Privacy Policy
Plain-English summary: We collect only your email and license metadata. We never see, store, or analyze your prompts or AI responses. The app reads your active application name and selected text locally — this data never leaves your Mac.
Overview
PromptCraft ("we", "us", "our") is a macOS application that optimizes prompts before they are sent to AI models. This policy describes what personal data we collect, why we collect it, how we store it, and what rights you have over it.
We designed PromptCraft with privacy as a constraint, not an afterthought. The result: our server-side data footprint is minimal by architecture, not by policy alone.
What we collect
We collect only what is strictly necessary to operate the service:
Collected at purchase via Stripe Checkout. Used to deliver your license key and, if applicable, send subscription renewal notices. We do not add you to marketing lists without explicit consent. You can opt out of transactional emails by contacting us at hello@promptcraft.app.
We store your license key (a random token we generate), your license tier (Pro or Cloud), activation timestamp, and the number of machines that have activated the license. We store a non-reversible hash of each machine's hardware identifier — not the identifier itself. This hash lets us enforce the per-machine limit without us knowing which specific device you own.
Payment processing is handled entirely by Stripe, Inc. We never see, handle, or store your card number, expiry date, CVV, or bank details. Stripe provides us with an opaque customer ID and a record of the transaction. For Stripe's data practices, see stripe.com/privacy.
When you use PromptCraft Cloud, we log: a SHA-256 hash of your license key, the AI provider you routed to, the HTTP status code of the provider response, and the round-trip latency in milliseconds. These logs are used for rate-limit enforcement and service health monitoring. They are retained for 30 days and then automatically deleted. No prompt content is logged.
What we never collect
These are architectural guarantees, not just policy statements:
App permissions
PromptCraft requires one macOS permission:
Used by the Context Engine to read your active application name and any text you have selected. This data is processed entirely on your Mac, in memory, and is discarded after each pipeline run. It is never transmitted to our servers or any third party.
You can revoke this permission at any time in System Settings → Privacy & Security → Accessibility. Revoking it disables context injection but does not affect prompt optimization or model routing.
No other permissions are required. PromptCraft does not request microphone, camera, location, contacts, photos, full disk access, or any other system permission.
Cloud proxy
Cloud subscribers use our Cloudflare Workers proxy to route requests to AI providers without managing API keys. Here is exactly what happens at the network level:
- Your Mac sends the assembled prompt over HTTPS to our proxy at
promptcraft-cloud-proxy.ozzydev.workers.dev. The connection is encrypted end-to-end using TLS 1.3. - Our proxy validates your license key hash, selects the appropriate provider, and forwards the prompt. The prompt is held in memory only for the duration of the forwarding operation.
- The provider's response is streamed back to your Mac. Our proxy does not buffer the full response — it acts as a streaming relay.
- We log the metadata described in "What we collect" above. The prompt content is never written to disk, logged, or stored in any Cloudflare service including Cloudflare Logs, Workers KV, or R2.
Cloudflare's infrastructure guarantees that Workers code runs in isolated V8 contexts. No other tenant's code can access your request data.
Data storage
License data (email, license key, tier, activation records) is stored in Cloudflare Workers KV, a globally distributed key-value store. Data is encrypted at rest using AES-256. Cloudflare's infrastructure is SOC 2 Type II certified.
We do not operate our own database servers for user data. The Cloudflare KV store is the single source of truth for license records.
Cloud proxy request logs are stored in Cloudflare's logging infrastructure for 30 days and then automatically purged. We do not export or back up these logs.
We do not transfer your personal data outside of Cloudflare's infrastructure except as inherent in forwarding your request to your chosen AI provider (Anthropic, OpenAI, Google, DeepSeek, or Moonshot).
Legal basis for processing
Where GDPR, UK GDPR, or similar privacy laws apply, we process personal data under one or more of the following legal bases: (a) contract necessity to deliver license activation, billing records, and paid service access; (b) legitimate interests for fraud prevention, abuse detection, infrastructure security, and service reliability; (c) legal obligation for tax, accounting, and lawful disclosure duties; and (d) consent where specifically required by law.
Our legitimate interests include protecting license integrity, preventing unauthorized key sharing, and preserving service availability for paying customers. We apply data minimization and retention limits to balance these interests with user privacy rights.
Third parties
Handles payment data. We share only what Stripe requires to process your order (email, order amount). See stripe.com/privacy.
Hosts our Workers proxy and KV store. Cloudflare processes data as a data processor on our behalf under their Data Processing Agreement. See cloudflare.com/privacypolicy.
When you use Cloud routing, your assembled prompt is sent to the provider you select. Each provider has their own data processing terms. We recommend reviewing their policies: Anthropic, OpenAI, Google.
This website loads Instrument Sans and Geist Mono from Google Fonts CDN. Google's servers receive your IP address as part of this request. This affects the marketing website only, not the PromptCraft app.
We do not sell, rent, license, or trade your personal data to any other third party for any purpose.
Children
PromptCraft is not directed at children under 13 years of age (or 16 in the European Economic Area). We do not knowingly collect personal data from children. If you believe we have inadvertently collected data from a child, contact us at hello@promptcraft.app and we will delete it within 7 days.
Your rights
Depending on your jurisdiction, you may have the following rights regarding your personal data:
- Access: Request a copy of the personal data we hold about you.
- Correction: Ask us to correct inaccurate data.
- Deletion: Ask us to delete your data (see "Data deletion" below).
- Portability: Receive your data in a structured, machine-readable format.
- Restriction: Ask us to limit how we use your data while a dispute is resolved.
- Objection: Object to processing based on legitimate interests.
- Withdraw consent: Where processing is based on consent, withdraw it at any time.
To exercise any of these rights, email hello@promptcraft.app. We will respond within 30 days. We do not charge a fee for reasonable requests. If you are in the EU or UK and believe we have violated your rights, you may lodge a complaint with your local data protection authority.
Data deletion
To delete all data we hold about you:
- Email hello@promptcraft.app with the subject line "Data deletion request".
- Include the email address you used at purchase so we can locate your record.
- We will confirm deletion within 7 days.
Deleting your data will deactivate your license key permanently. We cannot recover it after deletion. If you purchased a Pro license and want to delete your data, we recommend redeeming any remaining value first. Refunds are governed by the Terms of Service.
Business transfer
If PromptCraft or its assets are involved in a merger, acquisition, financing, reorganization, bankruptcy, or sale transaction, relevant account records may be transferred as part of that transaction, subject to confidentiality obligations and this Privacy Policy. Any successor operator will remain bound by equivalent privacy and security obligations for transferred data.
If a transaction materially changes how your personal data is processed, we will provide advance notice and, where legally required, offer an opportunity to object, request deletion, or terminate service before the change takes effect.
Changes to this policy
We may update this policy when we change how we operate. When we make material changes, we will notify existing customers by email at least 14 days before the change takes effect. The "Last updated" date at the top of this page reflects the most recent revision.
Your continued use of PromptCraft after the effective date of a revised policy constitutes acceptance of the changes.
Contact
Privacy questions, data requests, and concerns:
We aim to respond within 2 business days.