Privacy Policy

1. Introduction and who is responsible

We respect your privacy and are committed to protecting your personal data. This policy explains how we collect, use, store, and share your information when you use PromptLikeEngineer across the web app, the CLI, and the MCP server.

The controller of your personal data is Zeynep Aslı Erhan, who operates PromptLikeEngineer from Türkiye. For anything about your data, including the requests described in section 7, write to zeynepaslierhan@gmail.com.

2. Information we collect

• Account information: when you sign up with email or Google, we collect your name, email address, and (for Google) your profile picture to create and manage your account.
• Your content: the prompts, projects, and versions you create, so the service can store and sync them.
• Usage data: how you interact with the service, used to operate and improve it. This includes activity milestones such as your first saved prompt and which surface (web, CLI, MCP) a prompt was used from.
• Where you came from: when you sign up we record which page or link brought you here (the campaign tags in the link, such as utm_source, and the website that referred you), the first page you landed on, and your country, which our hosting provider derives from your IP address. We do not save the IP address with this record. We use it only to learn which channels work. The campaign tags, the referring website, and the first page are not stored on your device: they are read from the link you clicked, held in the page's memory while you browse, and sent with your sign-up. One exception: if the address of the sign-up page itself carries a ref value that is a referral code (referral links do), the sign-up page keeps that code in your browser's local storage until you are next signed in, as described in section 8.
• Technical data: as with any website, our hosting provider receives your IP address and browser user agent with each request and keeps them in server logs for a limited time.
• Notes email list: the "send me the notes" form on the home page does not need an account. If you use it, we store your email address and a label for where the form was (such as landing-notes), and send you an email with a link to confirm. If the same address is submitted again before it is confirmed, we send that confirmation email again. You are on the list only after you click the link (double opt-in); an address that is never confirmed receives no notes.
• Request counters (abuse protection): to limit repeated requests such as sign-in attempts, confirmation emails, and the notes form, our database keeps a counter per one-minute window, labelled with your IP address (when you are not signed in) or your account ID (when you are). They are not used for anything else. An automatic cleanup removes expired counters, but it runs only now and then as requests arrive, so a counter can stay for several days when traffic is low.
• Payment information: payments are processed by Lemon Squeezy, our merchant of record. We never see or store your full card details.

3. How we use your information, and our legal basis

If you are in the European Economic Area or the United Kingdom, these are the legal bases we rely on (GDPR Article 6):

• Provide, operate, and maintain PromptLikeEngineer(your account, your library, the AI features you trigger): performance of a contract with you.
• Process transactions through Lemon Squeezy: performance of a contract with you, and legal obligations for tax and accounting.
• Security, abuse prevention, and error monitoring(including the request counters in section 2): our legitimate interest in keeping the service safe and working.
• Notes email list: your consent, which you give by confirming your address through the link we email. You can withdraw it at any time by writing to the address in section 1; we then remove your entry.
• Understand how the service is used and which channels bring people to it, and improve the platform: our legitimate interest in running and improving a small product. You can object at any time (section 7).
• Service emails (account confirmation, security, billing, deletion notices): performance of a contract. Optional digest and product emails: our legitimate interest, and you can switch them off in Settings or with the unsubscribe link in the email.

Giving us your account details is necessary to create an account; without them we cannot provide the service.

We do not sell your personal data, and we do not use your prompts to train AI models.

4. Data storage and security

Your data is stored in Supabase with row-level security. We apply appropriate technical and organizational measures to protect it against unauthorized access, alteration, disclosure, or destruction.

5. Third parties

• Google (Gemini): powers the optional AI Improve and Loop features. Relevant prompt content is sent only when you trigger them.
• Google OAuth: optional sign-in.
• Supabase: database hosting and secure storage.
• Lemon Squeezy: payment processing and merchant of record.
• Vercel: website hosting.
• Vercel Web Analytics: page-view statistics (which pages, referring site, country). It does not use cookies and stores nothing on your device.
• Resend: delivery of the emails we send (account confirmation, welcome, deletion notices, optional digest).
• Sentry (EU region): error monitoring for our website and servers. When an error occurs, technical details about it are sent; we configure it to exclude IP addresses, cookies, request contents, prompt text, and access tokens.

International transfers. Several of these providers (for example Vercel, Google, and Lemon Squeezy) process data outside the European Economic Area, the United Kingdom, and Türkiye, including in the United States. Where that happens we rely on the transfer safeguards those providers publish, such as standard contractual clauses or the EU–US Data Privacy Framework. We do not sell your data to any of them.

6. Chrome extension

The Chrome extension is not published yet. This section applies once it is available in the Chrome Web Store; until then nothing described here is running.

The PromptLikeEngineer Chrome extension is a side panel where you can browse, search, copy, edit, and version your own prompt library. This section adds to the rest of this policy and does not replace it.

Stored on your device

The extension keeps exactly two things in the Chrome extension storage on your device:

• Your sign-in session: an access token, a refresh token, the time the access token expires, and your user ID and email address. This keeps you signed in. The extension does not store your password.
• Your theme preference: light or dark.

The extension does not use cookies, localStorage, or IndexedDB, and it does not save copies of your prompts on your device.

Sent to our servers

The extension communicates only with promptlikeengineer.com, over HTTPS.

