Privacy Policy

1. What We Collect

We collect what we need to provide the service, protect the network, and see how the website is used:

• Account Info: Email address and password (hashed)
• API Usage: Request counts, response times, and the account a request came from
• Payment: Billing info via Stripe (we don't store card numbers)
• Intelligence samples: Free accounts contribute blocked prompts. Paid accounts start with Intelligence Sharing on and contribute safe and blocked prompts until it is switched off. Our published retention window for collected text and raw IPs is 24 hours. Request metadata and enabled session tracking are separate.
• Blocked prompts: The intelligence-sample policy sets 24 hours for prompt text and raw IPs, followed by pseudonymous hash retention.
• Client IP addresses: Required for network defense. The intelligence-sample policy sets 24 hours for raw IPs and 90 days for retained hashes.
• Session data: When deployment session tracking is enabled, a session token requests checked-turn storage separately from intelligence contribution. Sessions expire after two hours idle and at most 24 hours; a fresh token does not guarantee conversation isolation.
• Attack Patterns: Cryptographic hashes of stored prompts and client IPs, kept for 90 days. These are pseudonymous, not anonymous, so we treat them as personal data and your rights in section 6 cover them
• Website traffic data: our host, Cloudflare, keeps standard server-side request logs (IP address, requested URL, browser type) to serve and protect the site. We run no Google Analytics, no advertising tag and no page-level analytics script (section 5b). This is separate from the API, and nothing you send to the API appears in it
• Playground: the playground does not store what you type. It records a hash of the text, a hash of your network address, a session identifier, the length of the text, the result, your browser's user-agent string and abuse signals, so that we can enforce the limit of 25 live checks a day per network and spot abuse. Your text is sent to the inference providers in section 5, the same as an API request

2. How We Use Your Data

• Process your API requests
• Bill you for the service
• Send important account notifications
• Improve our threat detection
• Understand how the marketing website is used
• Comply with legal requirements

3. Data Security

We use industry-standard security measures:

• TLS for all API traffic. Always call the https:// endpoint
• Database encrypted at rest with AES-256
• API keys stored as hashes, so nobody can read them back, including us
• Regular security updates
• Limited access controls, with your data scoped by API key and no cross-customer access

Note: We do not hold SOC 2 or ISO 27001 ourselves. Our security page states exactly where we stand, and we would rather you read that than a badge. The third-party services we build on (Supabase, Cloudflare, Stripe) hold their own certifications, which are theirs and not ours.

4. Your Prompts & Threat Intelligence (Phase 1A)

Important: Here's what happens to prompts you send us:

Legal Basis: Legitimate interest (network security) on every plan. Contribution on a paid plan starts switched on, so we do not describe it as your consent. The table in section 2 sets out the basis for each purpose, and section 6 sets out your right to object. See our full documentation for technical details.

5. Third-Party Services

Services that receive your prompt text. Validating a prompt means sending it to a language model. These are the companies that process prompt content on our behalf:

• OpenRouter: Routes validation requests to the inference providers below, under our account. Receives the full prompt text.
• Groq, Crusoe, CoreWeave, Cloudflare, Together AI, DeepInfra: Inference providers. A request goes to one of them first. If that provider fails or runs out of time, we send the same prompt to the next one, so one request can reach two or three of them. Each receives the full prompt text.
• TypeSafe: Runs an additional safety check on a request, reached through OpenRouter. Receives the full prompt text.

This list is complete and enforced in code: requests are pinned to the providers named above, so a prompt cannot be routed to a provider that is not on this list. Before 17 August 2026, routing fallbacks were enabled and a small fraction of requests may have reached other inference providers available through OpenRouter. Every request we send through OpenRouter tells it to use only providers that do not keep prompts or train on them.

Infrastructure and account services. These operate the product:

• Stripe: Payment processing
• Supabase: Database and authentication, including stored intelligence samples and enabled session records.
• Cloudflare: CDN and DDoS protection (separate from its role as an inference provider above)
• Cloudflare Workers: API hosting; receives submitted prompt text.
• Resend: Transactional emails

5a. Where Your Data Goes

SafePrompt is a US company. Its API runs on Cloudflare Workers. Prompt processing also involves the inference providers described in section 5; a fixed processing region is not promised.

If you are in the UK, the EEA or Switzerland, that means your prompt content is transferred outside your region. Each provider processes that content under its own published transfer safeguard, the European Commission's Standard Contractual Clauses or EU-US Data Privacy Framework certification, as set out in that provider's data processing terms. Ask us at [email protected] for a copy of the clauses that apply to your account, and for the current list of providers and the safeguard each one sits under.

If you need your prompts confined to a fixed region, tell us before you integrate. We will tell you whether we can do it for your traffic before you commit to anything.

