Privacy Policy

Effective date: March 21, 2026

1. Introduction

This Privacy Policy describes how Welded Anvil Technologies LLC ("we", "us", "our") collects, uses, and protects information when you use Prompt Cellar ("the Service"). We are committed to protecting your privacy and being transparent about our data practices.

A core principle of our Service is client-side encryption: your prompt content is encrypted in your browser before it reaches our servers, and we store only ciphertext. We do not access your prompt content except as needed to provide the Service (see "Encrypted Prompt Data" below for an important detail about instant-unlock key recovery).

2. Information We Collect

Account Information

When you create an account, we collect:

  • Email address
  • WebAuthn credential identifiers (public keys for passkey authentication)
  • Account creation timestamp

Encrypted Prompt Data

We store your prompts, session context, and associated files as encrypted ciphertext. Each entry is encrypted client-side using AES-256-GCM with a key derived from your passkey. We do not read this content in the ordinary course of operating the Service. To provide instant unlock across your devices, we also store an encrypted recovery copy of your vault key — which means we are technically able to decrypt your content, and we access it only as needed to operate the Service or as required by law. The key protecting this recovery copy is held in our application configuration, not in the database, so a breach of the database alone does not expose your content. Our servers store:

  • Encrypted prompt blobs and initialization vectors
  • Encrypted context file blobs and initialization vectors
  • Encrypted search index entries
  • Unencrypted metadata: timestamps, tool identifiers, session grouping IDs

Billing Information

Payment processing is handled entirely by Stripe. We do not store credit card numbers, bank account details, or other payment credentials. We receive and store only your Stripe customer ID and subscription status.

Usage Data

We collect aggregate usage metrics such as prompt counts and feature usage to enforce plan limits and improve the Service. This data is not tied to your prompt content.

3. Cookies and Analytics

We use analytics tools to understand how visitors use our site. No analytics tracking runs until you explicitly accept via our cookie consent banner.

If you accept cookies, we use:

  • Google Analytics 4: Page views, traffic sources, and general site usage. IP addresses are anonymized. Google's Privacy Policy
  • Amplitude: Product analytics and session replay to understand feature usage and improve the user experience. Session replay captures interactions with the site interface but cannot access encrypted prompt content. Amplitude's Privacy Policy

If you decline cookies or have not yet made a choice, no analytics scripts are loaded and no tracking cookies are set. You can change your preference at any time using the "Cookie Settings" link in the footer.

Your consent choice is stored in your browser's local storage (not as a cookie) and is not transmitted to our servers.

4. How We Use Your Information

We use the information we collect to:

  • Provide, maintain, and improve the Service
  • Authenticate your identity and secure your account
  • Process payments and manage subscriptions
  • Enforce plan limits (prompt counts, retention periods)
  • Analyze aggregate usage patterns to improve the Service (only with consent)
  • Communicate with you about your account or the Service

We do not sell, rent, or share your personal information with third parties for their marketing purposes.

5. Third-Party Services

The Service integrates with the following third-party providers:

  • Stripe: Payment processing and subscription management
  • Google Analytics: Website analytics (only with consent)
  • Amplitude: Product analytics and session replay (only with consent)

Each provider operates under its own privacy policy. We encourage you to review their policies.

6. Data Retention

  • Free plan: Encrypted prompt data is retained for 30 days
  • Paid plans: Encrypted prompt data is retained for as long as your subscription is active
  • Account data: Retained until you delete your account
  • Billing records: Retained as required by law and Stripe's policies

When data is deleted, it is permanently removed from our databases. Because your prompt data is encrypted and we do not hold the keys, deleted ciphertext is unrecoverable.

7. Data Security

We implement multiple layers of security:

  • Client-side encryption: Prompt content is encrypted in your browser with AES-256-GCM before it reaches our servers, using a key derived from your passkey. We store only ciphertext.
  • Passkey authentication: No passwords are stored. Authentication uses the WebAuthn standard with hardware-backed credentials.
  • Transport security: All connections use TLS encryption.
  • Encrypted search: Search indexes are encrypted client-side so that queries and results are never exposed to the server.

For a detailed technical explanation, see our Security Architecture page.

8. Your Rights

You have the right to:

  • Access: View all data associated with your account through the dashboard
  • Deletion: Delete your account and all associated data at any time
  • Portability: Export your data (decryption happens client-side in your browser)
  • Withdraw consent: Revoke cookie consent at any time via the "Cookie Settings" link
  • Correction: Update your account information through the dashboard

To exercise any of these rights, contact us at support@weldedanvil.com.

9. Children's Privacy

The Service is not intended for use by anyone under the age of 18. We do not knowingly collect information from children. If we become aware that we have collected information from a child, we will take steps to delete it.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page with a new effective date. Your continued use of the Service after changes take effect constitutes acceptance of the revised policy.

11. Contact

If you have questions about this Privacy Policy or our data practices, contact us at support@weldedanvil.com.