• Sign-in: when you sign in, your email address and password are sent once to sign you in.
• Session: your refresh token is sent to renew your session, and every request carries your access token and the extension version number.
• Your library: requests to load your prompts and projects. When you save a version or create a quick note, the title, text, changelog, and project are sent and stored in your account, the same as a prompt created on the web. When you roll a prompt back, only the IDs of the prompt and of the chosen version are sent.
• Copy counter: when you copy a prompt, the extension tells our server which prompt was copied (its ID only) so usage counts, such as most-used ordering, include copies made in the extension. The copied text is not sent for this; it only goes to your clipboard.

As with any request over the internet, our servers also receive your IP address and browser user agent. Searching and tag filtering run inside the extension on prompts it has already loaded; what you type in the search box is not sent to our servers.

What the extension does not do

• It does not read or collect the content of web pages, your browsing history, your open tabs, or form data. It has no content scripts and does not request the tabs, activeTab, scripting, history, cookies, or clipboard-read permissions. Its only permissions are extension storage, the side panel, and access to promptlikeengineer.com.
• It contains no analytics, advertising, or tracking code, and it does not contact any website other than promptlikeengineer.com.
• It does not load or run remote code; all of its code ships inside the extension package.
• It does not sell your data and does not send it to anyone other than PromptLikeEngineer. Data received through the extension is used only to provide its prompt-library features, is never used for advertising, and is shared only with the service providers in section 5 that we need to run the service, or when required by law. Our use of this data complies with the Chrome Web Store User Data Policy, including the Limited Use requirements.

Your controls

• Sign out (account menu in the side panel) removes the stored session from your device immediately. The theme preference stays until you remove the extension.
• Uninstalling the extension removes everything it stored on your device.
• Prompts you save through the extension are part of your account. You can edit or delete them in the web app, export your library, and delete your account as described in section 7.

7. Your rights: access, export, deletion

You can access, export, and delete your data at any time. If you are in the European Economic Area, the United Kingdom, or Türkiye you also have the right to correct your data, to restrict how it is processed, to object to processing that rests on our legitimate interests, to receive it in a portable format, and to withdraw consent wherever we rely on it. To use any of these rights, email zeynepaslierhan@gmail.com. Your prompt library can be downloaded as JSON from Settings on any plan (data portability), and it is never locked behind a paywall or a downgrade.

You can delete your account yourself in Settings. Deletion is scheduled with a 30-day waiting period; until then you can cancel it from Settings or with the link we email you. An active paid subscription has to be cancelled first.

You can also ask us to delete your account and all associated data by email at zeynepaslierhan@gmail.com. We process deletion requests promptly and remove your data from our servers.

If you think we are handling your data unlawfully you have the right to complain to a data protection authority: in the EU or EEA, the authority of your country; in the United Kingdom, the Information Commissioner's Office; in Türkiye, the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu). We would appreciate the chance to fix it first, so please write to us as well.

8. Cookies and similar technologies

We use essential cookies for authentication and session management. They are necessary for the site to function and cannot be disabled. We do not use advertising or cross-site tracking cookies. Page-view statistics come from Vercel Web Analytics, which is cookieless, and the source information described in section 2 (campaign tags, referring website, first page) is not written to cookies, local storage, or session storage, with one exception: the ref value on the sign-up page when it is a referral code, listed below as ple:ref.

The web app does keep a few items in your browser's local storage (not cookies). They stay on your device; nothing in this list is used for advertising:

• cookie-consent: remembers that you dismissed the notice at the bottom of the page.
• Interface settings and drafts (ple:sidebarMode, ple:promptStripOpen, ple:editorTerminalOpen, ple:claim-handle-dismissed, ple:draft:…) so the app remembers your layout and does not lose unsaved editor text, and ple-404-balik-rekor, the best score of the small game on the 404 page.
• ple:activation:…: timestamps of when you first reached steps such as saving your first prompt. They are written once and stay in your browser; the same milestones are also recorded on our side as the usage events in section 2.
• ple:local-history:v1: prompts and versions you save on the /try page (no account needed). They stay in this browser and are never sent to us, unless you are signed in and choose to import them into your account; clearing this site's data clears them.
• ple:ref: the referral code in the sign-up page's address. Referral links (/r/…) open the sign-up page with the inviting user's 8-character referral code there; other ref values are not stored. It stays until you are next signed in on this browser, when it is sent to us once to check for a referral and then removed. If you never sign in, it stays until you clear this site's data.

If you use Google sign-in on the sign-up or log-in page, Google's own sign-in script loads from Google and sets a cookie of its own (g_state) to remember the state of the sign-in prompt. We do not read it.

9. How long we keep data

• Account and content (profile, prompts, projects, versions, and the sign-up source record): for as long as your account exists. When you delete your account, they are removed after the 30-day waiting period in section 7.
• Usage events (which prompt was used and from which surface): 13 months.
• Payment records: held by Lemon Squeezy, as merchant of record, for as long as tax and accounting law requires.
• Notes email list (email address, form label, confirmation): until you ask us to remove it. An address that is never confirmed receives no notes, only confirmation emails, and is removed on request.
• Request counters: they expire after one minute and are deleted by an occasional automatic cleanup; when traffic is low they can remain for several days.
• Error reports (Sentry) and server logs(hosting): a limited time set by those providers.

Anything else is kept only as long as it is needed for the purpose it was collected for.

10. Türkiye: KVKK aydınlatma metni

11. Contact

Questions about this policy? Email zeynepaslierhan@gmail.com.

Zeynep Aslı Erhan