Privacy Policy

This policy describes how Prompt Pie handles information when you use the web app at app.promptpie.dev and the optional local ppie companion. Prompt Pie is published by Jeremy Rojas.

When you use Prompt Pie while signed out, your canvas is stored in this browser's local storage. Clearing this browser's site data, using another browser profile, or losing access to the device can remove that local canvas. Prompt Pie does not create a cloud account for signed-out use.

When you choose to sign in, Prompt Pie uses Supabase for account authentication and optional cloud canvases. Cloud canvas titles and canvas content are stored with your account so they can be loaded and synced by the app. Account records include your email address and subscription-related fields. You can delete individual cloud canvases in the app. The app does not currently provide an in-product account-deletion control.

Pro users can approve an OAuth connection that lets a supported app access their cloud canvases and revisioned prompt or skill documents while Prompt Pie is closed. The consent screen shows the requesting app and its identity scope before approval. Connected Apps in Settings lists current grants and lets you revoke them.

Supabase issues and validates the connection tokens. Prompt Pie checks the signed-in account, current grant, plan access, server allowlist, and enabled read or write capability for each hosted request. Revoking a grant invalidates its sessions and refresh tokens, and the next hosted request must pass the live grant check again.

Hosted request logs and rate-limit records contain operation, outcome, timing, account or client identifiers, document identifiers, revision identifiers, and request identifiers. They exclude document titles, document content, access tokens, cookies, authorization headers, share bodies, and local paths. Expired idempotency receipts and rate counters are removed by scheduled maintenance.

Prompt Pie supports encrypted snapshot canvas and slice shares. The browser encrypts those snapshots before sending the encrypted record to the service. The decryption key is placed in the link fragment, which browsers do not send to the server. Anyone with a complete link can use it to decrypt the shared content in their browser.

Encrypted snapshot-share records do not currently have a configured expiration date or an in-product deletion control. Prompt Pie has not published a fixed retention period for those records. A lost link does not automatically delete its encrypted record.

Signed-in users can also publish an unlisted public Pie link. A published Pie exposes the linked canvas content to people who have that public URL. The publisher can turn a public link off or delete it through the app. Deleting a source cloud canvas also removes related published-artifact records through the service's database relationship.

Eligible signed-in users can create an unlisted link to one immutable prompt or skill revision. Anyone with that link can read the pinned title and content until the owner revokes it, the source document is deleted, or eligible plan access ends. A recipient who signs in with eligible access can fork the pinned revision into a separate document they own. The fork keeps the public link ID, version ID, and package hash as provenance and remains independent from the source owner's document.

Pairing is optional and is available for signed-out canvases. When you choose to pair, the web app sends requests from your browser to ppie running on the loopback address on your computer. Your browser may ask you to allow Local Network Access for that connection.

Pairing stores a non-secret browser-profile record in local storage and a temporary bearer token in session storage. The paired companion can create, update, and retrieve prompts from the connected local canvas. Disconnecting asks the companion to revoke the session and then clears the browser pairing data when that revocation is confirmed.

Prompt Pie loads Google Analytics and Vercel Analytics. Google Analytics may set analytics cookies. When a PostHog key is configured for a deployment, Prompt Pie also initializes PostHog through the app's /ingest endpoint; PostHog may use browser storage. Prompt Pie does not currently provide an in-product analytics consent banner or preference center.

Browser local storage and session storage are also used for app features such as signed-out canvases, local-companion pairing, temporary companion sessions, and limited sign-up state. The app may process device, browser, and usage information through its analytics providers.

If you submit feedback, Prompt Pie stores the email address and message you provide along with request metadata such as IP address, user agent, browser information, and submission time. Prompt Pie uses Supabase for account and app data, Vercel for hosting and analytics, Google Analytics, and optionally PostHog. Payments and subscriptions use Lemon Squeezy, and transactional email uses Resend.

For privacy questions or requests, use the Prompt Pie issue tracker linked below. Please keep encryption keys, share links, passwords, and other secrets out of support messages. We may update this policy as the product changes and will update the date above when we do.