App privacy

Northcard Holding B.V. is the controller responsible for personal information processed to operate Prompt. This notice covers the app and associated support; website privacy covers the marketing website. Contact hello@tryprompt.app for privacy questions, requests or complaints.

Go to AI processing, optional analytics, retention, your rights or people described in listings.

Your choices before personalization

Before personal setup, you confirm that you are 18 or older, accept the linked terms and separately permit sharing the described personal context with the named AI providers. We record the choice, time and notice version. A privacy notice explains processing; it is not blanket consent to everything. Optional usage analytics is off until you choose it in Settings → Privacy.

Personal setup uses preferences and relevant activity to suggest things to do. Some setup is available before sign-in; reading personal picks requires an account and verified subscription access or a complimentary grant. Declining or withdrawing AI permission pauses personalized use: your feed, Ask, plans and preference editing stop working, and AI suppliers receive no new personal requests about you. Your stored profile is kept, not deleted, so you can resume by giving permission again. Settings, your data export, support, privacy requests, deletion and subscription management remain available, and notifications you set up are controlled separately in Settings → Notifications. Withdrawing permission or deleting data does not cancel an Apple or Google subscription.

The app makes initial technical requests using its device-held credentials, including retrieving privacy choices, before you send interview answers. The app checks your date of birth on your device and saves only an adult confirmation, rather than your birth date or an identity document. An under-18 answer stops personal setup without transmitting that answer. Earlier versions asked for an age band and an optional gender; we no longer collect or store either, and previously stored values have been erased.

What information we handle

• Account and device identity. A randomly generated reader identifier and credential support setup before sign-in. These are pseudonymous, not anonymous. Signing in through Apple, Google or an email code links setup history to your account. We then handle your account identifier, email or relay address, provider identity and sign-in/session records. Native sign-in credentials use the operating system's secure storage.
• What you tell us. Chosen cities and places, interests, onboarding answers, aims, standing instructions, things you name as loves, answers to questions Prompt asks you, plans, watches and feedback. Declared or inferred membership/access eligibility can help determine which opportunities and watch alerts apply to you; it is not a verification of admission by Prompt.
• Questions you ask. Ask answers your question; we do not keep a history of your questions. The answer is held for about 24 hours so a retried request returns the same result, and a one-way fingerprint of the request (not its text) is kept for up to 35 days for usage accounting. A question can also produce short-lived preference evidence, such as an interest or a named place, which counts toward your recommendations for 28 days. Questions are not copied as text into optional usage-event records.
• What we learn from use. Which recommendations are shown to you and which you read, save, dismiss or act on; outcomes you report; and preferences derived from those signals. Some ranking values begin as system defaults, rather than facts you told us. Optional app-improvement analytics is never used to personalize your recommendations.
• Location and maps. With foreground permission, the app reads a location fix while open and rounds the city-selection coordinates before sending them to our server. Our server also rounds any location sent with a feed request to 0.1 degree (roughly 11 km) before using it. You can select a city manually. We do not track background movements or keep a precise movement history. A place/route lookup can include the place searched and route endpoints; endpoints or locations you enter can be more precise than the rounded automatic city fix.
• Subscriptions. Store and RevenueCat customer/transaction references, product, currency, charge and subscription status, renewal/trial information and purchase confirmations. We do not receive full card numbers or security codes.
• Operation and support. Network/request information, device platform and app version, notification tokens, delivery status, technical errors, account/privacy choices, model usage and cost counts, and messages or diagnostic references you choose to send us. Hosting providers see network addresses as requests pass through their infrastructure. Our application logs strip email addresses, credentials and web-address query strings before they are written, and record unexpected errors by type and code location rather than their message; log lines still carry pseudonymous reader, account and request identifiers. For rate limiting we store a keyed, non-reversible code of your network address for about 2 hours.

The app does not access your contacts or photo library and does not offer image/file uploads. Do not include passwords, payment details or unnecessary information about others in a question. We do not build sensitive trait profiles. Free text that Prompt would keep as part of your profile (standing instructions, named loves, declared intentions, onboarding answers, custom aims and stated preferences) is first checked by an AI classifier, run by the AI provider named below, for health, sex life or sexual orientation, gender identity, religion or belief, political opinion, racial or ethnic origin, trade-union membership, and genetic or biometric data. Text that reveals such a trait, or that cannot be checked at that moment, is refused and not stored. Ask still answers such a question, but no preference evidence is kept from it. Free-text notes on outcomes and dismissals are dropped when they reveal such a trait, while the action itself is kept. Activity choices can still say something about you; contact us to remove or correct information that should not be in your profile.

