Privacy Policy

1Prompt (“we”, “us”) is a prompt builder for AI video. This policy explains what we collect when you use the website and the studio, why, who helps us run it and the choices you have. If anything here is unclear, use our contact form.

You don’t need an account. Without one, everything you make (prompts, drafts, references and the images and videos you add) is saved only in your browser, in its local storage and IndexedDB. It never reaches us.

That also means we can’t recover it. Clearing your browser’s data for this site deletes it, and some browsers, Safari among them, delete a site’s storage when you haven’t visited for a while. An account keeps a copy for you.

With an account:

• Your account: your email address and the display name you choose in Settings. If you log in with Google, also the name and the address of the profile picture Google shares with us.
• Your work: the prompts you save (title, text, tags, favorites and the choices you made in the Prompt Builder), your current draft and your references (titles, notes, tags, links and the images and videos you upload, up to 50 MB each). Earlier drafts you put aside stay in your browser and are never uploaded.
• Login records: Supabase, which runs our login, records when you log in and from which IP address and browser, to keep accounts secure.

With or without an account:

• Messages you send us: what you write in Help and feedback or on the contact page, the page you sent it from, your account if you’re logged in and the email address you give us if you’re not.

We also measure how 1Prompt is used: the pages you open and the buttons you press, never what you type. See How we measure use. Your browser’s Global Privacy Control or Do Not Track setting turns it off.

We don’t ask for payment details, your contacts or anything else, and we never ask for your precise location.

We use only what the site needs to work:

• Login cookies (named sb-…-auth-token) keep you logged in.
• A one-hour cookie (op-next) brings you back to the page you were on after you log in.
• Local storage, session storage and IndexedDB hold your work on this device, your theme and a few small preferences, such as a checklist you closed or a note you dismissed.
• For measuring use (see How we measure use), local storage holds a random id for this browser (1prompt:visitor, with when it was made and where your first visit came from), the current visit’s id and the time of its last action (1prompt:session), how a login under way started, that it was recorded and which account last used this browser’s id (1prompt:analytics).

There are no advertising or tracking cookies, no tracking pixels and no third-party trackers. Measuring use sets no cookies of its own; when you’re logged in, your login cookie goes along with what’s recorded and links it to your account. Our fonts and scripts are served from our own site.

Two things in the studio load straight from another site, because you asked for them:

• YouTube thumbnails. When you save a YouTube link as a reference, your browser loads its thumbnail from YouTube (i.ytimg.com, run by Google), which sees your IP address. We don’t send it the page you’re on.
• Images and videos you add by link. They load from the site you linked to, which sees your IP address in the same way.

To see how 1Prompt is used and what to fix, the site records what you do in it, first-party: it goes from your browser to our own site and into our own database. The one other place is Vercel Web Analytics, which counts page views for us in aggregate, without cookies. It’s on unless your browser asks sites not to track it (below).

What we record:

• The pages you open, by their address without its query string (only the id of an example, prompt or reference the address opens is kept).
• The buttons and links you press, by their label (“Copy prompt”, “Save”), and what you do with them: submitting an idea, the choices you pick in the Prompt Builder and Camera Angles, copying or saving a prompt, opening an example, adding a reference (how many, not what), the command menu, the theme and the like. A button that shows your own words, such as a prompt’s title, is recorded by a fixed name (“Prompt card”), never by those words.
• Accounts: when a login link is sent, a code is entered or a Google login starts, and when you log in (by email or Google, and whether the account is new) or out.
• A random id for this browser, made on your first visit and kept in local storage for 13 months (it isn’t renewed when you come back; after 13 months, when you log out or when another account logs in on this browser, a new one replaces it), and an id for each visit, which ends after 30 minutes without any action.
• Roughly where and on what: country, region and city, worked out from your IP address by our host (the address itself isn’t stored, nor any coordinates); the kind of device (desktop, phone or tablet); and the browser’s and operating system’s names.
• Where your first visit came from: the referring site’s address without its query string, and the campaign tags (utm_…) of the link you followed, leaving out any tag that holds an email address.
• Errors and speed: error messages (with email addresses and query strings removed) and how quickly pages load and respond (Core Web Vitals).

Never recorded: what you type (ideas, prompts, titles, notes, tags, messages or your email address), the names of files you add, the rest of an address’s query string (beyond the ids and campaign tags above), your IP address or your precise location. Automated browsers and known bots aren’t recorded.

