | Created when you use the service |
| Push notifications | Firebase push token, a random install ID, user agent, platform and timestamps | Your browser, only if you turn notifications on |
| Content | Bides (prompts, example inputs, variables, outputs, “why it works” notes), questions, answers, comments, articles and uploaded images or video | You |
| Interactions | Likes, dislikes and votes; views, copies and shares (counted in aggregate); follows; saved items and your private notes on them | Created when you use the service |
| Notifications | Notifications we send you and your notification preferences | Created when you use the service |
| Reports and messages | Reports you submit about content, and messages you send through the contact form or by email | You |
| Consent records | Which version of the Terms and Privacy Policy you accepted, when, and the IP address and user agent at that moment | Created when you agree |
| Visits and campaigns | When you arrive on the site: the referring site’s domain, campaign tags on the link (such as utm_source), the page you landed on, and device type, browser and operating system. No IP address is stored with it. Only if you switch Analytics on: a random browser ID, and a link from those visits to your account, including which campaign your sign-up came from. | Your browser, automatically; the browser ID and account link only with your consent |
| Announcement receipts | Which site announcements you were shown while signed in, how many times, and whether you acknowledged, dismissed or followed them | Created when you use the service |
| Extension captures | The prompt, output and media on an AI tool’s page that you choose to capture and publish | You, through the extension (see The browser extension, below) |
We do not collect payment data: no paid features are currently offered. We do not use third-party analytics tools, advertising pixels or third-party tracking cookies; the visit and campaign measurement above is our own and is not shared with anyone. See the Cookie Policy for the few cookies and storage items we do use.
4.Why we use it, and our legal basis#
Data protection laws require a legal reason (a “lawful basis”) for each use. Under the EU and UK GDPR, these are the Article 6(1) bases shown below. Under India’s DPDP Act 2023, we rely on your consent, given when you create an account and when you turn on optional features, and on the legitimate uses in Section 7 of the Act, such as data you give us voluntarily for a stated purpose and compliance with law.
| Purpose | Data used | Lawful basis (GDPR) |
|---|---|---|
| Create and run your account, sign you in, keep you signed in | Account, devices and sessions | Contract (Art. 6(1)(b)) |
| Publish, display and let others interact with your content | Content, interactions, profile | Contract (Art. 6(1)(b)) |
| Build your feed and trending lists from public engagement | Interactions, follows, content | Contract (Art. 6(1)(b)); legitimate interests (Art. 6(1)(f)) |
| Send account emails (verification, password reset, security alerts) | Email, name | Contract (Art. 6(1)(b)) |
| Send push notifications you turned on | Push data, notification preferences | Consent (Art. 6(1)(a)); you can withdraw it at any time |
| Optional AI suggestions when you ask for one | The draft text you send | Contract (Art. 6(1)(b)), because you request the feature |
| Keep the service secure, detect abuse and fraud, let you see and sign out your devices | Devices, activity log, IP address, user agent | Legitimate interests (Art. 6(1)(f)) |
| Moderate content and handle reports and grievances | Content, reports, account | Legitimate interests (Art. 6(1)(f)); legal obligation (Art. 6(1)(c)) |
| Keep logs and registration records the law requires; answer lawful requests from authorities | Logs, minimal registration record | Legal obligation (Art. 6(1)(c)) |
| Record your agreement to our Terms and this policy | Consent records | Legal obligation (Art. 6(1)(c)) and legitimate interests (Art. 6(1)(f)) |
| Remember your preferences, such as theme and sidebar | Preference storage | Consent, through the cookie banner |
| Count visits by referring site and campaign, without identifying anyone | Visits and campaigns (no browser ID, no account link) | Legitimate interests (Art. 6(1)(f)) |
| Attribute your visits and sign-up to the link or campaign that brought you | Visits and campaigns, browser ID, account | Consent, through the cookie banner (Analytics); you can withdraw it at any time |
| Tell you about new features and changes, and know that you have seen them | Announcement receipts | Legitimate interests (Art. 6(1)(f)) |
| Tell search engines about new public pages (IndexNow) | Public page URLs only | Legitimate interests (Art. 6(1)(f)) |
| Answer your messages | Contact messages, email | Legitimate interests (Art. 6(1)(f)) |
Where we rely on legitimate interests, our interests are running a safe, working community and protecting our users and the service. We have weighed these against your rights, and you can object at any time (see Your rights).