Why we use it and the legal bases

• Providing your requested service: account access, personalized recommendations, Ask, saves/plans/watches, subscription verification and relevant support, including relevant processing by the named AI suppliers. We rely on contractual necessity for information objectively needed to deliver the service you request. AI sharing separately requires the permission described above; accepting the terms does not supply that permission.
• Optional measurement: understanding app use, testing improvements and voluntary surveys, based on your consent. Refusal does not prevent paid use.
• Security and necessary operation: preventing fraud/abuse, protecting accounts, diagnosing service failures, allocating service capacity and establishing or defending claims. We rely on our legitimate interests in a safe, reliable service and protecting our legal position, with proportionate data and access limits. You may object where applicable.
• Legal duties: required accounting/tax records, legally required disclosures and handling applicable privacy or consumer-rights requests. We rely on the relevant legal obligation; records for a disputed claim may also be needed for our legitimate interests in legal defense.

Information needed to authenticate you or verify an entitlement is required for those features; without it we cannot provide them. Location and optional analytics are not required for a subscription. Recommendation ranking is automated personalization, not a decision about employment, credit, insurance or another legal entitlement. It combines the cities and places you follow, the preferences, instructions and loves you state, short-lived evidence from your questions, and how you respond to what you are shown, to choose and order activities; AI suppliers help interpret your words and draft the presentation. You can correct preferences and give feedback in the app. Deleting a standing instruction or a named love also deletes the preference evidence derived from it.

The separate AI-sharing choice is a control over third-party AI use; it does not replace the purpose-specific legal bases above or provide explicit consent to process sensitive personal traits. We do not treat every possible profiling use as necessary merely because it is mentioned in these terms.

AI processing and no model training

Prompt uses commercial APIs from OpenAI and/or Anthropic, as named in the in-app permission notice for the current configuration; our server refuses to run with any other AI provider. They receive relevant cities, preferences, instructions, activity context, candidate listings, questions and onboarding conversation to generate recommendations, normalize instructions, check free text for sensitive traits and answer you. This can include background personalization after your permission; it is not limited to pressing Ask.

We do not use your private questions, preferences or activity to train AI models, opt that information into supplier model-training programs, or submit it as training feedback. Learning your personal preferences to deliver your own recommendations is different from training a general AI model. Authorized staff may access information when needed for support, security or a privacy request, with access limited to the task.

We do not add your sign-in email or raw account identifier to model prompts: before a personal request is sent, our server replaces any email address in it with a placeholder and removes your own account and reader identifiers. Requests can carry a coded safety identifier derived from the account or reader identifier so the provider can detect repeated abuse; it is still pseudonymous data. What you type may itself identify you. Providers may retain requests or related records for service delivery, safety, abuse prevention or legal duties under their applicable arrangements. No model training does not mean no supplier retention or safety review.

You can withdraw AI permission in Settings → Privacy. Future personal AI calls stop; withdrawal does not automatically erase previous records or cancel renewal. Use a deletion or other rights request for existing records. Adding an AI recipient requires a new permission choice.

Optional analytics

If you opt into usage analytics, PostHog receives limited usage events such as onboarding progress, screen types, whether a question or plan was viewed, event time, platform/app version and session/account or reader identifiers. We use these to understand problems and improve the app, not for advertising and not to personalize your recommendations. Analytics is sent only to PostHog's EU region; our server will not start with another analytics host, and release builds fall back to the EU host. Questions and sign-in codes are not sent as usage-event text. IP-based location lookup is disabled.

Session recordings are disabled in the launch app. Optional analytics records limited events and screen types, not a video of your session. You can decline or turn off analytics in Settings → Privacy; future optional measurement stops. Opting out is separate from requesting deletion of information already collected, including any recordings you allowed in an earlier version.

Optional PostHog screen measurement, feature flags and dismissible surveys also follow this choice. Prompt does not send marketing email at launch. We do not use support messages to subscribe you to marketing. Account codes and security notices are service messages, with email open/click tracking disabled.

