Privacy Policy

This policy explains how Prompt Pie handles information in the web app at app.promptpie.dev, the Prompt Pie hosted OAuth and MCP plugin, public and unlisted shares, and the optional local ppie companion. Prompt Pie is published by Jeremy Rojas.

Prompt Pie provides a workspace for prompts and skills. We use information to provide, secure, maintain, and support these features. We do not sell personal data or use hosted plugin inputs and outputs for advertising.

When you connect Prompt Pie to ChatGPT, Codex, or another supported client, Supabase presents the consent screen and issues OAuth tokens. The connection uses the openid scope. Prompt Pie validates the token, account ID, connected client ID, requested scope, token expiration, live grant, plan entitlement, and enabled capabilities on every hosted request. Prompt Pie does not place access tokens, refresh tokens, cookies, or authorization headers in tool results or application logs.

The hosted MCP server receives the tool call selected by the connected client and the fields listed below. It does not request, retrieve, or reconstruct your full chat history. Text from a chat reaches Prompt Pie only when the client places it in an explicit tool field such as a document title or content body.

Vercel processes standard connection data such as source IP address, request time, and browser or client information while delivering the hosted endpoint. Prompt Pie records limited operation outcomes and security metadata as described below.

The connected client sends only the fields needed for the selected action. Identifiers below refer to a canvas, document, revision, share, public link, pagination cursor, or retry key inside Prompt Pie.

• get_connection_status has no user-data input. It returns authentication status, plan state, enabled read and write capabilities, and the Prompt Pie account URL.
• list_canvases accepts an optional exact title, page limit, and cursor. It returns owned canvas IDs, titles, creation and update times, browser links, and a next-page cursor.
• list_documents accepts an optional canvas ID, exact title, prompt-or-skill kind, page limit, and cursor. It returns current owned document metadata: document, canvas, node, and revision IDs; kind; title; revision number; content hash; creation and update times; browser link; and a next-page cursor. List results omit document content.
• list_document_revisions accepts canvas and document IDs plus an optional page limit and cursor. It returns revision IDs, parent and document IDs, revision number, kind, content hash, source, creation time, and a next-page cursor. Revision lists omit titles and content.
• get_document accepts canvas and document IDs and an optional revision ID. It returns the requested prompt or skill metadata, exact title and content, and a browser link.
• create_document accepts a canvas ID, prompt-or-skill kind, title, content, and idempotency key. update_document accepts canvas, document, and expected-revision IDs; changed kind, title, or content; and an idempotency key. Both return the saved document metadata and browser link. The update result can include safe conflict details for the current revision.
• delete_document accepts canvas, document, and expected-revision IDs plus an idempotency key. restore_document_revision also accepts the source revision ID. They return document metadata, replay status, and the number of shares revoked when applicable.
• create_share accepts canvas, document, and revision IDs plus an idempotency key. get_share accepts a canvas ID and one share, public-link, or document ID. They return the pinned revision's share IDs, document and revision details, title, content, hashes, status, timestamps, and unlisted URL path.
• revoke_share accepts canvas and share IDs plus an idempotency key and returns the share's revoked status. fork_shared_document accepts a destination canvas ID, public-link ID, optional node ID, and idempotency key; it returns the new owned document, copied title and content, source provenance, and browser link.

Tool errors return a public error code and message. Rate-limit errors can include retry timing, and revision conflicts can include the current revision ID, number, and content hash. Tool results exclude internal request IDs, trace IDs, access credentials, and server logs.

Prompt Pie supports encrypted snapshot canvas and slice shares. The browser encrypts those snapshots before sending the encrypted record to the service. The decryption key is in the link fragment, which browsers do not send to the server. Anyone with the complete link can decrypt the shared content in their browser. Encrypted snapshot records currently have no automatic expiration or in-product deletion control and remain stored until Prompt Pie deletes them following a valid privacy request or operational cleanup.

Signed-in users can publish an unlisted public Pie link. People who have that URL can read the linked canvas content. The owner can turn off or delete the link in the app. Deleting the source cloud canvas removes its related published records.

Eligible signed-in users and the hosted plugin can create an unlisted link pinned to one immutable prompt or skill revision. Anyone with that URL can read its title and content while the link is active. Revocation ends public access immediately. The stored share record and pinned content remain until the source document, canvas, or account is deleted. A signed-in recipient can fork the pinned revision into a separate document they own; that copy remains under the recipient's control.

Signed-out canvases stay in the browser's local storage until you clear site data or the browser removes it. Prompt Pie does not create a cloud account for signed-out use.