Who sees it: only the 1Prompt team, in an admin page open to the team alone. It shows totals, and also each visitor’s activity in order (a timeline); if you’re logged in, that timeline is linked to your account and its email address, including what you did in this browser before logging in (except in the places named next).

In the EU, the EEA, the UK and Switzerland, while you’re not logged in, your visits aren’t linked to each other: our server sets the browser’s id aside and counts each visit on its own. Once you log in, your visits are linked through your account.

Where and how long: in our Supabase database in the United States (us-east-1), with your account. It’s kept for 13 months, and older activity is deleted automatically. If the database nears its size limit, the oldest activity is deleted sooner, even recent activity if that’s what it takes, to keep room for your saved work. Deleting your account deletes all its activity at once.

Vercel Web Analytics: our host, Vercel, also counts page views for us, in aggregate. It uses no cookies, receives the page’s address without its query string and tells visitors apart only within a day, by a hash of the request that’s reset daily. It’s off in the same cases.

Turning it off: turn on Global Privacy Control or Do Not Track in your browser. While it’s on, nothing is recorded or sent from that browser.

Why we may: we have a legitimate interest in understanding how 1Prompt is used, keeping it working and improving it, kept to what’s described here and off for browsers that ask not to be tracked. In the UK we rely on the exception for storage used only for statistics (the Privacy and Electronic Communications Regulations, as amended in 2025). We don’t sell this data, use it for advertising or share it with advertisers.

• To run 1Prompt: log you in, save your work and keep it in step across your devices.
• To send the emails you ask for: your login link and code. We don’t send newsletters or marketing email.
• To answer your messages and fix what you report.
• To keep 1Prompt secure and working, for example by spotting abuse.
• To understand how 1Prompt is used and make it better (see How we measure use).

We use your data to provide the service you asked for and, for security, because we have a legitimate interest in keeping it safe. We don’t sell your data, we don’t use it for advertising and we don’t use your prompts or references to train AI models.

These companies process data for us, only to provide their service:

• Supabase: our database, login and file storage, in the United States (us-east-1). Your account, your work, your messages and the record of how 1Prompt is used are stored there.
• Vercel: hosts the website. Like any web host, it handles each request, including your IP address and browser, and keeps short-lived logs. It also works out the rough location we record from your IP address, and counts page views for us (Vercel Web Analytics).
• Resend: delivers our login emails, so it handles your email address.
• Google: only if you choose to log in with Google.

We share data with anyone else only if the law requires it, or to protect people’s safety or our rights. Our providers may process data in the United States and other countries; where the law requires it, we rely on safeguards such as standard contractual clauses.

Everything travels over HTTPS. In our database, every row of your work belongs to your account and row level security makes it unreachable for anyone else; your uploaded files sit in private storage under your account. There are no passwords to leak: you log in with a one-time link or code, or with Google. No system is perfectly secure, so if you see something wrong, use our contact form.

• Your account and work stay until you delete them or your account.
• When you delete a prompt or reference, its content is removed and a small marker (its id and when it was deleted) stays, so your other devices remove it too. A file you delete is removed from storage once Undo has passed, the next time 1Prompt syncs on one of your devices.
• Deleting your account deletes all of it at once: your profile, prompts, references, draft, files, messages and the record of how you used 1Prompt.
• The record of how 1Prompt is used is kept for 13 months, then deleted automatically, and sooner (oldest first) if our database nears its size limit.
• Our providers’ logs and database backups are kept for a limited time, then deleted on their own schedule.

• Export: in Settings, Export my data downloads your prompts and references as one file (the images and videos you uploaded are listed by name).
• Delete: in Settings, Delete account deletes your account and everything in it, straight away.
• Correct: change your display name in Settings.
• Log out everywhere: in Settings, Log out of all devices ends every session, here and on your other devices.
• Usage data: turn on Global Privacy Control or Do Not Track in your browser to stop it.
• Without an account: clear this site’s data in your browser to remove everything it holds.

Depending on where you live (for example under the GDPR, the UK GDPR or California law), you also have the right to access, correct, delete or move your data, and to object to or restrict how we use it. To ask, use our contact form. We’ll answer within a month. You can also complain to your local data protection authority.

1Prompt isn’t meant for children under 13, or under the age your country sets for agreeing to this on your own (16 in some countries). We don’t knowingly collect their data; if you think a child has made an account, use our contact form and we’ll delete it.

When this policy changes, we’ll update the date at the top. If a change matters, for example a new kind of data or a new company that processes it, we’ll also tell you in the app or by email before it takes effect.

For anything about your privacy or this policy, use our contact form.