Privacy Policy
Last updated 24 July 2026
PromptBook watches your terminal for a living, so it matters that you know exactly what leaves your machine. The short version: the Mac app works entirely offline and sends nothing. If you use Remote, your commands and notes are relayed between your devices — never written to our database, never written to our logs.
This policy covers the PromptBook Mac app, the iOS app, promptbook.sh, and PromptBook Remote. It is written by Tipasoft Inc., which makes PromptBook.
The Mac app on its own
Downloading and running PromptBook requires no account. There is no analytics SDK, no crash reporter, and no profiling of what you do in the app.
Your notes, attachments, and preferences stay on your Mac — notes and attachments under ~/Library/Application Support/Promptbook, window and pane preferences in the app's own settings. Your files are wherever you keep them; PromptBook only reads the folders you point it at.
The app makes two outbound requests on its own, both part of looking for a new version about once a day:
- An update check to api.github.com for the latest release. It carries no account information — to GitHub it looks like any anonymous request, and it reveals your IP address to them as any web request would.
- A check-in to us that says only "a macOS install running version X looked for an update". It carries no account, no cookie, and no installation identifier — nothing that distinguishes your Mac from anyone else's — so all we can count is how many checks happened on a given day, never how many people or which ones. The iOS app does the same thing.
Turning off automatic update checks in Settings stops both. Neither happens while you work; they fire only when a check is due.
What we never store
- Terminal input and output. Everything you type and everything your shell prints is forwarded between your Mac and your browser or phone and then discarded. It is never written to our database and never written to a log file.
- Note and file contents. Note titles, note bodies, file paths, file contents, and image attachments are relayed the same way and are never persisted on our servers.
- Card details. Payment happens on Stripe's own checkout. Card numbers never touch our servers.
- IP addresses, in any durable form. We hold an address in memory for up to about two minutes purely to rate-limit sign-in and form submissions. No table in our database has an IP column.
- Anything that fingerprints you. We record no user agent, no referrer, no screen size, no language, no location, and no advertising or device identifier.
What we do collect
Only what a specific feature needs, and only when you use that feature.
| What | When | Why |
|---|---|---|
| Email address and a bcrypt hash of your password, plus an account ID and creation date | You create an account for Remote | To sign you in and connect you to your own Macs. We never store the password itself and cannot read it. |
| Stripe customer and subscription IDs, subscription status, and plan | You subscribe to Remote | To know whether your subscription is active. These come back from Stripe; we send Stripe your email and account ID to open checkout. |
| Terminal tab names, your Mac's name, and window names | Your Mac connects to Remote | So you can tell your terminals apart in the browser and on your phone. Note that a tab name is built from its working directory and title, so it can contain a folder or project name. |
| Your email address and the landing page you arrived on | You subscribe to release notes | To send you the update emails you asked for. |
| Your name, email address, and message | You send the contact form | To read and reply. Messages are visible only to us on an admin page. |
| Anonymous counts: a page view, a signup, a newsletter signup, a download, and which landing page variant it came from | You visit promptbook.sh | To know which version of the page works. These rows carry no email, no account ID, no IP and no identifier of any kind — they cannot be traced back to a person, including by us. |
| A count of update checks, with the platform and the app version — and nothing else | The app looks for a new version, about once a day | To see roughly how many installs are still alive and which versions are still in use. Because there is no identifier, this counts checks rather than people. |
Cookies
We set exactly one cookie: pb_lp. It stores nothing but the name of the landing page variant you were shown — for example control — so that returning to the site does not shuffle the page under you, and so the counts above stay consistent. It lasts 30 days, it contains no identifier for you, and it is not used to sign you in.
We use no advertising, tracking, or cross-site cookies. Signing in uses a token your browser holds in local storage rather than a cookie.
The live chat widget on our marketing pages (see below) sets its own storage under its own rules.
Who else sees anything
- Stripe — payments. Receives your email address and account ID at checkout, and everything you type into their payment form. We receive back only the identifiers listed above.
- GitHub — hosts the app downloads and release notes. When you click a download link your browser is redirected to GitHub, which sees your IP address and browser as it would for any download.
- Railway — runs our server and database. Our data sits on their infrastructure.
- Aura Blaster — the live chat bubble on our marketing pages. It loads in your browser and can see your IP address, the page you are on, and whatever you type into the chat. It is not present when you are signed in to the Remote app.
- Apple — distributes the iOS app and notarises the Mac app.
We do not sell your data, and we do not share it with anyone for advertising. We would disclose data if the law genuinely required it.
How long we keep it
Account, subscription, terminal-session, newsletter, and contact-form records are kept until you ask us to delete them — we do not currently expire them on a schedule. Anonymous page counts are kept indefinitely because they identify nobody. Rate-limiting data disappears within minutes. Relayed terminal and note content is never kept at all.
Your choices
You can ask us to show you what we hold about you, correct it, or delete it — including your account, your terminal session records, your newsletter subscription, and any messages you have sent us. Deletion is handled by a person rather than a button today, so allow us a few days. Depending on where you live you may also have the right to object to processing, to receive your data in a portable form, or to complain to your local data protection authority.
To cancel a subscription without deleting anything, use your account settings.
Security
Passwords are stored as bcrypt hashes and are never recoverable, by us or by anyone who obtained a copy of the database. Traffic to the site and the relay runs over TLS. Sign-in tokens expire after 30 days; the connection ticket that opens a terminal expires after 60 seconds and works exactly once. The admin panel is behind a separate password and its own short-lived session.
No system is perfectly secure. If you find a vulnerability, please tell us through the contact form before disclosing it publicly, and we will work with you.
Children
PromptBook is not intended for children under 13, and we do not knowingly collect their data. If you believe a child has given us personal information, contact us and we will remove it.
International transfers
We are based in Canada. The providers we rely on — our hosting platform, Stripe, and GitHub — operate in the United States, so data covered by this policy is transferred to and processed there as well. If you use PromptBook from outside those countries, that transfer is part of using the service.
Changes
If we change this policy in a way that materially affects you, we will say so by email or on the site before it takes effect. The date at the top always reflects the current version.
Contact
Privacy questions and requests go through the contact form, or by email to contact@promptbook.sh.