Privacy Policy — Prompt Gateway

Effective date: September 3, 2026  ·  Contact: admin@promptgateways.com

Prompt Gateway is a Chrome (Manifest V3) extension that prepares your own input for an AI model — turning what you type, say, or paste into a better-structured prompt, context file, or plan. It does this by sending your input to the Prompt Gateway service and returning the result. The extension never answers your question itself. This policy explains exactly what it handles, what it does not keep, and where data goes. It is written to match how the software actually behaves.

What the extension does

The extension adds a single side panel containing three tools, which you switch between with a tab strip:

• Prompt Gateway — you speak or type a scenario; it asks any clarifying questions and returns an engineered prompt.
• Prompt Smart — you paste in a conversation you had with another AI tool; it returns a portable context file you can hand to a different model.
• Prompt Plan — you write a description of a task; it asks up to three clarifying questions and returns a structured plan file.

All three take input you supply, send it to the Prompt Gateway service over an encrypted (TLS) connection, and return a document you then use elsewhere. None of them answers your topic, and there is no model-execution step.

What data is handled

• Voice audio — only while you hold the microphone button (push-to-talk). Audio is captured in the browser and streamed to the Prompt Gateway to be transcribed. It is used solely to produce your result.
• Prompt text — what you type, the transcript of what you say, your answers to clarifying questions, and the resulting engineered prompt.
• A conversation you paste in (Prompt Smart). When you use Prompt Smart, the text you paste — which may be an entire conversation you had with a different AI tool, including anything you or that tool wrote in it — is sent to the Prompt Gateway service to be turned into a context file. It is sent exactly as you pasted it; the extension does not add to it, and it does not edit or reinterpret it.
  Nothing is sent until you confirm. After you paste, the extension shows a consent step naming the real destination it will send to and the size of what will be sent, and no part of the paste leaves your browser until you press the button on that step. The step appears every time you capture — there is no "don't show this again" and no setting that turns it off. If you close the panel or go back instead, nothing was transmitted.
• A task description you write (Prompt Plan), together with your answers to its clarifying questions. If you choose to attach a context file that Prompt Smart produced earlier, that attached text is sent with the task — so content originating in a conversation you pasted can reach the service a second time as part of a plan request. The panel shows when a context file is attached and lets you remove it before sending.
• Authentication data — a sign-in token from Google Identity Platform used to authenticate you to the gateway, a client-safe copy of the usage policy that applies to you, and the list of which tools your plan includes.

What is NOT stored

• No transcripts, no audio, no prompts, no pasted conversations, no task descriptions, and no results are persisted by the extension. They live only in the memory of the open side panel and are gone when you close it.
• By default the only values the extension stores are your authentication token and the client-safe policy, and only in chrome.storage.session — an in-memory area that Chrome clears when the browser closes and that web pages cannot read. Small non-sensitive UI preferences (light/dark theme, which tool was last open) may be stored locally. Those preferences record a setting, never any content.
• "Keep me signed in on this device" (optional). If — and only if — you tick this box at sign-in, the extension keeps you signed in across browser restarts by saving a single sign-in refresh token to local storage in encrypted form (it is never stored as readable text, and the encryption key stays in your browser and never leaves your device). No conversation content is ever saved. Leaving the box unticked keeps the default above (you are signed out when the browser closes). Signing out deletes the saved token and its encryption key.
• The only way anything is saved to disk is if you click the download action in a tool — Save chat, Download context file, or Download plan — which writes a Markdown (.md) file to your own device. The extension never uploads or retains that file. Because nothing else is kept, closing the panel without downloading discards the result.

Where data goes (no third parties)

The extension communicates only with the Prompt Gateway service at https://edge.promptgateways.com (over TLS) and Google Identity Platform endpoints (identitytoolkit.googleapis.com, securetoken.googleapis.com) for sign-in. It makes no other network calls. There are no advertising, analytics, or third-party tracking services, and your data is never sold. These restrictions are enforced by the extension's host_permissions and Content Security Policy, which allow those addresses and nothing else. The extension does not read the web pages you visit — there is no page-reading capability of any kind, and that includes Prompt Smart, which works only from text you paste in yourself.

Server-side processing (transparency note)

Once your input reaches the Prompt Gateway, it is processed by backend services to build your result, which includes sending your content to a language model that authors the final document. In the current configuration, server-side redaction and encryption stages are turned off for cost reasons, so your text reaches the authoring language model without automated redaction. A safety check still runs. Please avoid entering sensitive personal information you would not want processed by that service — and note that this applies equally to a conversation you paste into Prompt Smart, which may contain more than you remember writing. The no-storage guarantees above are about this extension on your device and are unaffected.

Who is responsible for your data

This depends on how you got Prompt Gateway, and it changes who you should contact.

• If you signed up yourself (an individual or a team buying directly), Prompt Gateway, Inc. is the controller of your data. Contact us at admin@promptgateways.com for any request about it.
• If your employer or another organization deployed it for you, that organization configures the service and sets the usage policy applied to your account. They are the controller for the content you submit through it, and we process it on their behalf. Contact your organization's administrator first; you can also write to us at the address above and we will direct your request.

Permissions and why they exist

• sidePanel — draws the single side-panel interface (the only surface).
• storage — holds the session-only auth token and policy, the local UI preferences, and (only if you choose "Keep me signed in") an encrypted refresh token.
• identity — completes the Google Identity Platform sign-in token exchange.
• contextMenus — adds a right-click entry to open the panel.
• Microphone — requested at runtime by Chrome when you first use push-to-talk; used only to capture your voice for transcription. No microphone permission is declared in the manifest.
• Host permissions — limited to https://edge.promptgateways.com and the two Google Identity endpoints above. No page or tab access of any kind is requested.

Data retention and deletion

Because the extension stores no content, there is nothing to delete on your device beyond closing the browser (which clears the session store), signing out (which also deletes the optional encrypted "Keep me signed in" token and its key), or removing the extension. Files you chose to download are yours and are never touched by the extension again.

For data handled by the Prompt Gateway service itself: if you signed up directly, write to admin@promptgateways.com. If your organization deployed the extension, contact your organization's administrator, who controls that service's configuration.

Children

Prompt Gateway is a productivity tool for general and professional use and is not directed to children under 13.

Changes to this policy

If this policy changes materially, we will update the effective date above and the hosted page.

Contact

Questions about this policy: admin@promptgateways.com.