Short answer
PromptFlower's prompt workflow uses localStorage for the Vault and preferences, plus sessionStorage for drafts and API keys. If session storage is blocked, API keys use page memory until reload or navigation away. Local storage is not automatically attached to HTTP requests. Generation sends text and any API key to your chosen AI server. Hosting and preview integrations may use their own storage; see the privacy policy too.
What is stored locally?
No tracking, no advertising, no third-party analytics.
If cookies are blocked, PromptFlower AI can use a limited access token in page memory. It is readable by this page's JavaScript, contains no OpenRouter key and is not saved to localStorage or sessionStorage.
| Key | Type | Purpose | Lifetime |
|---|---|---|---|
| __Host-promptflower-ai | Access protection | Secure HttpOnly cookie for verified PromptFlower AI access. Contains no provider key. Turnstile is used for verification. | At most one hour; desktop keeps its corresponding token in memory only. |
| pf.lang | Necessary | Remembers your language choice (en/sv). | Until you clear it |
| promptflower:v1:settings | Functional | Your preferences (model, base URLs, export options). | Until you clear it |
| promptflower:v1:saved_prompts | Functional | Your Vault: saved prompts and revisions. | Until you clear it |
| promptflower:v1:api_keys | Functional | API keys in this tab's session, used only against your chosen provider. | Tab session |
Is consent required?
The app's local storage supports the features you choose to use, rather than advertising or analytics. Hosting, preview and any other integrations must be assessed according to their actual configuration.
How do I delete it?
Clear site data for promptflower.app in your browser and everything is gone instantly. Note that this deletes your Vault too — export your prompts first if you want to keep them.