Privacy policy

Using the generator without an account

Nothing identifying is stored. Your daily allowance is counted against a key made by hashing your IP address together with a server-side secret. The hash is one-way: it cannot be turned back into an address, and it expires at midnight UTC along with the count.

The idea you type is sent to a language model provider to produce the prompt, and the result is cached for seven days under a hash of the request so an identical idea does not cost a second call. That cache is keyed by the request alone and is not linked to you or to any account.

Your prompt history

When you are signed in, each prompt you generate is saved to your account together with the idea you typed, so you can copy it again later. Only the last ten are kept: each new one deletes the oldest. Only you can see them. You can delete any one, or all of them, from your account page at any time, and they are deleted with your account. Prompts generated without an account are never saved.

Accounts

When you create an account we store:

• your email address;
• your name, if you supply one or if Google supplies one;
• your profile picture URL, only when you sign in with Google;
• a bcrypt hash of your password, if you set one. The password itself is never stored and cannot be recovered from the hash;
• the dates the account was created and last used.

When a new account is created, the site operator receives an email notification containing the account’s email address, the name if one was given, and how the account was created. It is not shared with anyone else.

Signing in with Google gives us your email, name and picture from your Google profile and nothing else. We do not receive your Google password and have no access to your Gmail, Drive, contacts or any other Google service.

Your session is a signed cookie, not a database record. It lasts thirty days and contains your account id, email address, name and profile picture URL.

To stop password guessing, failed and successful sign-in attempts are counted for fifteen minutes against a one-way hash of your IP address and a one-way hash of the email address entered. The counts then expire on their own.

The contact form

Messages are stored with the name, email address, subject and body you supply, so they are not lost if mail delivery fails. They are deleted once the thread is closed. If you are signed in, the message is linked to your account so a reply can be matched to the right person.

Advertising

This site is funded by Google AdSense. Google and its partners set cookies and use device identifiers to serve and measure ads, and that processing is governed by Google’s own policies rather than this one. You can review and change what Google uses at myadcenter.google.com. We do not pass your email address, your account, or anything you type into the generator to any advertiser.

What we never do

• Sell or rent your personal data to anyone.
• Use what you type into the generator to train a model of our own.
• Add you to a mailing list. There is no newsletter.
• Track you across other websites for our own purposes.

How long things are kept

• Daily usage counts: until midnight UTC.
• Sign-in attempt counts: fifteen minutes.
• The record that an account was created from a connection (a one-way hash, never the address): thirty days.
• Saved prompts: the last ten per account, until you delete them.
• Cached prompts: seven days, then deleted automatically.
• Contact messages: until the thread is closed.
• Accounts: until you ask for deletion.

Your rights

You can delete your account yourself, immediately, from the account page. Nothing is queued for review and there is no retention offer: the row is removed when you confirm.

For a copy of what is held about you, or a correction, send the request from the address on the account through the contact form. Those are answered within seven days, at no charge.

Depending on where you live you may also have the right to object to processing, to restrict it, or to complain to your national data protection authority.

Children

This site is not directed at children under 13, and accounts are not knowingly created for them. If you believe a child has created an account, tell us and it will be removed.

Changes

If this policy changes in substance, the date at the top changes with it and the change is described here rather than applied silently.