Privacy policy
Everything Malprompt collects, how long we keep it, who else touches it, and how to get it back or deleted. No ads, no trackers.
We collect as little as the service allows, we don't sell anything, and there are no ad networks or tracking scripts anywhere on this site. Here is everything.
What we collect
If you create an account: your email address and a hash of your password. The password itself is never stored and can't be recovered from the hash. If you tell us to email you about product updates, we store that preference too.
When you submit a URL: the link, the canonical form we derived from it, when you sent it, and which account sent it. Submitted URLs are public information — they can appear in a published report.
Your IP address, for abuse control only. We store it two ways: the address itself, and a keyed hash of it. After 30 days a nightly job erases the address and keeps only the hash, which lets us recognise a repeat abuser without holding the address. We use IPs to count anonymous submissions against a quota, to rate-limit sign-ins, and to block attacks. We never use them to profile anyone.
If you create an API key: a hash of the key (never the key itself — we can't show it to you twice), your label for it, when it was last used and how many requests it has made.
Ordinary server logs: requests, errors and timings, with no third-party analytics attached.
What we don't collect
No advertising, no analytics scripts, no session recording, no fingerprinting, no cross-site tracking, no data brokers, no selling or renting anything to anyone. The only cookies we set are the ones that keep you signed in and a small marker the header uses to decide whether to draw signed-in controls. Your theme choice is stored in your own browser and never sent to us.
Content we fetch
When you submit a link we download what's there and store it as evidence. That content is treated as hostile: it is never executed, never rendered as code, and shown publicly only in defanged form. If a repository we scanned happens to contain someone's personal information, tell us and we'll take it out of the excerpt.
Who else touches your data
- Railway — hosting and the Postgres database. All application data lives there.
- Resend — sending email (verification, notifications, replies to disputes). They handle the address we're sending to and the message.
- Cloudflare — sits in front of the site for DNS, caching and abuse protection, and provides the Turnstile challenge on anonymous submissions. They see request metadata including your IP.
- Our analysis provider — fetched content is sent to a language model for analysis. The submitted content goes; your email address and your IP never do.
That's the whole list. No one else receives your data, and none of it is sold.
How long we keep things
- Account data: until you ask us to delete it.
- Submissions and reports: indefinitely — the registry is a historical record.
- IP addresses: 30 days, then only the keyed hash.
- Sign-in attempt records: swept daily.
- Email we've sent you: the recipient, the template and the delivery status. We don't store message bodies.
Your choices
- See what we hold. Ask and we'll send you a copy of every row attached to your account.
- Correct it. Your email address is editable; anything else, ask.
- Delete it. Ask and your account and its rows go. Published reports describe public content and stay.
- Stop the email. Product-update email is off unless you turn it on, and every one of those messages has a one-click unsubscribe. Email about your own submissions and disputes is part of the service.
If you're in the EU or UK, these are your GDPR rights to access, rectification, erasure, restriction, portability and objection. Our lawful basis is legitimate interest for running and defending the service, and consent for optional email. You can complain to your local data protection authority; we'd appreciate a chance to fix it first.
Children
Malprompt isn't for under-16s and we don't knowingly hold their data.
Changes
If we change what we collect or who we share it with, we'll say so on the site rather than quietly editing this page. The date above is when it was last updated.
Contact
Privacy questions, data requests and complaints: [email protected].