Privacy Policy

• We collect the minimum needed to run the service: your email, your name, and what you put into it.
• We do not sell your data, and we do not run advertising or third-party analytics.
• Your prompts are private until you explicitly publish them — twice, deliberately.
• Page-view counts on the marketplace are anonymous and deduplicated with a daily-rotating hash that cannot be reversed to an identity.
• You can export everything and delete your account whenever you like.

The rest of this page is the detail behind those five lines.

Prompt Share is the data controller for the personal data described here. For any privacy question or request, email support@degird.com or contact us.

There is no third-party analytics, no advertising network, no tracking pixel and no fingerprinting on this site. The public marketplace loads no external scripts, fonts or images at all — a Content Security Policy blocks them, so it is enforced rather than promised.

We do not sell, rent or trade personal data. We do not build advertising profiles or share data with data brokers.

Public pack pages show a view count. Counting it fairly needs a way to tell two visits apart without identifying anyone, so a view is deduplicated using a one-way hash of your IP address, your user-agent string, and a salt that rotates every day.

The hash is not stored against your identity, cannot be reversed, and cannot be correlated across days — yesterday’s hash of the same visitor is a different value. It exists only to stop one person refreshing a page from counting fifty times.

Copies are counted per signed-in account, because copying requires an account. Traffic from a pack’s own workspace is excluded entirely.

• Contract — account data and your content, to provide the service you asked for.
• Legitimate interests — security logging, abuse prevention, and aggregate view counts, balanced against your rights and kept minimal.
• Legal obligation — where we must retain or disclose something by law.
• Consent — for anything optional, which today is nothing; we will ask if that changes.

Only where it is necessary to run the service:

• Email delivery — our SMTP provider, to send verification, reset and invitation emails.
• Hosting — our infrastructure provider stores the database and serves the application.
• Legal — where we are required to disclose by law, or to protect rights and safety.

Anything you publish is shared with the world by definition. That is the point of publishing, and it is why the publish flow shows you every field of yours that is about to become public before you commit.

• Passwords hashed with bcrypt; API keys stored only as SHA-256 hashes.
• Session cookies are HttpOnly and, in production, Secure and SameSite-restricted.
• CSRF protection on every cookie-authenticated write.
• Rate limiting on authentication, public reads, search, downloads and counter endpoints.
• A publish-time scanner that blocks a pack containing what looks like a credential.
• Security headers including a Content Security Policy, HSTS, and frame denial.

No system is perfectly secure. If you find a vulnerability, please tell us — see reporting vulnerabilities.

Depending on where you live you may have the right to:

• Access — get a copy of your data. The export tools give you your prompts immediately, in JSON or CSV.
• Rectify — correct anything inaccurate, from your profile page.
• Erase — delete your account, which cascades to your prompts, your store and everything you published.
• Restrict or object — ask us to stop a particular processing activity.
• Portability — your export is machine-readable JSON, by design.
• Complain — to your local data protection authority.

Email support@degird.com to exercise any of these. We respond within 30 days.

Deleting your account removes your account record, your prompts and collections, your store, and unpublishes everything you had published. Backups age out on their normal cycle.

One honest limitation: content that was public may have been copied, cached or archived by third parties — search engines, archive services, or readers who downloaded it. We cannot reach into those. This is a property of publishing anything on the open web, and it is why the publish step is deliberately explicit.

The service is not directed at children under 13 (or the minimum age where you live), and we do not knowingly collect their data. If you believe a child has given us personal data, contact us and we will delete it.

Our infrastructure may process data in countries other than yours. Where data leaves the UK/EEA we rely on appropriate safeguards such as Standard Contractual Clauses or an adequacy decision.

We will update this page and the date at the top when this policy changes. For material changes affecting how we use your personal data, we will give reasonable notice.