PromptFlower stores your Vault and preferences locally in your browser. PromptFlower AI sends your text through our service to OpenRouter and its model provider. Your own key and Ollama modes send text directly to your selected endpoint. The website also uses server rendering, external fonts and, inside the editor preview, error diagnostics.
1. Data controller
PromptFlower is run by an independent developer. For privacy-related questions, contact us by email:
The address is hidden until you click, to protect it from scrapers.
2. What we collect
The regular prompt workflow requires no account. The following data is stored in your browser's localStorage; drafts and API keys use this tab's sessionStorage:
- Your Vault: saved prompts and revision history.
- Settings: language, export preferences, selected model and base URLs.
- API keys: keys you paste are stored in this tab's session and sent only to the provider they belong to. If session storage is blocked, keys use page memory until you reload or leave the page. The app indicates if an older persistent key copy could not be cleared.
3. AI providers
In own-key or Ollama mode, the text goes directly from your browser to the provider you chose — for example OpenAI, Anthropic, Google Gemini, DeepSeek, a custom OpenAI-compatible endpoint, or a local Ollama server. We are not part of that request and never see the content; that provider's own privacy policy applies. A local model on your own Ollama server can keep the text on your device or network. Remote servers, tunnels or cloud models may send it outside your network.
When you choose PromptFlower AI, our service processes the text and sends it to OpenRouter's free router and the selected model provider. The selected free model may vary. Cloudflare Turnstile verifies access. A short-lived session and a day-specific HMAC of your IP address support quotas and abuse prevention. The developer's provider keys are never disclosed to clients.
Our AI service does not store raw input. Generated results may be cached for up to five minutes to handle duplicate requests. Request identifiers, input hashes and status may remain for up to two days; quota counters for up to 40 days. Expired records are removed by scheduled storage cleanup. Hosting recovery copies may persist longer. OpenRouter, the model provider and Cloudflare have their own data handling terms.
4. Hosting
The site uses server rendering and static files at our hosting provider, which may process technical server logs (IP address, timestamp, browser) for operations and security. Fonts are loaded from Google Fonts, which makes network requests to Google. The editor preview may report generic errors to Lovable; the app's error reporting does not send original error messages or stacks. The project also includes protected MCP and authentication email routes. If the email integration is enabled, it handles recipient addresses, verification links and delivery logs.
5. Retention
Local data remains until you clear it. Export first if you want a backup. Hosting and integration logs have their own retention periods; clearing browser data does not remove those logs.
6. Your rights
You can manage your Vault and preferences in the browser. Contact us with questions about hosting or integration data. You have the right to lodge a complaint with your data protection authority.
7. Security
Use HTTPS for the hosted website. The app includes a Content Security Policy and HTTP security headers. API keys are stored as plain text in browser storage and can be read by code with access to the same origin. Protect your device and avoid saving keys on shared computers.
8. Changes
We may update this policy. The date at the top shows when it was last changed.