Privacy Policy

At a glance

• pineprompts.com is free and paid for by advertising (Google AdSense). Ads are shown to every visitor. Google may personalise them using advertising cookies unless you click Decline, turn personalisation off in Your Privacy Choices, or your browser sends a Global Privacy Control signal. Visitors in the EU/EEA, UK and Switzerland are asked for consent first. Analytics cookies are only set after you click Accept.
• We collect only what we need to run your account, show prompts, keep the site safe, and understand what people use.
• We never sell your personal data for money. Some privacy laws treat personalised advertising as “sharing” — you can opt out at any time (details).
• You can see, correct, download or delete your data, and withdraw consent, whatever country you are in.
• Questions or complaints: Contact page or our Grievance Officer.

1. Who we are

pineprompts.com (pineprompts.com) is a free, community platform for sharing AI prompts, operated from India. For your personal data we are the Data Fiduciary under India's Digital Personal Data Protection Act 2023 (“DPDP Act”) and the controller under the GDPR and similar laws. You can reach us through our Contact page.

2. Information we collect

Information you give us

• Account data: username, email address, password (stored only as a secure hash), profile photo and bio.
• Content: prompts, images, collections, comments and FAQ entries you submit. Anything you publish is public.
• Saved items & boards: prompts you save and board names. Boards are private to you.
• Onboarding preferences: your role, preferred AI tools, topics and usage frequency, used to personalise your feed. Editable or deletable in Dashboard → Preferences.
• Social links: Instagram, LinkedIn or X profile URLs you choose to add.
• Messages: what you send through the contact form, reports and the on-site AI assistant.
• Sign in with Google (optional): your name, email and profile picture from Google.

Information collected automatically

• Hashed IP address: when you view, copy, like or share a prompt or click a sponsored card, we store a one-way SHA-256 hash of your IP address, not the IP itself.
• Session identifier (hashed): a temporary token used to show “people viewing now”. It expires automatically and is not linked to your account.
• Activity counts: views, copies, likes and shares with timestamps, used for counters, rankings and the leaderboard.
• Search data: search text, result counts, which result you clicked and time spent on it, used to improve search ranking.
• Device & technical data: browser type, device type, approximate location (country/region, derived from IP by our security/CDN provider), and referring page.
• Cookies and similar technologies: see Sections 3–4 and our Cookie Policy.

We do not intentionally collect sensitive data such as health, religion, caste, sexual orientation, biometrics, government ID or financial account numbers. Please don't include such information in prompts, comments or assistant chats.

3. Advertising

We show ads from Google AdSense in the feed, on prompt pages and in articles. Ads are shown to every visitor. Google may personalise them using advertising cookies unless you click Decline, turn personalisation off in Your Privacy Choices, or your browser sends a Global Privacy Control signal. Visitors in the EU/EEA, UK and Switzerland are asked for consent first. Analytics cookies are only set after you click Accept.

• Third-party vendors, including Google, use cookies to serve ads based on your prior visits to this website or other websites.
• Google's use of advertising cookies enables it and its partners to serve ads to you based on your visits to this site and/or other sites on the Internet. Learn more at How Google uses information from sites that use its services.
• Personalised vs non-personalised ads: personalised ads use cookies or device identifiers to match ads to your interests. Non-personalised ads are chosen from context (such as the page you are on) and your general location; Google may still use cookies for frequency capping, aggregated reporting and fraud prevention, unless you have declined cookies.
• Consent in the EU/EEA, UK and Switzerland: visitors there see Google's certified consent message (IAB Transparency & Consent Framework) before any advertising cookies are used, and can change their choice at any time from the “Privacy and cookie settings” link in that message.
• Global Privacy Control (GPC): if your browser sends a GPC signal, we automatically treat it as an opt-out of personalised advertising and “sale/sharing”.
• Opting out elsewhere: Google My Ad Center, aboutads.info (US), youradchoices.ca (Canada) and youronlinechoices.eu (Europe).
• Sponsored and affiliate cards: some feed cards marked “Sponsored” link to partner offers. If you click one, we record the click (with a hashed IP) and we may earn a commission. The partner's own privacy policy applies on their site.

We do not knowingly show personalised ads to children (see Section 13).

4. Analytics

We use Google Analytics 4 (via Google Site Kit / Tag Manager) and our own server-side statistics to understand how the site is used. We use Google Consent Mode: until you click Accept, Google Analytics runs without cookies and receives only anonymous, aggregated measurement signals. After you accept, it may set analytics cookies and record detailed engagement events (for example, which prompts you open or copy).

If enabled on this site, we may also use session-analytics or conversion tools (such as Microsoft Clarity, Hotjar or the Meta Pixel). These only run after you accept and are listed in our Cookie Policy.

You can withdraw consent at any time in Your Privacy Choices or Dashboard → Preferences, and delete the analytics records we hold about you in Dashboard → Security → Delete my analytics data.

