Privacy policy
PromptWallet is built to be private by default.
This Privacy Policy explains what PromptWallet collects, how it is used, and what choices you have when using the PromptWallet iPhone app and Mac app.
PromptWallet may store the following information on your device:
This information is primarily stored locally on your device.
If CloudKit is available and you are signed into the same Apple ID on your devices, PromptWallet can sync private prompts between your own devices using Apple's CloudKit private database.
That may include:
This private sync is intended only for your own devices connected to the same Apple account.
If CloudKit is unavailable, PromptWallet may operate in local-only mode.
Sign in with Apple is optional.
If you choose to sign in with Apple, PromptWallet may store and use limited identity information such as:
PromptWallet does not ask Sign in with Apple for your email address and does not store one. Email addresses that earlier versions of the app sent to PromptWallet's backend have been deleted.
This is used to:
Core prompt capture, organization, and reuse do not require Sign in with Apple.
PromptWallet includes optional backend-connected account and community metadata features.
If those features are configured and you choose to use them, PromptWallet may send limited account or identity metadata to backend endpoints in order to:
PromptWallet is designed so these backend-connected features are optional and separate from the app's core private prompt-library behavior.
PromptWallet offers auto-renewing subscriptions through Apple's In-App Purchase system and uses RevenueCat, Inc. to manage product offerings, validate App Store transactions, maintain subscription entitlement state, unlock or restore PromptWallet Pro, support refunds and fraud prevention, and provide aggregate subscription analytics.
Apple processes the payment itself. PromptWallet and RevenueCat do not receive your payment-card number, bank-account number, or other payment credentials.
For subscription functionality, RevenueCat and PromptWallet may process:
Before sign-in, PromptWallet's RevenueCat app user identifier is derived from a stable pseudonymous installation identifier. If you sign in, PromptWallet may use a one-way fingerprint derived from your Apple or backend account identifier so purchases and entitlements can remain associated with the correct account. PromptWallet does not use the raw Apple or backend account identifier as the RevenueCat app user identifier. Purchase history and a pseudonymous user identifier may therefore be linked to your PromptWallet identity when you are signed in.
Purchase history is used for app functionality and subscription analytics. PromptWallet does not use it for third-party advertising or cross-app tracking.
PromptWallet's backend may receive signed subscription lifecycle events from RevenueCat and retain verified transaction facts needed for entitlement integrity, accounting, refunds, and fraud prevention. If you delete a backend-linked PromptWallet account, retained subscription lifecycle facts are unlinked from that account and installation where supported, while limited transaction facts may remain for accounting, refund, fraud-prevention, or legal obligations.
RevenueCat's privacy policy is available at https://www.revenuecat.com/privacy.
Public profile and community features are optional.
If you choose to use public features (for example: publish, comment, follow, or maintain a public profile), PromptWallet may store and process:
This data is used to operate shared feed and community features, and may be visible to other users of those features.
To keep community features safe, PromptWallet also stores:
PromptWallet uses privacy-first product analytics.
Current product analytics are limited to coarse event names, counts, timestamps, source surfaces, and route origins used to understand activation, retention, and product reliability. If optional remote telemetry upload is enabled, PromptWallet may also send pseudonymous install or account fingerprints, app version, and platform so aggregate cohorts and retention can be measured without sending prompt content. Technical diagnostics can include bounded failure categories, such as a purchase or restore error category, rather than raw receipts or prompt content. If the app crashes or stops responding, Apple's MetricKit diagnostics can also add the crash's exception type and signal code, or how long the app was unresponsive in coarse ranges (1-2, 2-5, or more than 5 seconds); PromptWallet does not send call stacks, logs, or prompt content from these reports. These identifiers and events can be linked to your PromptWallet account when you are signed in. Examples include:
PromptWallet may also generate an on-device analytics intelligence snapshot from your local prompt metadata and product signals so you can review behavior patterns such as activation progress, workflow mix, and reuse. That snapshot stays local unless you explicitly copy or share it yourself.
Remote telemetry upload uses the configured backend URL and can be disabled in Settings. When disabled, PromptWallet clears any pending unsent telemetry queue on the device.
If backend telemetry forwarding is configured by PromptWallet operators, coarse analytics events may be forwarded to PostHog for product analytics processing. Prompt content is still excluded from those events.
PromptWallet does not include the following in product analytics:
If you choose to send feedback from within PromptWallet or through support channels, you may provide:
Only the information you submit intentionally through those support or feedback flows is included.
If you use PromptWallet's sharing features, the content you choose to share is packaged by the app so another person can preview or import it.
When creating a hosted share, the app also sends a pseudonymous installation identifier to enforce abuse rate limits. That identifier is used as a rate-limit key and is not stored with the shared prompt record. If you are signed in when you create a hosted share, the share is linked to your PromptWallet account so it can be deleted with the account.
You control whether you initiate that share. Shared content is not posted publicly by default.
If you share content from other apps into PromptWallet (for example from web pages or X), PromptWallet processes the items you shared (such as URL/text payloads) so they can be captured into your private library or review inbox.
PromptWallet keeps your local data until:
If you use optional backend-connected features, related account/session metadata may be retained according to the backend configuration used for those features.
If you connected optional backend-linked account features, you can also delete that PromptWallet account from inside the app by going to Me → Settings → Account → Delete Account. On Mac, the same action is also available from the Me screen account card. Account deletion removes the backend-linked account, public profile metadata, public community data associated with that account, the reports and blocks you made, and hosted shares you created while signed in. The only exceptions are the one-way identifier hashes described under "Reports, blocks and moderation" (for a banned account, and for blocks other people made against yours) and the subscription facts described under "Purchases and Subscriptions". It does not automatically erase your private prompt library stored locally on your device or your private iCloud/CloudKit data.
You can:
PromptWallet is not directed to children under 13, and we do not knowingly collect personal information from children through the app.
If PromptWallet's data practices change materially, this Privacy Policy will be updated and the revised date at the top of this page will change.
If you have privacy questions, contact: