Privacy Policy
Last updated: July 25, 2026
PromptKey (“we,” “us”) moves text between devices via QR codes and short links — on the web, and through the PromptKey browser extension. This page explains what we collect, why, who we share it with, and how you can control or delete it. It applies to both.
What we collect
The text you share
When you create a QR code or link, its content is encrypted (AES-256-GCM) and stored only until it expires or you delete it. Two modes change what we ever see:
- Offline QR (short text) — encoded directly into the QR image in your browser or the extension. It never touches our servers.
- Link QR (longer text) — sent to our server, encrypted at rest, and decrypted only to display it to whoever opens the link.
- Private / end-to-end mode — encrypted in your browser before it ever leaves your device. The decryption key travels only inside the QR/link itself (in the URL fragment), which browsers never send to us. We cannot read this content under any circumstances.
Account information
If you sign in: your email address and, if you use Google sign-in, the name and profile image Google shares with us. If you use email sign-in, we send a one-time sign-in link and don’t store a password.
Usage analytics (owners only)
For QR codes you own, we log when they’re scanned so you can see basic stats: a daily scan count, a coarse device type (mobile or desktop, from the browser’s user-agent string), and the referring website’s domain only — never the full URL, and never anything that identifies the individual scanning it. These logs are automatically deleted after 90 days.
Browser extension data
The PromptKey extension stores, only on your own device:
- The PromptKey server address and API token you configure, so you don’t need to re-enter them.
- A short local history (your 5 most recent items) so you can find them again from the popup.
Text you select and turn into a QR/link through the extension is handled exactly like the web app: kept on your device for offline QR codes, sent to our server (encrypted) for link QR codes. The extension does not read any page content unless you explicitly trigger it — via the right-click menu, the keyboard shortcut, or the toolbar popup. It does not run in the background and does not access pages you haven’t interacted with it on.
Payments (prompt marketplace)
Purchases and subscriptions are processed by Razorpay. We store the resulting order/subscription IDs, amount, and status — never your card or bank details, which Razorpay handles directly.
Why we collect it
- To create, store, and deliver the QR codes and links you make.
- To authenticate you and keep your library of QR codes.
- To show you scan analytics for content you own.
- To process marketplace purchases and subscriptions.
- To prevent abuse (rate limiting by IP address, not tied to an account unless you’re signed in).
We do not sell your data, and we do not use it to train AI models.
Who we share it with
We use a small number of service providers to run PromptKey. Each only receives what it needs to do its job:
- MongoDB Atlas — database hosting.
- Vercel — application hosting.
- Google — optional sign-in (OAuth).
- Resend — delivery of sign-in emails.
- Razorpay — payment processing for the marketplace.
We don’t share your data with anyone else, and none of these providers may use it for their own purposes.
How long we keep it
- QR codes/links expire automatically based on the option you chose (1 hour up to never, for signed-in users).
- Deleted QR codes are soft-deleted immediately and permanently purged within 30 days.
- Scan analytics are purged after 90 days.
- Deleting your account removes your profile and schedules all your content for permanent deletion within 30 days.
Your controls
- Edit or delete any QR code from your dashboard at any time.
- Revoke your API token from Settings, which immediately blocks extension access.
- Delete your account from Settings — this is permanent and cannot be undone.
- Uninstalling the browser extension removes everything it stored locally.
Security
All content is encrypted at rest (AES-256-GCM) and in transit (HTTPS). Slugs are unguessable and never indexed by search engines. We never render your text as HTML, which rules out an entire class of injection attacks against people who scan your codes.
Children
PromptKey is not directed at children under 13, and we don’t knowingly collect data from them.
Changes to this policy
If this policy changes materially, we’ll update the date at the top of this page. Continuing to use PromptKey after a change means you accept the update.
Contact
Questions about this policy or your data: shrimalinaman888@gmail.com