Automated decisions. We rank feeds and trending lists automatically from public engagement signals. We do not make decisions based solely on automated processing that have legal or similarly significant effects on you.
5.Public content#
PromptAbide exists so people can find, copy and reuse prompts. Anything you publish publicly (your bides, questions, answers, comments, articles, public profile, username and profile picture) can be seen, copied and shared by anyone, indexed by search engines, and read by AI assistants and other automated agents. We cannot control copies made by others. Please do not put personal data, confidential information or secrets such as API keys in content you publish.
If you make your profile private, or save an item with a private note, that information is only shown to you.
6.AI features#
When you ask for an AI suggestion, such as a title, topics, keywords or a rewrite of your draft, we send the text of your draft to Google’s Gemini API to generate it. We only send the text needed for the suggestion you asked for, and only when you ask. Suggestions are labelled as AI-generated, and nothing is published until you choose to.
What this means for your draft
Google processes the text to produce the suggestion. Depending on the service tier we use, Google may also use inputs to improve its products, and they may be reviewed by people. Do not include personal data or anything confidential in text you send for a suggestion.
We do not train AI models on your data, and we do not sell or license your content to AI companies. Public pages can still be read by AI crawlers and assistants, like any other public web page.
8.International transfers#
We are based in India, and most of our service providers store or process data in the United States and other countries. This means your data may be processed in a country other than yours, where data protection law may differ.
- From the EU, EEA, UK and Switzerland: where the law requires a transfer safeguard, we rely on our providers’ data processing agreements that include the European Commission’s Standard Contractual Clauses (with the UK Addendum where relevant), or on the EU-US Data Privacy Framework where a provider is certified. You can ask us for a copy of the relevant safeguards.
- From India: the DPDP Act 2023 allows transfers outside India except to countries the Government of India restricts. We will stop any transfer that becomes restricted.
9.How long we keep it#
We keep personal data only as long as we need it for the purposes above, or as long as the law requires. Automated jobs delete or anonymise data on the schedule below.
| Data | How long |
|---|---|
| Account and profile | While your account exists. Deleted when your account is deleted (after a 30-day grace period). |
| Minimal registration record (user ID, a hash of your email, account dates) | 180 days after your account is deleted, then purged. Required by India's IT Rules 2021. |
| Content you post (bides, questions, answers, comments, articles, media) | Until you delete it or your account is deleted. |
| Activity log (sign-ins, posts, likes, follows, profile changes) | IP address and browser details are removed after 180 days. The event itself is kept while your account exists. |
| Devices and sessions | Deleted after 12 months without use, when you sign a device out, or when your account is deleted. |
| Visit and campaign records (referring site, campaign tags, landing page, device type) | The link to your browser ID and account is removed after 180 days; the anonymous record is deleted after 13 months. The campaign your sign-up came from is kept while your account exists. |
| Announcement receipts (which site announcements you were shown and what you clicked) | Until the announcement is deleted or your account is deleted. |
| Push subscriptions | Deleted when you turn notifications off, or 60 days after the token stops working. |
| Accounts never verified | Deleted 30 days after sign-up. |
| Password reset and verification links | Until used or expired. |
| Consent records (document versions, time, IP address, browser) | While your account exists, and 180 days after it is deleted, so we can show what you agreed to. |
| Reports and moderation records | Until the report is resolved and up to 24 months afterwards; longer only if a legal claim or order needs it. |
| Contact form and email correspondence | As long as needed to answer you, and up to 24 months afterwards. |
| Server and security logs | 180 days, as required by India's CERT-In Directions 2022. |
| Encrypted database backups | About 3 months (the 12 most recent weekly backups). Deleted data can remain in a backup until that backup rolls off. |
10.Your rights#
Most rights can be used directly in the app. Go to Settings → Privacy & data to download a copy of your data (a JSON export), delete your account, deactivate it, or sign out other devices. You can edit your profile and content at any time, change notification settings, and change your cookie choices from the footer. For anything else, email hello@promptabide.com. We may need to confirm your identity, normally by asking you to write from the email address on your account.
