End-to-end encrypted by your password
Every Prompteu account has its own random 256-bit library key, created on your device when you sign up. Your whole library — prompts, titles, tags, collections and history — is encrypted with it using AES-256-GCM before it’s uploaded, every time you save.
We store the library key only in locked form, twice:
- locked with your password (PBKDF2-HMAC-SHA256, 310,000 iterations, random salt);
- locked with your recovery key — 32 random characters shown once at sign-up.
Your password itself never leaves your device. To sign in, your device derives a separate secret from it (PBKDF2, salted with your email) and sends only that. So what reaches us can’t unlock your library, and we can’t read your prompts.
If two devices save at the same moment, the server rejects the older write; the device pulls the latest copy, merges it and tries again, so nothing is silently overwritten.
The trade-off: we can’t unlock your prompts for you. If you forget your password, reset it by email and enter your recovery key to unlock them again. If you lose both, the saved copy can’t be opened by anyone — you can start a fresh library.
What our servers store
| Data | Readable by us? | Why we keep it |
|---|---|---|
| Your email address | Yes | To sign you in and send account emails |
| A sign-in secret derived from your password | No — stored as a salted bcrypt hash | To sign you in |
| Your library key, locked by your password and by your recovery key | No | So your devices can unlock your library |
| Your encrypted library | No — ciphertext only | Backup and sync |
| Revision number, last save time, device label (e.g. “Android · Pixel 8”) | Yes | To detect sync conflicts |
| Your password and recovery key | Never sent to us | — |
| Your AI API keys | Never sent to us | — |
On your devices
- Android: your library is encrypted at rest with a key held in the Android Keystore (hardware-backed on most phones). Your session and the unlocked library key are stored the same way, and removed when you log out. You can turn on screenshot and screen-recording blocking, and the app clears copied prompts from the clipboard after a minute.
- Web: your library is stored in your browser’s own storage for this site. API keys are stored in this browser and sent only to the AI provider you picked. The unlocked library key is kept in this browser in a form that can’t be exported. Logging out removes your prompts, the key and your API keys from the browser — do that on shared computers.
Accounts and access
- Authentication and the database run on Supabase (PostgreSQL). Every table is protected by row-level security: a signed-in user can read only their own encrypted vault, and writes go through a single audited database function.
- All traffic uses HTTPS (TLS 1.2+). The website sends strict security headers, including a content security policy and HSTS.
- Email confirmation is required for new accounts; passwords must be at least 10 characters.
AI assist
AI assist sends the prompt you’re working on directly from your device to the provider you chose (for example Anthropic, OpenAI or Google), using your own API key. It doesn’t pass through Prompteu’s servers. That provider’s terms and privacy policy apply to those requests.
No tracking
Prompteu has no analytics SDKs, no advertising IDs and no third-party trackers — in the apps or on this website.
Reporting a vulnerability
If you believe you’ve found a security issue, please email security@prompteu.com with the details and steps to reproduce. We’ll acknowledge your report within 3 working days, keep you updated, and credit you (if you’d like) once it’s fixed. Please don’t access other people’s data, disrupt the service or publicly disclose the issue before we’ve had a chance to fix it. We won’t take legal action against good-faith research that follows these rules.
Last updated 24 September 2026