Privacy Policy

Last updated: July 25, 2026 · version 2026-07-25

In one sentence: we collect the minimum your account needs to work, your IP is never stored in plain text, we sell nothing to anyone, and you can delete everything whenever you want. The rest of this page is the detail required by Brazil’s data protection law, the LGPD (Law 13.709/2018), written to be read, not to wear you down.

Who processes your data

CopyPrompt is the controller of the personal data processed on this site, on its machine interfaces (REST API v1 and MCP server) and in the CLI. We talk about privacy by email, with real people:

Data Protection Officer (DPO) and privacy matters: [email protected]
Response time: up to 15 days, as LGPD art. 19 requires. In practice, well before that.

What we collect

No giant forms: almost everything here is what you type yourself in order to publish.

Account: email, username, display name and, if you want, avatar, bio and a link to your site. The password is never stored: we keep only an argon2id hash, which cannot be reversed.
Social sign-in: when you sign in with Google or GitHub we receive your email, public name and your account id at that provider, plus the tokens needed to finish the sign-in. We never ask for contacts, private repositories or anything beyond the basic profile.
Public contact: the contact email and the social handles you choose to fill in under Settings. They are optional, they show on your profile to anyone (crawlers included) and you can clear them whenever you want. This is not your sign-in email, which is never displayed.
Content: prompts, descriptions, result images and videos, comments, answers, collections, likes, ratings and who you follow.
Copy events: when a prompt is copied we record the prompt, the source (web, API, MCP or CLI), the time and, if you are signed in, your account. This is what powers the rankings.
ip_hash: so that a signed-out visitor cannot inflate the count by clicking ten times, we need to tell visitors apart. Instead of the IP, we store sha256(IP + daily salt). The salt changes every day: today’s hash does not match tomorrow’s, which makes it impossible to build a history of the same person over time. The IP itself is never written to the database.
Sessions and devices: while you are signed in we keep one record per device: browser, operating system, device type (desktop, mobile, tablet or bot), interface language, approximate region (country and state, never city, never coordinates) and the same ip_hash described above. The IP itself is not stored: there is no column for it. Coming back from the same device updates that row instead of creating a new one.
Moderation record: reports, warnings and suspensions applied to your account, with reason, date and who applied them. The active ones are shown to you at the top of Settings.
API keys: the name and the visible prefix stay in your dashboard; the full key exists only as a hash. Lose it and you generate a new one: not even we can recover it.
Operations: temporary technical server logs (IP, user agent, route) and rate-limit counters, used to block abuse and debug errors.

We do not collect: precise geolocation, your contact list, payment data, sensitive data under art. 5, II (health, biometrics, political opinion, religion) or anything bought from data brokers.

Legal basis for each purpose

Every processing activity needs a legal basis under art. 7. Ours, with no runaround:

Purpose	Data	Legal basis
Create and keep your account, sign-in and session	Email, username, password hash, session cookie	Performance of a contract (art. 7, V)
Publish and distribute your content	Prompts, media, comments, public profile	Performance of a contract (art. 7, V)
Rankings and copy counts without duplicates	Copy event and ip_hash with a daily salt	Legitimate interest (art. 7, IX)
Security: rate limiting, anti-abuse and moderation	IP in memory, temporary logs, reports	Legitimate interest and legal obligation (art. 7, IX and II)
Show your active sessions and detect access that was not yours	Browser, system, device type, language, approximate region and ip_hash	Legitimate interest (art. 7, IX)
Product notifications and transactional email	Email address and events in your account	Performance of a contract (art. 7, V)
Audience measurement (Umami)	Page, referrer, country and device type	Consent (art. 7, I)
Remember interface preferences (theme)	The theme key in your browser	Consent (art. 7, I)

The last two rows (and only those) depend on the cookie banner. Turn them on and off whenever you like; the full inventory is on the Cookies page.

What is public (and should be)

CopyPrompt is an open community. Your profile, your prompts, comments, answers and public collections are visible to anyone and to any AI reading the site through MCP, the public API or the feed. Never put anything in a prompt that you would not say in a public square: someone else’s service key, customer data, a photo of an ID.

Your email is never public. It does not show up on your profile, in the API, in the RSS feed or in llms.txt.