Local pairing is optional and available for signed-out canvases. The browser sends requests to ppie on the loopback address of your computer. Pairing stores a non-secret browser-profile record in local storage and a temporary bearer token in session storage. Disconnecting asks the companion to revoke the session and clears the browser pairing data after confirmation. Closing the browser tab or clearing session storage removes the temporary browser token.

The web app loads Vercel Analytics and Google Analytics. A deployment with a PostHog key also sends product events and captured application errors to PostHog through the app's /ingest endpoint. These services can receive page and feature events, timestamps, browser and device information, approximate network location, cookie or browser-storage identifiers, and error details. They use this data for service operation, security, performance measurement, and product analytics. Prompt Pie currently has no in-product analytics preference center. Browser privacy controls, content blockers, and clearing site data can limit this collection. Provider-held data follows the retention settings configured for the Prompt Pie property and the provider's legal obligations; you can request deletion through the controls below.

Feedback submissions include the email address and message you enter, IP address, user agent, language and encoding headers, browser information, and submission time. Prompt Pie keeps feedback until it is resolved or you request deletion; there is currently no automatic expiration. Lemon Squeezy processes purchases and payment details and sends Prompt Pie subscription status and transaction references. Prompt Pie does not receive full payment-card numbers. Resend processes email addresses and message delivery data for transactional email. Subscription and email records remain while needed to provide the account, meet tax and legal duties, resolve disputes, and prevent fraud.

• Browser-local canvases and pairing records remain until you disconnect, clear site data, or the browser removes them. Temporary local-companion tokens remain for the browser session.
• Account, profile, cloud canvas, current document, and revision data remain while the account or owning canvas exists. Deleting a cloud canvas removes its documents, revisions, and related public records. A soft-deleted document remains recoverable in storage until its canvas or account is deleted.
• OAuth grants remain until you revoke the connected app. Token validity ends at expiration or revocation. Supabase retains authentication and grant records according to the account and security lifecycle.
• Idempotency receipts contain identifiers and hashes without title or content. They expire after 30 days and the daily cleanup normally removes them within 31 days.
• Per-account MCP rate counters contain a bucket type, count, and minute window. The daily cleanup normally removes them within 26 hours.
• Hosted request events sent to runtime logs contain outcome, HTTP status, latency, and a public error code when applicable. Runtime log retention follows the Vercel project's configured log-retention period.
• Active public and unlisted shares remain available until the owner disables or revokes them, the source is deleted, or eligibility ends. Stored document-share records remain until the source document, canvas, or account is deleted. Encrypted snapshot shares and feedback currently have no automatic expiration and can be addressed through a privacy request.
• Analytics, payment, and email providers retain information under the Prompt Pie account settings, their published policies, and legal requirements. A deletion request to Prompt Pie will be forwarded when provider-side action is needed and available.

Prompt Pie discloses information only to these recipient categories for the purposes described above:

• OpenAI and the connected ChatGPT or Codex client receive the hosted MCP outputs requested on your behalf.
• Supabase provides authentication, OAuth grants, database storage, and account services.
• Vercel provides application hosting, request logs, scheduled maintenance, and web analytics.
• Google Analytics and PostHog provide optional website and product analytics.
• Lemon Squeezy provides payment and subscription processing, and Resend provides transactional email delivery.
• People who receive a public, unlisted, or encrypted share link can access the content that link exposes.
• The Prompt Pie operator can access support submissions and limited service records when needed to answer requests, secure the service, debug failures, and meet legal duties.
• Authorities or other parties can receive information when disclosure is required by law, needed to protect rights and safety, or part of a business transfer subject to appropriate safeguards.

• Review and revoke OAuth grants under Connected Apps in Prompt Pie Settings. Revocation invalidates the connected app's active sessions and refresh tokens.
• Create, update, soft-delete, and restore hosted prompts or skills; delete cloud canvases; and revoke document-share links.
• Disable or delete a published Pie from the app.
• Disconnect ppie and clear browser local storage, session storage, and cookies through browser settings.
• Use the in-app Share Feedback control to request access, correction, export, or deletion of account, feedback, share, or analytics data. You can also open a support issue using the link below and ask for a private follow-up channel. Keep passwords, tokens, encryption keys, and private share links out of public issues.

Prompt Pie currently handles full account deletion by verified request. We may retain limited records when required for security, fraud prevention, dispute resolution, tax, or other legal obligations and will explain any applicable exception.

Prompt Pie limits hosted access to the authenticated owner, checks the live OAuth grant and plan entitlement, uses scoped database access, rate limits requests, and keeps credentials out of tool results and logs. Public and unlisted links should be treated as secrets because anyone who receives a working link can access its shared content.

We may update this policy as Prompt Pie changes. The date at the top shows the latest revision. Material changes will be reflected here before or when the changed data practice begins.