Who receives information

• Supabase: application database and account authentication, including sending email sign-in codes; account, profile and sign-in information.
• GitHub: our scheduled operational checks run on GitHub Actions and connect to the application database to produce service-health and operations reports.
• Fly.io and website/network hosting suppliers: deliver requests and protect infrastructure; application and network/request information. Our app server uses Fly.io's Amsterdam region.
• Listing-image hosts: venue, organizer, publisher and image-delivery servers receive your network address and asset-request information when the app loads artwork from their servers. This can happen while viewing a listing, before following an external booking link.
• Resend, our support mailbox provider and relevant email suppliers: account/support messages, recipient addresses and delivery status, and the messages you send us.
• OpenAI and Anthropic: the personal AI context and coded safety identifier described above, according to the configuration you are shown.
• AI assistants you connect: on your request we can issue an access token that lets an AI assistant you choose (for example Claude or ChatGPT) read your current picks, watches and notification settings, and record preferences, intentions, outcomes, watches and notification settings for you. That assistant's provider handles what it receives under its own terms, not ours. Tokens expire (after 90 days unless we agree a different period), expired tokens are deleted, and we revoke a token whenever you ask.
• PostHog, EU region only: optional usage events, identifiers, screen measurement and surveys after opt-in. Any recordings from earlier versions remain subject to deletion and retention controls.
• Google Maps Platform: requested place searches and route endpoints. Apple Maps on iPhone and Google Maps on Android also receive the displayed map area and network information when drawing maps.
• Expo, Apple and Google: notification delivery when enabled, including delivery tokens and message payloads; Apple and Google also provide the sign-in or store functions you choose.
• Apple, Google and RevenueCat: native purchases, receipts and subscription entitlements associated with your account.
• Sentry: scrubbed crash reports in internal test builds only. Public store builds do not send Sentry crash reports; optional usage-error events are covered by the analytics choice.

Some suppliers process data on our instructions; others, including store, sign-in and mapping providers, may also act independently for their own functions under their notices. We may disclose necessary information to authorities when required by law, to professional advisers for a relevant dispute, or to a successor to the Prompt business with appropriate protections and notice. Suppliers do not gain permission from us to exploit private questions for unrelated marketing.

We do not sell personal information, share it for cross-context behavioral advertising, use an advertising SDK, or accept sponsored ranking. When you follow an external organizer or booking link, that service handles your visit under its own notice.

Notifications and security

We use push notifications for watches or reminders you request, not promotional campaigns at launch. Notification suppliers receive the token and the message needed for delivery. Depending on your preview settings, event names or actions may appear on a lock screen. Settings → Notifications in Prompt lets you choose discreet or full previews and mute delivery; your phone's settings also let you turn notifications off or hide previews.

We use account/device authentication, access checks and measures designed to restrict personal-information access and reduce unnecessary disclosure. These measures do not eliminate every security risk. Report a suspected account or data-security problem to hello@tryprompt.app; do not include passwords or sign-in codes.

People described in activity listings

This notice also covers identifiable people described in our catalogue, such as artists, performers, curators and organizers. We obtain professional names, roles and activity-related details from public event, venue, organizer, ticketing and editorial sources. Public availability does not remove privacy or intellectual-property rights.

We use this information for our legitimate interests in describing activities accurately and helping people discover them. Relevant information may appear in listings and recommendations and be processed by hosting and AI suppliers to prepare those descriptions. This is separate from creating a personal taste profile for a reader. We retain relevant source and listing records for catalogue maintenance and verification, subject to correction, removal and any necessary legal-claim retention.

If a listing identifies you, you can ask about the source, request access or correction, object to this use, or request deletion where applicable, without creating a Prompt account. Use hello@tryprompt.app or the content-reporting route. We assess the applicable rights and any competing lawful reasons, and explain the outcome. The request and complaint routes below also apply to you.

International processing

Suppliers and their support teams or subprocessors may process information outside the Netherlands, EEA or UK, including in the United States. An Amsterdam server or EU analytics region does not establish that all access stays in Europe. Where required, transfers must be covered by an applicable adequacy decision or appropriate safeguards, such as EU Standard Contractual Clauses and, for relevant UK transfers, the UK Addendum or International Data Transfer Agreement, with the necessary assessment and safeguards. Contact hello@tryprompt.app for the arrangements relevant to your information and how to obtain a copy of applicable safeguards.

