Privacy
Promptiful is operated by Edison Tan Khai Ping (edison88tkp@gmail.com). Product site: promptiful.ai. Updated 11 October 2026. Notice version: legal-2026-10-11.
No registered company name, registration number, or postal address is published in this repository. Use the email above.
If you only read one thing: we store the Google email you use to sign in, a session cookie, and — if you choose them — a paid plan, a private prompt library, a LinkedIn connection, or a browser alert. We do not call a model. We do not sell personal data.
Who is responsible
Edison Tan Khai Ping decides why this data is processed and is the data controller for the website. Contact edison88tkp@gmail.com. No data protection officer is named on this page. Appointment depends on thresholds in the current Malaysian PDPC guideline; confirm those figures before treating a DPO as required.
What we process
| Data | Source | Why | Required? |
|---|---|---|---|
| Google email and subject id | You, via Google sign-in | Create a session so you can search, open specs, and pay | Obligatory for search and paid plans. If you do not sign in, you can still read the logged-out marketing page. You cannot search or subscribe. |
Session cookie promptiful_session |
Us, after sign-in | Keep you signed in. The cookie is HttpOnly, holds a signed copy of your email and subject id, and lasts 30 days or until you log out. We do not keep a separate session database. | Obligatory once you sign in |
| Stripe customer id, subscription id, plan, and status | Stripe, after you subscribe | Unlock the paid shelf you bought. Card numbers stay with Stripe. We do not store them. | Obligatory only if you subscribe |
| Personal library text | You, if you create or import a prompt | Show that private library back to you. Other users cannot see it. Personal prompts cannot be shared to LinkedIn. | Voluntary. Paid plans only. |
| Variable values you type into a spec | You | They stay in this browser’s localStorage, or on-device storage in the app. They are not copied to your Promptiful account. | Voluntary |
| LinkedIn name, email, member id, and a sealed access token | You, if you connect LinkedIn | Let you post a link to a curated spec on your own LinkedIn profile | Voluntary. Disconnect on Account. |
| Browser push endpoint and keys | You, if you choose Enable alerts | Deliver an announcement the operator sends to people who opted in | Voluntary. You can remove the subscription from this browser. |
| IP address, user agent, and the page you requested | Your browser, automatically | Cloudflare serves the site and can log the request. We do not run a separate analytics store unless a measurement id is configured. | Comes with using the site |
We do not ask for your date of birth, payment card, health data, or a government id. We do not show ads.
Children
Promptiful is a job library (writing, marketing, engineering, and similar work). It is not directed at children under 13. Do not sign in if you are under 13. If we learn an account belongs to a child under 13, email edison88tkp@gmail.com and we will delete the records we hold for it. We do not verify age at sign-in.
Cookies and similar technology
| Name | What it does | When it is set |
|---|---|---|
promptiful_session |
Signed-in session | After Google sign-in. Strictly necessary for the signed-in product. |
| Google Analytics and Google Tag Manager | Page-view counts, if a measurement id or container id is configured on that deployment | Not loaded on a deployment with no id. When an id is set, the Google script stays off until you choose Accept on the banner, or if your browser sends Global Privacy Control, in which case we treat that as Reject and do not ask. Production on 11 October 2026 was serving the site with no measurement id and no Tag Manager id. |
We do not run session replay, heatmaps, or advertising pixels. We do not sell personal information, and we do not share it for cross-context behavioural advertising. A “Do Not Sell or Share” link is not shown for that reason.
The current production site is not, on the figures we can see, a CCPA “business”: the revenue threshold cited in our check (USD 26,625,000, periodically adjusted — confirm the current figure), 100,000 consumers, and 50% of revenue from selling or sharing. Confirm the three thresholds before relying on that. We still answer access and deletion email.
Who else receives data
Classes of third parties: hosting, sign-in, payments, an optional social network, an optional push service in your browser, and — only after you accept, and only if configured — Google Analytics or Tag Manager. Named providers are on Subprocessors.
Choosing Run or a model deep link sends the resolved prompt text to the site you picked (Claude, ChatGPT, Gemini, Grok, or Perplexity). That is your request to that site. Promptiful does not receive the model’s reply and does not send your library to a model API.
The iOS and Android apps talk to this same website. If a shipped build includes Firebase config, Firebase Analytics and Crashlytics can receive app-use and crash data. That is not turned on by the website alone.
Where data goes
Cloudflare serves the Worker at the edge, which can be outside Malaysia. Google, Stripe, and LinkedIn process data on their own infrastructure, commonly including the United States. We have not recorded a written transfer assessment or a signed set of standard contractual clauses in this repository. The practical basis we are using is: the service cannot be provided without the host, the sign-in provider, and the payment provider; LinkedIn, push alerts, and analytics are optional. Confirm the current Malaysian PDPC transfer guideline before treating that note as the assessment.
How long we keep it
| Data | How long |
|---|---|
| Session cookie | 30 days, or until you log out. There is no server copy to delete. |
| Entitlement, personal library, LinkedIn connection, push subscription | Until you delete the item, disconnect, or email us and we delete the KV record. There is no automatic expiry job. |
| Stripe billing records | Stripe’s own retention. We do not delete Stripe’s copy. |
| Cloudflare request logs | Cloudflare’s log retention. We have not set a separate period. |
Email edison88tkp@gmail.com from the Google account on the session to ask for access, a correction, a portable copy, or deletion. We delete the personal library, entitlement record, LinkedIn connection, and push subscriptions we store for that account. We may ask you to prove you control the Google account. We aim to answer within 30 days. There is no in-product “delete my account” button.
European and UK users
Legal bases we rely on: contract, for the account and a subscription you ask for; consent, for LinkedIn, push alerts, and any analytics tag; legitimate interests, for security logs that come with serving the site, balanced against your rights. You can ask for access, correction, deletion, restriction, portability, and objection, and you can withdraw consent. You can complain to a supervisory authority where you live. We have no EU or UK establishment and have not appointed an Article 27 representative.
Malaysia
This notice is also published in Bahasa Malaysia at /privasi. You may request access and correction, ask us to stop processing that is likely to cause you damage or distress, and require us to stop using your data for direct marketing. We do not send marketing email to customers. Withdrawing consent for an optional feature (LinkedIn, alerts, analytics) does not close the rest of the account.
Contact
edison88tkp@gmail.com. Billing changes are in the refund and cancellation policy.