Privacy Policy

Last updated: October 30, 2026

Local-First Architecture

Prompt Lab stores prompts, API keys, settings, and experiment results locally on your device. Those artifacts do not leave your browser unless you explicitly send a request to an AI provider.

What Prompt Lab Does Not Store Server-Side

API Keys

Provider API keys you configure (Anthropic, OpenAI, Google, OpenRouter, Ollama) are stored in your browser's local storage or Chrome extension storage. In the extension and desktop shells, requests go directly to the provider you selected. In the hosted web app, requests are forwarded through Prompt Lab's domain-allowlisted Vercel Edge proxy at /api/proxy to satisfy browser CORS requirements. Prompt Lab does not persist your user-provided keys server-side. Hosted access supplied by Prompt Lab uses a separate operator-managed provider credential on the server.

AI Provider Requests

When you run a prompt, Prompt Lab sends your input to the provider API you selected. In extension and desktop environments, that traffic is direct. In the hosted web app, traffic passes through a narrow proxy that validates the target domain and forwards the request. Each provider has its own privacy policy and data handling practices. Prompt Lab does not store your prompts or responses in a developer-controlled backend.

Chrome Extension Page Capture

The Chrome extension has a Capture Page button. Only when you click it, the extension reads the selected text, title, and URL of the tab you are viewing, using Chrome’s activeTab and scripting permissions, and inserts them into your draft as context. Captured text stays on your device unless you run a prompt that includes it, in which case it is sent to the AI provider you selected. The extension does not read pages in the background, keep a browsing history, or send captured page content to Prompt Lab servers.

Billing and Pro Access

Prompt Lab uses Stripe for checkout, subscription management, and customer portal flows. When the hosted web app validates billing for a signed-in account, it can find or create a Stripe customer even on the Free plan, before you start a Pro upgrade. This can send your account email and Clerk user ID to Stripe. Prompt Lab and Stripe also process billing metadata such as your Stripe customer ID, subscription status, and configured Prompt Lab price IDs. Prompt Lab uses that metadata to sync Pro access locally on your device.

Usage Insights

Prompt Lab sends lightweight usage events to developer-controlled endpoints only after you allow analytics. These events include event names, app surface, anonymous device/session identifiers, plan state, and an optional contact email if you choose to provide one in Settings. When you allow analytics on a Prompt Lab web page, Prompt Lab also loads Google Analytics 4 for standard page measurement. Google receives page and referrer information plus online identifiers generated by its tag; Prompt Lab does not send prompt text, model responses, provider API keys, or the optional contact email to Google Analytics. You can deny analytics when first asked or change the setting later. Prompt Lab pages do not load Vercel Web Analytics or Vercel Speed Insights.

The landing page may temporarily place a bounded, content-free attribution record in same-origin session storage so the web app can understand which Prompt Lab action you selected. That record is limited to allowlisted values such as CTA placement, destination, pricing period, demo mode, result count, schema version, and timestamp. The app removes it after your analytics choice is applied. Prompt text, model responses, documentation search terms, arbitrary URLs, email addresses, and provider API keys are never included in landing attribution or usage-event context.

Usage Record Retention and Deletion

Prompt Lab's own usage records are kept for a limited time. A device profile and an optional contact email record expire 180 days after the last event from that device or contact. The shared event list holds at most the 2,000 most recent events, carries no contact email, and expires 180 days after the last event written to it.

When you turn analytics off in Settings, or choose not to allow analytics after previously allowing it, Prompt Lab asks its server to delete the device profile, the contact record created from that device, and that device's entries in the event list. If the request cannot reach the server, the app keeps it and tries again the next time it opens. Aggregate event counts that contain no device identifier or email address are kept. This deletion covers Prompt Lab's own usage records; it does not delete data that Google Analytics has already collected.

To ask for deletion another way, for example if you no longer have the device, email avbydave@gmail.com with the subject “Prompt Lab data deletion”. Please do not post personal details in public GitHub issues.

Data Export and Import

You can export your workspace as a local JSON file at any time. The export contains your prompt library (including trash and collections), preset packs, Scratch pads, and your experiments — evaluation history and saved test cases. App settings and provider API keys stay on your device and are never included in the export. Imported data is processed entirely in the browser. No data is uploaded to external services during import or export.

Local and Server Records

Removing local workspace data does not by itself delete your hosted account, server-side billing records, or usage records previously sent with your analytics consent. Those records are separate from the prompt library stored on your device. To delete usage records, turn analytics off in Settings or use the email route in Usage Record Retention and Deletion.

Source Available

Prompt Lab is source available under the repository's license. You can inspect the codebase and license on GitHub to verify these claims.

Contact

Questions about this policy can be directed to the project's GitHub Issues page.