How long we keep it

Account and content: for as long as the account exists.
Copy events with ip_hash: the ip_hash is erased after 12 months. The copy record itself stays tied to your account while it exists, and goes away with it.
Sessions and devices: 90 days after the device was last seen; a scheduled routine deletes anything older. Erasing the history in Settings, or deleting your account, removes the record right away.
Account security log: 180 days. It records the security events of your own account (confirmation code sent or used, data exported, account anonymized) with the time and the daily ip_hash, never the IP. It is in your data export, and deleting your account erases it.
Moderation record: for as long as the account exists. Acknowledging a warning does not erase it: it only records that you read it.
Server logs: up to 30 days, to investigate incidents.
Consent record: while it is the version in force, plus 5 years after withdrawal, because the record is the proof that consent existed (art. 8, §2).
After deletion: we erase within 30 days, including from backup copies on the next rotation.

Who we share it with

We do not sell, rent or trade data with anyone. The only third parties involved are processors that run one technical part of the service:

Cloudflare R2: stores the published images and videos. It receives the file and nothing else: no account data.
Resend: delivers transactional email and the weekly digest. It receives your email address and the message itself.
Self-hosted Umami: audience measurement on a server of ours. It is not a third-party service: the aggregate data never leaves our infrastructure, and the script only loads once you accept it.
Infrastructure: the app and the Postgres database run on our own server with restricted admin access. We optionally use Upstash Redis for distributed rate limiting, which stores only counters per key, never content.

We may also disclose data under a court order or a request from a competent authority, and, where the law allows it, we will tell you first.

International transfers

Cloudflare, Resend and Upstash run infrastructure outside Brazil, which makes this an international transfer of data (art. 33). It happens under standard contractual clauses signed with each processor and is limited to what is strictly necessary to run the service (art. 33, II and IX). Want to know exactly which of your data crosses the border? Ask at the privacy address. We answer case by case.

Your rights (LGPD art. 18)

Every right below is yours, it is free, and you never have to justify it.

These rights come from the LGPD, but they are not limited to people in Brazil: wherever you are, you can use them. Access, correction, export and deletion are built into the product. They are buttons, not promises. We do not claim GDPR compliance: what exists is exactly what is described here.

Confirmation and access (I and II): find out whether we process your data and get a copy. Use “Export my data” in Settings: it produces a JSON file with your profile, prompts, comments and collections.
Sessions (art. 18): the history of devices that signed in to your account is in Settings, and you can erase that history whenever you want. Erasing the record does not end the session itself: to sign out use “Sign out” in the account menu; changing your password drops older sessions.
Correction (III): edit your profile, username and content whenever you want, right on the site.
Anonymization, blocking or deletion (IV): of data that is unnecessary, excessive or processed outside the law.
Portability (V): the same JSON export, in an open, machine-readable format.
Deletion of data processed with consent (VI): deleting your account erases everything in cascade; if you prefer, your public contributions can stay, anonymized as “[deleted account]”. It is your call, right in the deletion flow.
Information about sharing (VII): the list of processors is above and is kept up to date.
Information about refusing consent (VIII): refusing analytics and preferences changes nothing about the service; refusing the essential cookies means you cannot stay signed in, and the panel says so.
Withdrawing consent (IX): through the “Cookie preferences” link in the footer, at any time, in the same number of clicks it took to accept.
Review of automated decisions (art. 20): automatic moderation can hide content preventively; every decision goes through a human review when you contest it at the contact address.

If our answer does not satisfy you, you can complain to the ANPD, Brazil’s National Data Protection Authority.

Security

Everything travels over HTTPS; passwords use argon2id and API keys sha256.
Strict Content-Security-Policy, HttpOnly and SameSite cookies, CSRF protection on forms and sanitization of every piece of user-submitted markdown.
Restricted admin access; every sensitive operation happens on the server only.
A relevant security incident is reported to you and to the ANPD within a reasonable time, as art. 48 requires.

Minors

The service is meant for people aged 18 or over. We do not knowingly collect data from children or teenagers; once we identify such a case, the account is removed and the data deleted. Guardians can request removal at the privacy address.

Changes to this policy

Any material change bumps the version shown at the top of this page, invalidates earlier consents and makes the cookie banner ask again. Relevant changes are also announced on the site before they take effect.