Privacy policy
Effective 2026-07-23
PromptO is built so that trust is checkable, and that starts with what
we store. The short version: we keep operational metadata, never
the content of your conversations or tool calls, and there are no
third-party analytics anywhere.
What we store
- Usage counters per tenant and day (how many calls,
against which server), used for quotas and billing.
- Session capability records: for each connected
session, which client connected and what rendering capabilities it
claimed, keyed by a short support id. This is what lets us answer a
support question about why a panel did or did not render.
- Trace metadata, only when the operator explicitly
enables tracing: which tool was called, when, its outcome, and the same
support id. Never arguments or results.
What we do not store
Tool call arguments and tool results pass through the proxy and are not
retained. Your prompts, drafts, and answers are between you, your host
application, and the upstream service.
Two exceptions, both yours
- Workbench history: if you use the panel's workbench
mode with sync enabled, your ask history is stored for your tenant so it
follows you across devices. You can delete entries from the panel at any
time, and deletion is immediate.
- Authorization evidence: when an operator enables the
gatescribe confirmation gate, consuming a grant produces a signed audit
record naming the sponsor, agent, tool, and time (not the call
contents). Evidence bundles are retained for 90 days, then pruned.
Diagnostics
A local debug switch (PROMPTO_DEBUG_TOOLCALLS) can log wire
traffic on an operator's own machine for troubleshooting. It is off in
production and its output never leaves the machine it runs on.
Third parties
None. No analytics scripts, no tracking pixels, no data sales. The admin
console reads our own database and nothing else.
Contact
Questions about this policy go to the support contact on the
support page. If you have a support id, include it;
it identifies a session's metadata record and nothing more.