Effective 24 September 2026
1. Who we are
Prompteu (the website at prompteu.com, the web app and the Android app) is operated by Craftsynk, run by Chandan Bhramarjal, Bhubaneswar, Odisha, India (“we”, “us”). We are the data fiduciary (under India’s Digital Personal Data Protection Act, 2023) and the controller (under the GDPR) for the personal data described here. Contact: privacy@prompteu.com.
2. What we collect
You can use Prompteu without an account. Then your prompts, profile name and settings stay on your device (in your browser’s storage or encrypted on your phone) and we receive nothing about them.
If you create an account
- Email address — to create your account, sign you in and send you account emails (confirmation, password reset, important service notices).
- Sign-in secret — your device turns your password into a separate sign-in secret; only that is sent, and it’s stored as a salted hash. Your actual password never reaches us.
- Locked encryption keys — your library’s key, locked with your password and with your recovery key. We can’t unlock it.
- Your encrypted library — prompts, collections, tags and history, encrypted on your device before upload with a key only your password or recovery key can unlock. We cannot decrypt it.
- Sync metadata — a revision number, the time of the last save and a device label (for example “Android · Pixel 8” or “Web · Windows”), used to keep your devices in sync.
- Technical logs — IP address, time and type of request, kept by our hosting providers for security and abuse prevention.
If you join the early-access list
Your email address and which page you signed up from.
If you contact us
Whatever you choose to send, and your email address, so we can reply.
What we don’t collect
We don’t collect the contents of your prompts, your password or recovery key, your AI API keys, your contacts, location or advertising IDs. We don’t use analytics or advertising SDKs or tracking cookies.
3. Why we use it (and our legal basis)
- To provide your account, backup and sync — because you asked us to (your consent, and performance of our agreement with you).
- To keep the service secure and prevent abuse — our legitimate interest, and legal obligations.
- To send the early-access invitation — your consent, which you can withdraw at any time.
- To answer your messages — your consent.
We don’t use your data for advertising, sell it, or use it to train AI models.
4. AI providers you connect
When you use AI assist, the prompt you’re working on is sent directly from your device to the AI provider you chose (for example Anthropic, OpenAI, Google, xAI or DeepSeek) using your own API key. That request doesn’t pass through us, and the provider’s own terms and privacy policy apply to it. When you send a prompt to an AI app or website, it’s handled by that app under its own policy.
5. Who processes data for us
| Provider | What for | Where |
|---|---|---|
| Supabase, Inc. | Account sign-in and the database that stores encrypted libraries and the early-access list | Hosted on AWS, Mumbai region (India) |
| Vercel, Inc. | Hosting this website and the web app | Global edge network |
| Our email delivery provider | Sending account and early-access emails | As listed at sign-up time |
| Google (Google Play) | Distributing the Android app | Under Google’s own policies |
These providers process data only on our instructions and under contracts that protect it. Some of them may process limited data outside India; where the GDPR applies, transfers rely on standard contractual clauses.
6. How long we keep it
- Account data and your encrypted library — until you delete your account. Deletion is immediate in our live database; copies in encrypted backups expire within 30 days.
- Early-access list — until launch invitations are sent or you ask us to remove you, whichever comes first.
- Technical logs — typically up to 30 days, depending on the provider.
- Support emails — up to 2 years after the conversation ends.
7. Your rights
Depending on where you live, you can ask to access, correct, delete or export your personal data, withdraw consent, object to or restrict processing, and (in India) nominate someone to exercise your rights. You can delete your account yourself in the app — see how to delete your account — or email privacy@prompteu.com. We’ll respond within 30 days.
Grievances: contact our grievance officer, Chandan Bhramarjal, at privacy@prompteu.com. If you’re not satisfied, you may complain to the Data Protection Board of India or, in the EU/UK, your local data protection authority.
8. Security
Your library is end-to-end encrypted, all connections use HTTPS, and access to our systems is limited and protected with multi-factor authentication. Read more on our security page. No system is perfectly secure; if a breach affecting your personal data happens, we’ll notify you and the authorities as the law requires.
9. Children
Prompteu isn’t intended for anyone under 18, and we don’t knowingly create accounts for them. If you believe a child has given us personal data, contact us and we’ll delete it.
10. Changes
If we change this policy in a meaningful way, we’ll update the date above and tell account holders by email or in the app before the change takes effect.
11. Contact
Craftsynk (Prompteu), Bhubaneswar, Odisha, India — privacy@prompteu.com