Draft, pending counsel review.
Security & privacy
Your prompt library is yours alone.
PromptDrawer holds work you'd rather not lose and wouldn't want shared. Here is exactly how it is kept private, in plain language.
- Who can read my prompts?
- Only you. Every folder, prompt, example and version is tied to your account and enforced at the database level, so one account can never read or write another account's rows — the rule is applied by the database itself, not just by the app screens.
- Is my data encrypted?
- Yes in transit: the whole site is served over HTTPS and refuses insecure connections. Data at rest sits in a managed Postgres database with encrypted storage and automated backups.
- Do you use my prompts to train AI models?
- No. Prompt text is sent to the AI provider only when you ask for an enhancement, an example or a transcription, and only for that request. We do not sell your content or use it to train models.
- Where do the AI requests go, and is my API key exposed?
- AI requests run server-side through a managed gateway. There is no API key to paste, and no key is ever present in the browser.
- How do you sign me in?
- Sign-in is handled by Google. PromptDrawer never sees or stores a password, and your session is validated on the server for every protected request.
- What stops spam and abuse on the public form?
- The early-access form is protected by a Cloudflare human check that is verified on our server before anything is stored or emailed. A submission with a missing or invalid check is rejected server-side, not just in the browser.
- What protects the site from injected scripts?
- An enforced Content Security Policy restricts which scripts, styles, images and connections the site may load, and blocks everything else. Blocked attempts are reported back to us and reviewed. The site also refuses to be embedded in other people's pages, and camera, location, payment and similar browser features are switched off (the microphone stays available for voice dictation).
- Can I export or delete everything?
- Yes. Any prompt or example can be copied out as Markdown at any time, and deleting your account removes your folders, prompts, examples and version history permanently.
- How do I report a security problem?
- Use the feedback link in the footer or the early-access form and mark it as a bug. Security reports are read first. Please don't post details publicly before we've had a chance to respond.
Reporting a vulnerability
Email promptdrawer@airworthyadvisory.com, or see /.well-known/security.txt. Test only against your own account and data; do not access or change other people's data or disrupt the service; give us reasonable time to fix an issue before disclosing it. We will not pursue good-faith research that follows these rules.
PromptDrawer is an independent product in early access. This page describes current practice, not a contractual guarantee — see the Terms and Privacy Policy.
PromptDrawer is operated by Airworthy Advisory LLC, a Nevada limited liability company. Security questions: promptdrawer@airworthyadvisory.com.
Last updated