Privacy Policy

Privacy first

OpenPrompt is built to keep your work on your own machine. Your projects, your captured prompts, your file history and your code stay local by default, and the only things that leave are the requests you deliberately make to a hosted feature.

We do not sell your data. We have never sold it, we do not share it with data brokers or advertisers, and we do not use your code or prompts to train AI models. There is no advertising in OpenPrompt and no third-party analytics or tracking SDK in the desktop app.

Privacy is not a section of this policy - it is the whole design. What follows says exactly where every piece of data goes.

What runs locally

The OpenPrompt desktop app stores your projects, captured prompts, file-change history, and settings on your own machine, in your home folder. That store is not uploaded.

The app watches the project folders you choose so it can attribute prompts and file changes to a project. It reads file paths and file contents inside those folders. It does not scan anything outside the folders you add, and every folder is one you picked and can remove.

The OpenPrompt API

Hosted features - Smart Enhance, commit messages, and the OpenPrompt agent - are answered by our own API. It runs on AWS, built with AWS Amplify: Amazon Cognito holds accounts, AWS AppSync and AWS Lambda serve requests, Amazon DynamoDB stores your usage counters, and Amazon Bedrock runs the models.

When you use one of those features, the text of that request goes to our API: the prompt you typed, the project context you chose to include, and the diff or file contents the feature needs. It is used to answer that request and is not kept beyond what the usage record below describes.

Signing in creates an account in Cognito holding your email, name, profile picture (if your identity provider supplies one), and the plan attributes that decide your limits.

We record one row per hosted call so you can see your own history and so plan limits can be enforced: the kind of call, its outcome, timings, sizes, and a short preview of the input and output. You can see exactly this on your dashboard, and it is the complete list of what we retain about your usage.

The models behind it

The OpenPrompt agent and the other hosted features run models through Amazon Bedrock, inside our AWS account. Bedrock serves models from several vendors - Anthropic, OpenAI, Amazon, Mistral AI, DeepSeek, Qwen, Moonshot AI and Z.AI among them - and the one that answers a given request is whichever is selected for that mode on your account.

Requests to Bedrock are processed by AWS under our agreement with them, within our account. AWS does not use them to train the underlying models, and neither do we.

When you instead connect a local CLI, the request never reaches us at all. It goes from your machine to that vendor under your own account: Claude Code to Anthropic, Codex to OpenAI, Cursor to Cursor, Antigravity to Google. Their terms, privacy policies and pricing govern it - we are not in the path and cannot see it.

GitHub

Connecting GitHub is optional. If you do, the access token you authorise is stored on your own machine and used only to clone, fetch, pull and push on repositories you act on from inside the app.

We do not receive a copy of that token, and OpenPrompt does not read your repositories from our servers. Everything git-related happens locally, by running git on your machine.

Security

Everything in transit is encrypted with TLS. Everything we store - your account in Cognito, your usage rows in DynamoDB - is encrypted at rest by AWS.

Access is per-account by construction: our API authorises every request against your own signed-in identity, and the database rules are written so one account cannot read another’s rows. Administrative access to accounts is limited to a named group and is used for support, not for reading your content - we hold no copy of your code or your prompts to read.

On your machine, your local store sits in your home folder under your own user account, and your GitHub token is stored locally and never sent to us. Permissions you grant the app are listed in Settings and can be revoked at any time.

If you find a security problem, write to support@openprompt.tech and we will work with you on it.

Your control

You choose which folders a project watches, and you can remove them at any time. Deleting a project deletes its captured prompts and history from your machine.

You can disconnect any CLI, disconnect GitHub, and turn off individual capture engines and hosted features in Settings.

To delete your account and the data held with it, write to support@openprompt.tech from the address you signed up with.

Children

OpenPrompt is a developer tool and is not directed at children under 13.