Privacy & Cookie Policy

1. Who we are

prompt-x is operated by Mariano Morera Sánchez (Atomic Products). For data protection purposes, Mariano is the data controller.

Contact: hola@atomic-products.com

2. What we collect

Account data

When you sign up, we store your email address and, if you use OAuth (Google), the token needed to authenticate you. We never store passwords — authentication is handled by Supabase Auth. Your account data lives in a Supabase database hosted in the EU.

Product analytics — PostHog

Inside the app, we use PostHog to understand how features are used — which editors you open, which actions you take, where you drop off. Once you sign in, these events are tied to your account so we can improve the product for you specifically.

Session recording is disabled. PostHog runs as long as you have an active account; it is part of the service, not a marketing choice you can opt out of independently. If you close your account, your event history is deleted within 30 days.

Marketing analytics — GA4 & Microsoft Clarity

On the marketing site (prompt-x.io), we use Google Analytics 4 and Microsoft Clarity to understand which pages people visit and how they navigate. Both are off by default.

We run GA4 in Consent Mode v2 with all storage denied until you opt in. That means no cookies are set, no cross-site tracking happens, and no identifiers are stored until you give consent via the cookie banner. If you never consent, GA4 receives only cookieless aggregate signals.

3. Cookies

We use two categories of cookies:

Essential cookies

Supabase sets a session cookie when you sign in. This cookie is strictly necessary to keep you authenticated — the app cannot function without it. No consent is required for essential cookies.

Analytics cookies

GA4 and Clarity cookies are only set after you opt in via the cookie banner. If you decline or ignore the banner, no analytics cookies are placed.

4. Your consent choices

Marketing analytics are off by default. The cookie banner on your first visit lets you opt in. You can change your choice at any time by clicking Cookie preferences in the site footer.

PostHog product analytics are tied to your account and run while you are a registered user. They are not marketing trackers, so they fall outside the cookie consent flow.

5. Your rights

Under GDPR you have the right to:

• Access — request a copy of the data we hold about you.
• Rectification — correct inaccurate data.
• Erasure — ask us to delete your account and associated data.
• Portability — receive your data in a machine-readable format.
• Objection — object to processing where we rely on legitimate interests.

To exercise any of these rights, email hola@atomic-products.com. We respond within 30 days.

6. Data retention

Account data is kept while your account is active and deleted within 30 days of account closure. PostHog event history follows the same schedule. GA4 and Clarity data are subject to each platform's own default retention periods (GA4: 14 months; Clarity: 90 days).

7. Changes to this policy

When this policy changes materially, we update the “Last updated” date above. Continued use of prompt-x after changes are posted means you accept the revised policy.

8. Contact

Questions about this policy or your data: hola@atomic-products.com