Privacy Policy

What this deployment collects, why, how long it is kept, and the event ledger.

Status: in force. Written by the operators of this service, not by a lawyer.

This document was drafted in-house and has not been reviewed by counsel. We are telling you that rather than leaving you to assume otherwise, because you are entitled to know how much weight to put on it. What it does have going for it is that every factual claim about how the software behaves was checked against the implementation instead of adapted from a template — where the system does not do something a policy would normally promise, this says so.

If you are relying on this for a decision that matters, get your own advice.

Last updated: 2026-08-16.

Operated by Aleph Consulting LLC, a Nevada limited liability company for showusyourprompts.com. Independent instances of this software are controlled by whoever runs them, not by us.

Every factual claim below was checked against the implementation as of f9ca0a4 rather than assumed. Where the software does not yet do something a policy would normally promise, that is stated instead of glossed.

What we hold

Account data

Provided by IDConnect when you first sign in, and refreshed on later logins:

field	source	note
internal user id	generated	stable, independent of the provider
provider issuer + subject	IDConnect	how we recognise you on return
email address	IDConnect	may be absent if the provider withholds it
display name	IDConnect	may be absent
platform role	derived at first sign-in	`admin` / `moderator` / `member`

We do not hold your password. Authentication happens at IDConnect.

Content you publish

Prompt repositories, manifests, versions, and proposals — held both in our database and in the Forgejo instance backing the Service. Public repositories are, by design, readable by anyone.

Sessions

A session record per sign-in, and an httpOnly cookie in your browser. Signing out revokes the session server-side, not merely in your browser — a captured cookie stops working immediately.

The event ledger

The Service keeps an append-only ledger of product events (repository created, fork created, proposal opened, merged, report submitted, moderation actioned) used to understand how the platform is used.

Two things worth stating plainly, because they are unusual:

The ledger is append-only by design — enforced at both the grant layer and by a database trigger. Entries are not edited or deleted in the ordinary course. This is a deliberate integrity property and it constrains what "delete my data" can mean; see Retention.
Event payloads record subject ids and actions, not free text. The body of an abuse report is deliberately not written to the ledger.

Abuse reports

Reason code, subject, optional free-text detail, and the reporter's user id where they were signed in. Reports may be filed anonymously, and an anonymous report stores no reporter identity at all.

Logs

Ordinary operational logs, including IP addresses, for security and abuse prevention. Requests reaching us through Cloudflare also pass through Cloudflare's infrastructure.

Operational logs are retained for 90 days and then deleted. Ninety days is long enough to investigate an abuse pattern that unfolds over weeks and to reconstruct a security incident, and short enough to be a real limit rather than a euphemism for "forever".

This is enforced by a scheduled job, not by intention. The distinction matters: a retention period nothing deletes is not a retention period, and a privacy policy that states one anyway is simply untrue. If the job stops, the promise above is broken, so it is monitored rather than assumed.

Two honest exceptions. A log line that is evidence in an open abuse or security investigation is preserved until that investigation closes, because deleting evidence of harassment on a timer protects the wrong person. And backups age out on their own schedule, so a log line may survive in a backup after it has been deleted from the live system; backups are not searched or used operationally.

Why we hold it

To operate the Service and attribute your work to you.
To enforce the Terms and the Acceptable Use Policy.
To understand aggregate usage and improve the product.
To meet legal obligations.

Lawful basis, and who this applies to

This deployment is operated from the United States under the law of the State of Nevada, and we treat users in the EU and UK as in scope. A public, open-source site receives visitors from everywhere whatever its terms claim, and accepting someone's signup while asserting we do not serve them would be the weaker position, not the safer one.

Where the GDPR or UK GDPR applies, our lawful bases under Article 6 are:

What	Basis
Your account, and the content you publish through it	Contract (Art. 6(1)(b)) — we cannot provide the Service without them.
Operational logs, rate limiting, abuse and security investigation	Legitimate interests (Art. 6(1)(f)) — keeping the Service available and its users safe. Balanced against your interests by retaining logs for 90 days rather than indefinitely, and by never using them for advertising or profiling.
Responding to a legal demand or preserving evidence	Legal obligation (Art. 6(1)(c)).

We do not sell personal data, we do not use it for advertising, and we do not profile users. Prompt content you publish publicly is published because you chose to publish it — that is the point of the Service, not a secondary use of your data.

You can export your account data and delete your account from within the product; both are implemented, not aspirational.

Who else sees it

IDConnect, our identity provider, which authenticates you.
Cloudflare, which fronts the Service.
Anyone, for content you publish publicly — that is the point of it.

We do not sell personal data.

Retention, stated honestly

Account data — held while your account exists.
Content — held until you remove it. Forks made by others are separate copies and are not removed with your original. This is inherent to how forking works, not a policy choice we could reverse.
Sessions — expire; revoked immediately on sign-out.
Event ledger — append-only, so events are not retro-actively deleted. Events reference an actor id rather than your name or email.
Abuse reports — kept after resolution, so moderation decisions remain reviewable.

BUILT 2026-08-10. Both rights are now implemented:

Export — GET /api/v1/auth/me/export returns everything we hold about you as a JSON file, and states inside the file what it does *not* include and why (prompt history lives in git, token secrets are unrecoverable hashes, ledger events record an actor id rather than a name).
Deletion — POST /api/v1/auth/me/delete, confirmed by typing your own handle. Irreversible.

What deletion does, precisely. Your email, display name and the identity your login matches on are erased; every session and token stops working immediately; your repositories are removed. The account row survives as an anonymous tombstone carrying no personal data, for two reasons we would rather state than hide: deleting it outright would leave your repositories *unowned*, which in this system means nobody — including staff — could ever moderate or remove them; and it would free your handle for someone else to claim, letting them inherit every URL that ever pointed at you.

What deletion cannot do. Forks are independent copies owned by other people. Your copies go; theirs do not, and reaching into another person's repository to delete content would be a far greater power than erasure. The deletion response names any repository that had been forked, so you are told rather than left to assume. Ledger events also remain — the ledger is append-only by design — but they reference an actor id that no longer resolves to an identifiable person.

Your choices

You can make a repository private, or delete it.
You can sign out, revoking that session.
You can ask us about your data at the contact address.

Contact

[email protected] — or [email protected], which reaches the same place.

Changes

Material changes announced before they take effect.

All policies