Privacy Policy

This policy explains how PromptStock ("we", "us") handles personal data when you visit the site or use the service. For the purposes of India's Digital Personal Data Protection Act, 2023 we are the Data Fiduciary for that data; under the GDPR we are the data controller.

It does not cover third-party sites you reach from here, or the model providers you connect to using your own API key — those are governed by their own policies.

Account data. Your name, email address, and a securely hashed password. If you sign in with Google or GitHub, we receive your name, email address, and provider account identifier instead — never your password for those services.

Prompt data. The prompts you submit, the enhanced output returned to you, and the settings used to produce it, such as your chosen target tool. This is the content that makes your history and saved prompts work. Enhancing requires an account, so every prompt you submit is associated with yours.

Usage data. Counts of enhancements against your daily quota, plan status, and timestamps. We need these to enforce limits and to bill correctly.

Billing data. Your plan, subscription status, and the identifiers our payment providers give us. We never receive or store your full card number, UPI PIN, or bank credentials — those go directly to the payment provider.

Technical data. IP address, browser and device information, and server logs, collected when you make requests. These are used for security, rate limiting, and diagnosing faults.

Bring-your-own-key credentials. If you choose to supply your own model provider API key, it is encrypted at rest and used only to route your own enhancements. It is never logged or shown back to you in full.

PromptStock lets you supply your own API key for a model provider such as Cerebras, Google Gemini, OpenRouter or Anthropic, so that your enhancements run on your account with that provider rather than ours. This is optional. If you never add a key, this section does not apply to you.

Because a provider API key is a credential that can incur charges on your account, we set it out separately here rather than treating it as ordinary account data.

How we hold it. The key is encrypted before it is written to our database, using authenticated encryption with a key held only in our server environment. It is never stored in plain text, never written to logs, and never sent to your browser after you save it — the settings page shows only the last four characters so you can tell which key is which.

What we use it for. Only to authenticate your own enhancement requests to the provider you supplied it for. We do not use it for other users, for our own workloads, or for anything unrelated to the request you made.

When we delete it. Removing a key in settings deletes our copy immediately. Deleting your account deletes any stored keys with it. There is no archive copy and no recovery.

What we cannot do. We cannot show you the key again, and if our encryption key is ever rotated, existing stored keys become permanently unreadable — the settings page will show them as unreadable and you will need to enter the key again. Removing a key from PromptStock does not revoke it at the provider. If you believe a key has been exposed, revoke it in the provider's own dashboard; that is the only action that actually invalidates it.

Your relationship with the provider. When you use your own key, your prompts are sent to that provider under your own account and agreement with them. Their terms, privacy policy, retention practices, and charges apply to that usage, and we are not a party to that agreement. We act only as a custodian of the credential you gave us.

Where the provider supports scoped, restricted, or spend-capped keys, we recommend supplying one of those rather than a key with full access to your account.

We use personal data to:

• provide the service — producing enhancements and storing your history and saved prompts;
• operate accounts, authenticate you, and keep sessions active;
• enforce quotas, rate limits, and our cost controls;
• take payment and manage subscriptions;
• detect, investigate, and prevent abuse, fraud, and security incidents;
• diagnose faults and improve reliability and performance;
• send service messages such as email confirmation, password resets, and billing notices.

We do not sell personal data, and we do not use your prompts to train any machine learning model — ours or anyone else's.

Under the GDPR we rely on: performance of a contract, for providing the service you signed up for; legitimate interests, for security, abuse prevention, and service improvement; legal obligation, for tax and accounting records; and consent, where we ask for it specifically.

Under the DPDP Act we process personal data on the basis of the consent you give when you create an account and submit content, and for the certain legitimate uses the Act permits. You may withdraw consent at any time, as described below.

We share personal data only with service providers who process it on our behalf, under contract, and only as needed to run PromptStock:

• Model providers — the prompt text you submit is sent to a large language model provider to generate the enhancement. Providers may change as our fallback chain changes. If you have supplied your own API key, the request goes to that provider under your own account instead of ours.
• Hosting and database providers — who host the application and store your account and prompt data.
• Payment providers — Razorpay for customers in India, and a merchant of record for customers elsewhere, which acts as the seller of record for those transactions.
• Authentication providers — Google and GitHub, only if you choose to sign in with them.

We may also disclose data where we are legally required to, or where it is necessary to establish, exercise, or defend legal claims. If PromptStock is ever involved in a merger or acquisition, data may transfer as part of that transaction, and we will give notice before it becomes subject to a different policy.

Our providers may process data outside India and outside the European Economic Area. Where data leaves the EEA or the UK, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses.

Where the Indian government restricts transfers to particular countries under the DPDP Act, we will comply with those restrictions.

Account data is kept for as long as your account exists. Prompts and history are kept until you delete them or delete your account.

When you delete your account we remove your personal data within 30 days, except where we must keep records longer — billing and tax records, for example, are retained for the period Indian law requires.

Server logs are retained for a short period for security and debugging, then discarded. Backups are cycled out on a rolling schedule, so deleted data may persist briefly in backups before being overwritten.

Whichever law applies to you, you can ask us to give you a copy of your personal data, correct it if it is wrong, delete it, or restrict or object to how we use it. You can also ask for your data in a portable format, and withdraw consent where our use is based on consent.

Under the DPDP Act you additionally have the right to nominate another person to exercise your rights in the event of your death or incapacity, and the right to an accessible grievance redressal process — see the section below.

Most of these are available directly in the product: you can edit your account, delete individual prompts, and delete your account outright. For anything else, write to drackoxyz69@gmail.com and we will respond within 30 days.

If you are in the EEA or the UK and are unhappy with our response, you may complain to your local supervisory authority. In India, you may complain to the Data Protection Board once it is operational.

For complaints about how your personal data is handled, contact our Grievance Officer at drackoxyz69@gmail.com.

We will acknowledge your complaint and aim to resolve it within the period required by the DPDP Act and its rules.

We set a session cookie when you sign in. It is httpOnly, meaning scripts on the page cannot read it, and it is required for the service to know who you are — you cannot use an account without it.

We do not use advertising cookies or third-party tracking pixels. Any analytics we run is limited to aggregate, privacy-respecting measurement of how the site is used.

Passwords are stored hashed, never in plain text. Traffic is served over HTTPS. Session cookies are httpOnly and, in production, Secure. Any API key you supply for your own model provider is encrypted at rest.

No system is perfectly secure. If a breach affects your personal data, we will notify you and the relevant authorities as the DPDP Act and GDPR require.

PromptStock is not intended for children. You must be at least 18 to hold an account, and we do not knowingly collect personal data from children. If you believe a child has given us personal data, contact us and we will delete it.

We will update this policy as the service changes or the law develops. The date at the top of the page shows the current version.

For material changes we will give notice in the product or by email before they take effect.

For any privacy question, request, or complaint, write to drackoxyz69@gmail.com.