5. How we use your information

• Create and run your account, including Sign in with Google.
• Publish and display your prompts, collections and comments.
• Show counters, leaderboards, trending lists and “more like this” recommendations.
• Personalise your feed from your onboarding choices and activity.
• Improve search results and the site's features.
• Show advertising and sponsored cards that keep the service free (Section 3).
• Answer your messages and assistant questions.
• Detect and prevent spam, fraud, abuse and security incidents.
• Send account emails (for example password resets) and, if you allow them, notifications.
• Meet legal obligations and respond to lawful requests.

We do not use your data to make decisions that have legal or similarly significant effects on you.

6. Legal bases

Under the DPDP Act we rely on your consent (given through clear notices such as registration and the cookie banner) or on a legitimate use permitted by Section 7 of the Act. Under the GDPR, UK GDPR and similar laws we rely on the bases below.

Where we rely on consent, you can withdraw it at any time as easily as you gave it. Withdrawal does not affect processing that happened before.

7. Sharing & service providers

We do not sell personal data for money. We share it only with the service providers below (who process it for us or, for advertising, as independent controllers under their own terms), and where the law requires.

We may also disclose data: (a) when required by law, court order or a competent authority (including under the IT Act 2000 and the DPDP Act); (b) to protect the rights, safety and security of users and the platform; or (c) to a successor if the platform is merged or transferred, in which case we will tell you first.

8. International transfers

We are based in India and several providers process data in the USA and other countries. We transfer data only to countries not restricted by the Government of India under Section 16 of the DPDP Act. For personal data from the EU/EEA, UK and Switzerland, transfers rely on adequacy decisions (including the EU–US Data Privacy Framework and its UK and Swiss extensions where the provider is certified) or on Standard Contractual Clauses and the UK Addendum/IDTA. Transfers from other countries (for example Brazil, South Africa or Australia) rely on the equivalent safeguards those laws accept, such as contractual clauses.

9. How long we keep data

• Account data and your content: until you delete your account (then removed within 30 days, except where the law requires us to keep something longer).
• View/copy/share logs: 12 months; totals shown on prompts are kept as anonymous statistics.
• Search logs and click data: 90 days; ranking signals without identifiers are kept indefinitely.
• “Viewing now” sessions: expire after 5 minutes; purged weekly.
• Server and security logs: kept by our hosting and security providers for at least 1 year, as the DPDP Rules require for detecting and investigating misuse.
• Contact messages and grievances: as long as needed to resolve them and keep a record of how we handled them.
• Consent records: the dm_consent cookie lasts 180 days; advertising cookies follow Google's retention periods.

10. Security & breaches

We use HTTPS everywhere, hashed passwords, hashed IP addresses, encrypted secrets, CSRF protection, restricted admin access and regular reviews. No system is perfectly secure. If a personal data breach occurs, we will notify affected users in plain language and inform the Data Protection Board of India as the DPDP Rules require, and for EU/UK users notify the relevant supervisory authority within 72 hours where required.

11. Your rights (everyone)

Wherever you live, we offer everyone the following rights:

• Access: a summary of the data we hold, why, and who we share it with.
• Correction and updating: most of it in Dashboard → Settings; anything else on request.
• Deletion: delete your analytics data instantly in Dashboard → Security, or your whole account in Dashboard → Security → Delete Account or by request.
• Portability: a machine-readable (JSON) copy of your account data, prompts, collections and preferences.
• Withdraw consent / opt out: in Your Privacy Choices, Dashboard → Preferences, or email unsubscribe links.
• Object or restrict: to processing based on legitimate interests.
• Nominate someone (India): to exercise your rights if you die or become incapacitated.
• Complain: to us first (Section 15) and to your local data protection authority (Section 12).
• No discrimination: using your rights never reduces your access to the free service.

How to make a request: use the Contact page with the subject “Privacy Request”. We verify requests using your account email; an authorised agent or parent/guardian may act for you with proof. We acknowledge within 72 hours and respond within 30 days (or sooner where local law requires; extendable where the law allows, with notice). You may appeal a refusal by replying to our decision; if you remain unhappy, contact your authority.

12. Country & region-specific information

India — DPDP Act 2023 & DPDP Rules 2025

You are a “Data Principal” with rights to information, correction, completion, updating and erasure, grievance redressal and nomination. You may give, manage and withdraw consent directly with us or, once available, through a Consent Manager registered with the Data Protection Board of India. Grievances are resolved by our Grievance Officer within 30 days (and never later than the 90 days allowed by the Rules). If unsatisfied, you may complain to the Data Protection Board of India. We also follow the IT Act 2000 and the IT (Intermediary Guidelines and Digital Media Ethics Code) Rules 2021.

European Union / EEA — GDPR

You have rights of access, rectification, erasure, restriction, portability and objection (Articles 15–21), the right to withdraw consent, and the right not to be subject to solely automated decisions with legal effects. Advertising and analytics cookies are used only with your consent under the ePrivacy Directive, collected through Google's certified consent message. You may complain to your national supervisory authority (list at edpb.europa.eu).

