Privacy Policy

Last updated: August 6, 2026

Local-First Architecture

Prompt Lab stores prompts, API keys, settings, and experiment results locally on your device. Those artifacts do not leave your browser unless you explicitly send a request to an AI provider.

What Prompt Lab Does Not Store Server-Side

• No developer-controlled tracking cookies; Google Analytics may set its own cookies after you allow analytics in the hosted web app
• No prompt text or model responses stored in a developer-controlled backend
• No provider API keys stored in a developer-controlled backend
• No Prompt Lab web account is required for the local extension or desktop shells; the hosted web app requires a Clerk account and sign-in

API Keys

Provider API keys you configure (Anthropic, OpenAI, Google, OpenRouter, Ollama) are stored in your browser's local storage or Chrome extension storage. In the extension and desktop shells, requests go directly to the provider you selected. In the hosted web app, requests are forwarded through Prompt Lab's domain-allowlisted Vercel Edge proxy at /api/proxy to satisfy browser CORS requirements. Prompt Lab does not persist your keys server-side.

AI Provider Requests

When you run a prompt, Prompt Lab sends your input to the provider API you selected. In extension and desktop environments, that traffic is direct. In the hosted web app, traffic passes through a narrow proxy that validates the target domain and forwards the request. Each provider has its own privacy policy and data handling practices. Prompt Lab does not store your prompts or responses in a developer-controlled backend.

Billing and Pro Access

Prompt Lab uses Stripe for checkout, subscription management, and customer portal flows. If you start a Pro upgrade, Prompt Lab and Stripe process billing metadata such as your billing email, Stripe customer ID, subscription status, and configured Prompt Lab price IDs. Prompt Lab uses that metadata to sync Pro access locally on your device.

Usage Insights

Prompt Lab sends lightweight usage events to developer-controlled endpoints only after you allow analytics. These events include event names, app surface, anonymous device/session identifiers, plan state, and an optional contact email if you choose to provide one in Settings. When you allow analytics on a Prompt Lab web page, Prompt Lab also loads Google Analytics 4 for standard page measurement. Google receives page and referrer information plus online identifiers generated by its tag; Prompt Lab does not send prompt text, model responses, provider API keys, or the optional contact email to Google Analytics. You can deny analytics when first asked or change the setting later.

The landing page may temporarily place a bounded, content-free attribution record in same-origin session storage so the web app can understand which Prompt Lab action you selected. That record is limited to allowlisted values such as CTA placement, destination, pricing period, demo mode, result count, schema version, and timestamp. The app removes it after your analytics choice is applied. Prompt text, model responses, documentation search terms, arbitrary URLs, email addresses, and provider API keys are never included in landing attribution or usage-event context.

Data Export and Import

You can export your library, experiments, and settings as a local JSON file at any time. Imported data is processed entirely in the browser. No data is uploaded to external services during import or export.

Open Source

Prompt Lab is open source. You can inspect the full codebase on GitHub to verify these claims.

Contact

Questions about this policy can be directed to the project's GitHub Issues page.