5b. Cookies and Tracking

We do not run Google Analytics, advertising pixels, session-replay tools or any other third-party analytics or advertising tracker on safeprompt.dev, docs.safeprompt.dev or dashboard.safeprompt.dev, and no analytics script of any kind loads on our pages. What does run:

• Cloudflare security cookies: Cloudflare may set a short-lived __cf_bm or cf_clearance cookie to tell people from bots. These are essential and carry no marketing data
• Sign-in session: when you sign in to the dashboard, Supabase sets the authentication cookies and local-storage entries that keep you signed in. Essential, and only on dashboard.safeprompt.dev
• Stripe: Stripe sets its own cookies on its checkout and billing pages for fraud prevention. See Stripe's privacy policy
• Playground limits: the playground counts live checks per network on our servers, using the network hash described in section 1. Each count is kept for about two days

Your choices. You can block or delete cookies in your browser; blocking the essential ones may stop the dashboard sign-in from working. There is no analytics opt-out because there is no analytics identifier to opt out of.

Global Privacy Control. We treat a Global Privacy Control (GPC) signal from your browser as a request to opt out of the sale or sharing of personal data and of targeted advertising for that browser. We do none of those things, so honouring the signal changes nothing about how the site treats you. If you believe we hold data used for any of these purposes, write to [email protected] and we will stop. We do not respond to the older "Do Not Track" setting.

6. Your Rights (GDPR & CCPA)

You have the following rights:

• Right to access: Use dashboard/API export for supported account records; it excludes retained hash records and has record limits. Contact [email protected] for an access request concerning additional personal data.
• Deletion controls: Dashboard/API deletion supports selected account records and intelligence samples that still hold text or raw IPs. Contact [email protected] for a request beyond those controls.
• Export format: Supported dashboard/API records are available in JSON; export limits do not determine the scope of applicable access rights.
• Right to Switch Off Contribution (paid plans): turn off Intelligence Sharing in Settings, Privacy and Data Controls, to stop new network-intelligence samples; metadata logging and enabled session tracking are separate
• Right to Rectification: Update your account information
• Right to Object: You can object at any time to our processing of blocked prompts for network defence, whatever plan you are on. Write to [email protected]. We will stop unless we can show compelling grounds that override your interests, and we will tell you which it is within 30 days. On a paid plan you can also switch contribution off yourself in Settings, Privacy and Data Controls, with no need to ask
• Right to Complain: if you are in the UK or the EEA you can complain to your local data protection authority. We would rather you told us first at [email protected], but you do not have to

6a. The Free Plan and Your Data

The free plan is free because blocked prompts from free accounts feed the shared network defence that protects every SafePrompt user. That is the exchange, and we would rather state it plainly than bury it.

What contributes to network intelligence: blocked prompt text and client IPs from Free accounts, under the published 24-hour text/raw-IP and 90-day hash policy. Safe prompts do not enter that sample store on Free. Request metadata and enabled session tracking are separate. We never sell your data or use it to train models we sell.

What it is worth: we value this contribution at no more than the retail price of the equivalent paid plan, which is $29 a month, calculated as the price of the lowest paid plan that lets you switch contribution off. In practice it is worth less than that to us, because most accounts block few prompts.

You can leave the programme at any time by upgrading to a paid plan and switching contribution off, or by closing your account and asking us to delete your data. We will not give you a worse service, a smaller quota or a different price for asking.

7. Data Retention (Phase 1A Updated)

Cleanup: An hourly job deletes intelligence prompt text and raw IPs after 24 hours, API log rows after 30 days, and hash records after 90 days.

Retained hashes. The published policy deletes intelligence prompt text and raw IPs after 24 hours and retains hashes until 90 days. Hash matching supports recognition of repeated attacks or sources. A supplied prompt or IP can be tested against a stored hash; these records are personal data. The self-service limits and rights-contact route are stated in section 6.

8. Compliance

We work to the GDPR and CCPA standards that apply to us, and we will answer any specific compliance question at [email protected].

California

If you are a California resident, the CCPA as amended by the CPRA gives you the rights in section 6, and these are the details it asks us to state.

• We do not sell your personal information, and we do not share it for cross-context behavioural advertising. We have never done either
• Sensitive personal information: we do not ask for it. A prompt can contain anything. We use prompt content only to validate the request and to defend the network, which are the uses the CCPA allows without a right to limit
• How long we keep things: the table in section 7
• How to ask: write to [email protected] or use our contact form. We answer within 45 days, and tell you if we need another 45
• How we check it is you: we match the request to the email on the account, and for a deletion we ask you to confirm from that address. If you use an authorised agent, send us written permission signed by you
• No penalty for asking: we will not deny you service, change your price, give you a lower quality of service, or charge you differently because you exercised a right. The free plan's data exchange is described in section 6a, including what it is worth and how to leave it

Nevada

Reboot, Inc. is a Nevada company. We do not sell covered information as Nevada law defines it, and we have no plans to. If you want to make a verified opt-out request anyway, our designated request address is [email protected] and we will respond within 60 days.

Links to Other Sites

Our site links to third-party websites, including Google. We do not control those sites and are not responsible for their privacy practices. Review the privacy policy of any site you visit from ours.

9. Children's Privacy

Our service is not for users under 16. If we learn we've collected data from a child, we'll delete it immediately.

10. Changes to This Policy

We may update this policy as we grow. We'll notify you of significant changes via email or dashboard notification.

11. Contact Us