United Kingdom — UK GDPR, Data Protection Act 2018 & PECR

You have the same rights as under the GDPR. Non-essential cookies require your consent. You may complain to the Information Commissioner's Office (ico.org.uk).

Switzerland — revised FADP

You have rights of information, access, rectification, deletion and data portability, and may contact the Federal Data Protection and Information Commissioner (FDPIC).

United States — California (CCPA/CPRA) and other state privacy laws

This applies to residents of California, Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, Virginia and any other state with a similar law, to the extent those laws apply to us.

• Categories collected (last 12 months): identifiers (username, email, hashed IP, cookie IDs); internet/network activity (views, searches, clicks, ad interactions); approximate geolocation; user content; inferences (content interests for your feed). Sources: you, your device, and Google Sign-in. Purposes: those in Section 5.
• Sale / sharing / targeted advertising: we do not sell personal information for money. However, allowing Google to personalise ads using cookies may count as “sharing” for cross-context behavioural advertising or “targeted advertising” under these laws. The categories involved are identifiers (cookie IDs, IP address) and internet activity, disclosed to Google and its advertising partners.
• Right to opt out: use Your Privacy Choices (“Do Not Sell or Share My Personal Information”), click Decline on the banner, or turn on Global Privacy Control in your browser — we honour GPC automatically and show when it has been applied.
• Sensitive personal information: we do not collect it for inferring characteristics, and we never sell it.
• Other rights: know/access, delete, correct, portability, appeal a denied request, and non-discrimination. Nevada residents may also ask us not to sell covered information (we do not).
• Minors: we do not knowingly sell, share or use for targeted advertising the data of users under 16 (under 18 in states that require it).

Canada — PIPEDA and Quebec Law 25

You may access and correct your information and withdraw consent. Quebec residents also have rights to data portability, de-indexing and to be informed of profiling technologies (our feed personalisation, Section 14). Complaints: the Office of the Privacy Commissioner of Canada or, in Quebec, the Commission d'accès à l'information. Our privacy officer is the Grievance Officer in Section 15.

Brazil — LGPD

You have rights of confirmation, access, correction, anonymisation, portability, deletion, information about sharing and revocation of consent (Art. 18). Contact our data officer (encarregado) via Section 15, or complain to the ANPD.

Australia & New Zealand

We handle personal information in line with the Australian Privacy Principles (Privacy Act 1988) and the New Zealand Privacy Act 2020. You may complain to the OAIC (Australia) or the Office of the Privacy Commissioner (New Zealand).

Singapore, Japan, South Korea and other Asian countries

Singapore (PDPA): access, correction, withdrawal of consent; regulator: PDPC. Japan (APPI): disclosure, correction, suspension of use; regulator: Personal Information Protection Commission. South Korea (PIPA): access, correction, deletion, suspension of processing; regulator: PIPC. Residents of other Asian countries (including Indonesia, Vietnam, Thailand, Malaysia, the Philippines, Sri Lanka and Bangladesh) have the rights in Section 11 and may contact their national data protection authority.

Africa & the Middle East

South Africa (POPIA): complaints to the Information Regulator. Nigeria (NDPA 2023): complaints to the Nigeria Data Protection Commission. Kenya: Office of the Data Protection Commissioner. UAE (PDPL) and Saudi Arabia (PDPL): you have access, correction, deletion and objection rights, and may complain to the UAE Data Office or SDAIA.

Everywhere else

If your country has a privacy law not listed here, we apply the rights in Section 11 and will honour any additional mandatory rights your law gives you. Tell us your country when you contact us.

13. Children

• You must be at least 13 to use pineprompts.com (or older where your local law requires, for example 14–16 in some EU countries).
• India: anyone under 18 is a child under the DPDP Act. Users under 18 may create an account only with verifiable consent from a parent or lawful guardian. We do not track, behaviourally monitor or target advertising at children.
• Users under 18 everywhere: please click Decline on the cookie banner so you only see non-personalised ads, and ask a parent or guardian to help you with your account.
• USA (COPPA): we do not knowingly collect data from children under 13.

If you believe a child has given us data without proper consent, contact us and we will delete it promptly.

14. Personalisation & automated decisions

We use automated logic to rank search results, recommend similar prompts and order your feed based on your onboarding choices and activity. This affects only which content you see first; it has no legal or similarly significant effect on you. You can reset your preferences in Dashboard → Preferences and delete your activity data at any time. Separately, Google's systems choose which ads to show (Section 3).

15. Grievance Officer / Privacy contact

Under the DPDP Act 2023, the DPDP Rules 2025 and the IT (Intermediary Guidelines) Rules 2021 we have appointed a Grievance Officer, who also acts as our privacy contact for all other countries:

If you are not satisfied, you may complain to the Data Protection Board of India or to the authority in your country listed in Section 12.

16. Changes & contact

We update this policy when our practices or the law change. The date at the top shows the latest version. For significant changes we will notify registered users by email or an on-site notice before they take effect and, where required, ask for fresh consent.

Questions? Use our Contact page. We aim to reply within 72 hours.

Last updated 26 September 2026.