Everyone
Wherever you live, you can access, correct, download and delete your data, withdraw consent, and complain to us. We respond within 30 days, and sooner where a law sets a shorter time.
India (DPDP Act 2023)
- Access: a summary of the personal data we process about you, what we do with it, and who we have shared it with.
- Correction, completion, updating and erasure of your personal data.
- Withdraw consent at any time, as easily as you gave it. This does not affect processing already done.
- Grievance redressal: complain to our Grievance Officer (see the Grievance Redressal page). If you are not satisfied, you can then complain to the Data Protection Board of India.
- Nominate another person to use your rights if you die or become unable to use them. Email us with the nominee’s name and contact details.
EU, EEA and UK (GDPR / UK GDPR)
- Access your data and receive a copy.
- Rectification of inaccurate data.
- Erasure (“right to be forgotten”).
- Restriction of processing in certain cases.
- Portability: receive the data you gave us in a machine-readable format (our JSON export).
- Objection to processing based on legitimate interests.
- Withdraw consent at any time where we rely on it.
- Complain to your local data protection supervisory authority. We would appreciate the chance to help first.
California and other US states
- Know what personal data we collect, use and disclose, and get a copy of it.
- Delete and correct personal data.
- Opt out of sale or sharing. We do not sell or share personal data, so there is nothing to opt out of, but we still honour opt-out requests.
- Global Privacy Control (GPC): we treat a GPC signal from your browser as a valid opt-out request, and our cookie banner treats it as “reject non-essential”.
- Sensitive personal information: the only sensitive item we hold is your account login (a hashed password or sign-in provider link), used only to sign you in.
- Non-discrimination: we will not treat you differently for using any of these rights.
- You can use an authorised agent. We will ask for proof of their authority and may ask you to confirm your identity.
11.Children#
PromptAbide is for adults. You must be 18 or older to create an account. We do not knowingly collect personal data from anyone under 18, and the service is not directed at children under 13 (as defined by the US Children’s Online Privacy Protection Act). If you believe a child has given us personal data, email hello@promptabide.com and we will delete the account and its data.
12.The browser extension#
The PromptAbide extension helps you publish a prompt from inside the AI tool you used. In short: it reads the prompt, output and media on a supported AI tool’s page only when you use it to capture; it checks the capture on your device for API keys (which it blocks) and personal data (which it warns about); and nothing is published until you press Publish. When AI suggestions are available, opening the share sheet sends the captured text to the PromptAbide API, which passes it to Google Gemini to suggest a title and details. It signs in by reusing your website session and appears as a device in your account. It sends no analytics.
What the extension sends, and how we use it, is set out in the Extension Privacy Policy.
13.Security#
We use reasonable security practices appropriate to the data we hold, including encryption in transit (HTTPS), one-way hashing of passwords, access controls on our systems and providers, private and encrypted backups, and logging to detect misuse. No system is perfectly secure, so please use a strong, unique password or sign in with Google or GitHub, and sign out devices you no longer use.
Read more, or report a vulnerability, on our Security page.
14.If there is a data breach#
If a personal data breach affects you, we will tell you without undue delay, explaining what happened, what data was involved, what we are doing and what you can do. We will also notify the authorities where the law requires it, including the Data Protection Board of India and CERT-In in India, and the relevant supervisory authority within 72 hours in the EU and UK.
15.Changes to this policy#
We will update this policy when our practices change. The version and “Last updated” date at the top show the current one. If a change is significant, we will tell you in the app or by email before it takes effect and, where needed, ask you to agree again.
16.Contact us#
- Privacy requests
- hello@promptabide.com
- Grievance Officer
- The PromptAbide team · hello@promptabide.com
- General questions
- hello@promptabide.com
- Postal address
- Noida, Uttar Pradesh, India
Other policies: Cookie Policy, Terms of Service, Data Deletion. Storage names such as promptabide_auth are explained in the Cookie Policy.