How your library is protected

• No passwords to leak

  Sign-in is Google OAuth only. We never see or store a password for your account.

• Per-user isolation

  Every Prompt, Topic, tag, and source is scoped to your account with database row-level security — enforced by the database itself, not just the application.

• Private file storage

  Uploaded sources and profile photos live in private storage and are served through short-lived signed URLs, never public paths.

• Analytics without content

  First-party product analytics, when enabled, use normalized route categories, allowlisted outcomes, counts, and bounded time estimates. They exclude Prompt and Source content, notes, search terms, filenames, raw URLs, provider IDs, click coordinates, and replay data. We do not train anything on your content.

• Hardened endpoints

  Authentication, saving, sharing, uploads, and billing endpoints are rate-limited, and billing webhooks are signature-verified and replay-protected.

• Exit on your terms

  Export your full library from Settings anytime. Account deletion is scheduled with a short grace window, then permanent.

Everything you save is private by default. A prompt and its attached sources become visible to someone else only when you explicitly share them. Private and invite-only access rules are enforced on every read, and revoking a share works immediately.

If you believe you have found a security issue, email support@isaveprompts.com with enough detail to reproduce it. We read every report. Please do not test against other people’s data — use your own account.

For what data we process and why, see the privacy policy.