PromptCatalog Privacy Policy

1. Information We Collect

• Account information: Sign-in provides an account identifier, email address, and, when available, a name through our authentication provider. We use this information to create or recognize your account. Sign-in credentials are handled through the authentication service.
• Profile information: Your display name, username, avatar, headline, biography, location, website, GitHub username, and Buy Me a Coffee username, when you provide them.
• Contributions and preferences: Prompts (including unpublished submissions), images, comments, prompt likes and dislikes, author follows and blocks, tag subscriptions, and records of account activity and moderation decisions.
• Contact messages: Your name, email address, message, submission time, and your account identifier if you are signed in. Messages are stored and can be forwarded to site operators through our notification service.
• Technical information: Requests to the Website and its providers expose information such as IP address, browser details, requested URLs, and referring pages. Hosting and error logs may record request information. Analytics and browser storage are described below.

You can read public pages without an account. Signing in is required for publishing, commenting, voting, following or blocking authors, and managing tag subscriptions. The contact form is also available without signing in.

2. How We Use Information

We use account and contribution information to authenticate users, save and publish contributions, display profiles, organize prompts by tags, calculate ratings and counts, and provide community features. We use activity and moderation records to operate the site and investigate misuse.

Prompt notification emails: Subscribing to a tag or a combination of tags stores your interests and enables emails to your account address when matching prompts are published. Remove a subscription using the subscribed button or the Interests section of your profile while signed in. Removing every subscription stops future matching notifications; a message already being processed may still arrive. Signing out does not unsubscribe you.

We use contact details to respond to questions and requests, and technical information to deliver, troubleshoot, secure, and understand use of the Website. We do not sell or rent your personal information.

3. Grounds for Processing

Where applicable data protection law requires a lawful basis, the purpose determines the basis:

• Providing requested services: Account access, saving contributions, and related features where processing is necessary to perform our agreement with you.
• Consent: Optional subscription emails you request and other processing for which consent is required. You can withdraw subscription consent by unsubscribing.
• Legitimate interests: Maintaining a functioning community, responding to inquiries, preventing abuse, and diagnosing faults, subject to your rights and interests.
• Legal obligations: Handling requests and retaining or disclosing information when law requires it.

The cookie notice described below is not an analytics consent control. These Terms and this Policy do not substitute for consent where it is legally required.

4. Your Choices & Privacy Requests

You can edit profile fields and manage tag subscriptions while signed in. Profile editing does not change credentials held by your sign-in provider. There is currently no self-service account deletion or full data export button; use our Contacts page to request account deletion, content removal, access, or a copy of your personal information.

Depending on the law that applies to you, you may also have rights to correction, portability, restriction, objection, withdrawal of consent, and complaints to your local data protection authority. Rights and exceptions depend on the processing involved. Withdrawing consent does not affect processing that was lawful before withdrawal.

Include your profile URL and the request you want us to handle. We may ask for information needed to verify your identity and protect your account. Do not send passwords, authentication tokens, payment details, or identity documents in your initial message. We will handle requests within applicable legal deadlines and explain any applicable limits or reasons we cannot fulfill a request.

5. Retention & Removal

Account records, contributions, activity records, and contact messages do not have a single automatic expiry period. Retention depends on whether the account or content is still in use, whether a request or dispute remains open, and any security or legal need to keep a record. Unsubscribing removes the active tag subscription; signing out only ends your session.

Request deletion through Contacts. Account closure, removal of public contributions, and deletion of records held by an external sign-in provider are distinct actions; describe which you want. Information may need to be retained for legal obligations or resolving disputes, and cached or backup copies may remain until their normal replacement or deletion. We do not promise instant deletion from every system or from independent websites that have copied public content.

6. Cookies & Browser Storage

We use the following browser storage. You can remove it through your browser settings; removing essential cookies may sign you out or interrupt sign-in.

When Google Analytics is enabled, it receives usage information and may set analytics cookies. Cookie names and lifetimes depend on its configuration. See Google's cookie information. The Website's current cookie notice remembers dismissal only; it does not enable, disable, or provide granular controls for analytics. Browser privacy settings can restrict cookies and tracking.

7. What Is Public & Who Receives Information

Public profiles: Your name, username, avatar, biography, headline, location and external links can appear publicly, together with join date, contribution and follower counts, selected activity history, and your subscribed tags under Interests. Your account email is not displayed as a normal profile field. Do not put a home address or other private details in public profile fields.

Contributions: Published prompts and comments are public. Unpublished and rejected prompt pages require appropriate account permissions, but uploaded images are public files accessible by URL, including images uploaded before a prompt is published. Do not upload confidential files. Some account moderation information, including a banned status and its explanation, may be shown on profiles.

Search engines can index public pages, and others can reuse content under our content reuse policy. Removing a page here does not remove independent copies elsewhere.

Providers: Amazon Web Services provides hosting, storage, authentication through Cognito, publication email delivery through SES, and contact notifications through SNS. Google Analytics receives usage information when configured. Google Fonts, jsDelivr, unpkg, jQuery's CDN, and Tiny Cloud supply fonts, scripts, styles, or editor resources on relevant pages. Your browser contacts these providers directly and can disclose IP address, browser details, and referring information.

External images or media included in prompts can cause requests to their hosts. GitHub, author websites, external sign-in providers, and Buy Me a Coffee apply their own policies when you use their services. Donation payment details are handled by the payment provider, not our contact form.

Site operators and authorized administrators can access information needed to run the service and handle reports. Information may also be disclosed when legally required or necessary to investigate abuse and protect users' rights. For provider details, see AWS Privacy and Google Privacy.

8. International Processing

Our infrastructure and external providers may process information outside your country. The location depends on the hosting service and provider involved. Contact us for information about the processing relevant to your account and any applicable transfer safeguards. The use of a provider does not by itself mean every country offers the same legal protection.

9. Security

The Website uses HTTPS and account permissions to protect access to features and non-public prompt pages. The session cookie is configured to restrict access by browser scripts. These measures do not make the service risk-free. Protect your sign-in account, sign out on shared devices, and do not share session tokens.

Report suspected account misuse or exposed personal information through Contacts. We will assess reported incidents and provide notifications where required by applicable law.

10. Age Requirements

The service is intended for users aged 13 or older, and aged 16 or older in the European Union under our site rules. Do not create an account or submit personal information if you do not meet those requirements. We do not currently verify age during sign-in. If you believe a child has submitted information in breach of these rules, contact us so we can investigate and arrange appropriate removal.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will post the updated Policy on this page and update the “Last updated” date. Material changes will be identified on this page; additional notice or consent will be provided where required by law.