What we collect, and why

What we store

• Your email address. If you signed in with Google, we ask Google for your email and nothing else — not your contacts, calendar, or files. If you created a password instead, it is stored as a hash by Supabase, our authentication provider, and never reaches this application in a form anyone here could read.
• Every prompt you generate — what you typed, what came back, and which platform you chose. That is what your library is.
• How many credits you have left, and if you subscribe, your Stripe customer and subscription IDs.
• How you found us. If you arrived from an advertisement or a link on another site, we record which one — the campaign tags in the address, the site you came from, and the advertising network’s click identifier if there is one. It is written once when your account is created and never updated. We keep it so we can tell which ways of reaching people are worth paying for, and it is stored against your account rather than sold or shared.

Cookies

Two are ours. One keeps you signed in. The other, set only if you arrive from an advertisement or an external link, remembers which one for ninety days so it can be recorded against your account if you sign up. Neither is readable by any other site.

We also run Google Ads conversion tracking, which sets cookies of its own and tells Google when an account is created and when a subscription starts, so we can tell which advertisements are worth paying for. Google receives the amount of a subscription and, for either event, a one-way reference to it — never your email address, never your account identifier itself, and nothing you typed into PromptGame. Page visits are counted separately by Vercel Web Analytics, which uses no cookie and collects nothing identifying.

When we are advertising on Facebook or Instagram, we run the same conversion tracking through Meta, and it is worth stating plainly that Meta receives more than Google does. It sets cookies of its own, and when an account is created or a subscription starts we send Meta a scrambled, one-way form of your email address, your IP address and your browser’s user agent, together with the amount of a subscription. Those identifiers are what let Meta recognise that the person who clicked an advertisement is the person who signed up. We never send your email address in a readable form, never your account identifier itself, and never anything you typed into PromptGame. While no Meta campaign is running, none of it loads and nothing is sent.

What we never see

Card details. Payment is handled entirely by Stripe’s hosted checkout — the numbers you type there never pass through PromptGame, and we could not store them if we wanted to. We receive only a customer ID and whether the subscription is active.

Who else sees it

• OpenAI processes the text you submit in order to write the prompt. We send those requests with storage disabled, so OpenAI does not retain the conversation.
• Supabase hosts the database your account and library live in.
• Stripe handles payment and billing.

We do not sell your data, and we do not use your prompts to train anything.

Deleting things

Any saved prompt can be deleted from your library, and deletion is immediate and permanent. To delete your whole account and everything in it, email us and we will do it.