Retention and deletion

Active profiles, preferences, standing instructions, plans, watches and linked activity history are retained until you change or delete them. Deleting a standing instruction or a named love also deletes the preference evidence derived from it. We keep no history of your Ask questions: answers are held for about 24 hours and request fingerprints for up to 35 days, as described above. Preference evidence from a question stops counting after 28 days; the expired record is kept, unused, until you delete your data. The feed’s record of which cards it has shown you, used to avoid repeats, is deleted after 90 days. Profiles never linked to an account are deleted after 90 days without reader activity, except where an active watch or a future plan still needs the profile. Removing the app does not itself erase server information; use Delete Prompt data or the external deletion route.

Optional usage records and any recordings collected in earlier versions are subject to the configured supplier retention and your deletion rights. Contact us for the period applicable to your records. Operational, support and privacy-request records are kept while needed for their purpose and any applicable complaint, security, legal-claim or statutory recordkeeping period. Billing/tax records can have a separate legally required period and are not used to preserve a recommendation profile.

Deleting Prompt data removes the active profile, every earlier device profile linked to the account, the unclaimed setup profile of the device you delete from, and their linked application history, including our analytics records about you, and starts tracked cleanup with relevant identity, analytics and other suppliers. After deletion we send no further analytics events about you. We keep minimal suppression identifiers needed to prevent old credentials, late events or restored backups from recreating erased data; after a backup restore, deletions made since that backup are re-applied before the data is used. The deletion record lists the sign-in methods the account used and the request references of its AI calls, so we can follow up with those suppliers, and AI usage and cost records remain without any link to you. Necessary evidence of a request or legal duty may also remain with restricted use. Supplier completion and backup expiry can take longer than removing the active profile; we explain relevant exceptions rather than promise immediate erasure everywhere.

Your rights, requests and complaints

Request access, correction, deletion or a copy at hello@tryprompt.app or through Settings → Privacy and withdrawal requests. Depending on applicable law and the processing, you may also request portability, restriction, object to legitimate-interest processing or withdraw consent. The app's export, available with or without an account, covers your profile and activity, earlier device profiles linked to your account, your privacy-request history, notification delivery records, usage records and store billing events that name your account. It does not replace a full legal access response; contact us for information across account, billing, support, notification, analytics and other relevant systems.

We verify ownership proportionately, accept authorized representatives where required, explain lawful exceptions and respond within the applicable deadline. EU/UK rights requests normally require a response within one month; a permitted extension is explained within that period. Exercising a privacy right does not incur a subscription penalty. Personalization can pause when information or permission essential to that feature is withdrawn.

EU/EEA: you may complain to your national supervisory authority, including the Dutch Autoriteit Persoonsgegevens. Where information is obtained indirectly, this notice explains its sources, including your actions, derived preferences and sign-in/store providers.

UK: you may complain to the Information Commissioner's Office. You can also send a data-protection complaint to us at the address above; we acknowledge it within 30 days, investigate appropriately and communicate the outcome. This complaint process is separate from a rights request.

United States: applicable state laws may provide access, correction, deletion, portability, sensitive-data consent or limitation, and opt-outs of sale, targeted advertising or profiling used for decisions with legal or similarly significant effects. Prompt does not offer sale, cross-context targeted advertising or that kind of significant-effect profiling. We do not intentionally use personal information for LLM training. To appeal a refused privacy request, email us with the request reference and subject "Privacy appeal"; we review it and explain the result and available regulator route within the applicable period, no later than 60 days where that is the governing deadline.

California tracking disclosures: we do not track readers across unrelated apps or websites for advertising or authorize our analytics providers to do so. Because we do not sell or share information for cross-context behavioral advertising, browser Do Not Track and Global Privacy Control signals do not switch on or off such processing. If our practices change, we will provide the required disclosures and signal/opt-out handling before introducing it.

Children and changes

Prompt's personal service is intended for adults aged 18 or older. Contact us if you believe an underage person has submitted personal information so we can assess and address it. Family or children's activities may be recommended to adults; those listings do not change the account eligibility rule.

We update the notice version when practices change and give appropriate notice of material changes. Any new processing requiring consent will need that choice before it starts. If another company takes over Prompt, we will identify the new responsible company and explain relevant changes; this does not permit unrelated reuse of your information.