Privacy Policy

Last updated: September 2026

1. Controller

Prysm Note is the data controller for the personal data described in this policy.

For any privacy question, data subject request, or concern, contact us at [email protected]. We respond to all verifiable requests within the timeframes required by law.

2. Data We Collect

We collect only the data needed to provide the service:

  • Account Data: Email address and display name for authentication and communication.
  • Task Data: Tasks, projects, tags, notes, and other productivity content you create within the app.
  • AI Chat Data: AI chat messages, rolling session summaries, and short-lived cached AI responses, kept so the AI features work and your conversations persist across sessions.
  • API Keys: If you connect your own LLM provider, your key is encrypted using Fernet before storage, decrypted in memory only when a request is made, and never logged or persisted in plaintext.
  • Voice Data: When you use voice capture, the resulting transcript text is stored as part of your chat session. Audio is processed as described in Section 5 and never stored on our servers.
  • Server Logs: Standard technical logs (IP address, request time, route) retained for security and debugging.
  • Security Monitoring: Requests to decoy paths that no real user flow reaches (for example common scanner targets such as /wp-login.php or /.env) are logged at our edge with a salted, one-way hash of the visitor IP (never the raw address), plus the ASN, country, user agent, method, path and response status. We use this only to detect and block automated scanning and credential harvesting. Raw IPs are not stored, and the hashes are deleted after 30 days.
  • Payment Data: If you subscribe to a paid plan, billing data is processed by our payment processor; we do not store full card details.

We use first-party, cookieless product analytics as described in Section 8. We do not use advertising or third-party tracking.

3. Purposes and Lawful Bases

We process personal data only for specific, legitimate purposes:

  • Providing the service and AI features: to run the application you asked us to run, including processing your prompts through AI providers. This processing is necessary for the performance of our contract with you (Art. 6(1)(b) GDPR).
  • Security, abuse prevention, and account isolation: we enforce row-level security, rate limits, session controls, and decoy-path monitoring (Section 2) so your data is isolated from other users and automated scanning is detected and blocked. This processing is in our legitimate interest and yours (Art. 6(1)(f) GDPR).
  • Responding to privacy and legal requests: to honor your data-subject rights and comply with our legal obligations (Art. 6(1)(c) GDPR).

We do not use your data for marketing. Prysm Note does not train models on your prompts.

4. Retention and Your Rights

Account and task data is kept while your account is active. AI chat history is kept until you delete the session (in-app) or delete your account. Cached AI responses are stored for about 5 minutes. Security logs are kept for a bounded period and then deleted; the hashed scanner-detection records described in Section 2 are deleted after 30 days.

If you are in the EEA or UK, you have the right to:

  • Access a copy of your personal data.
  • Rectification of inaccurate or incomplete data.
  • Erasure of your data, including deleting your account in-app.
  • Restriction or objection to processing.
  • Portability of your data in a machine-readable format.

You can exercise these rights in-app (for example, deleting AI sessions or your account) or by emailing [email protected]. You also have the right to lodge a complaint with a supervisory authority.

5. AI Features and Third-Party Providers

Hosted PrysmAI. When you use our hosted AI (PrysmAI), your prompts are transmitted to OpenRouter, a US-based AI gateway we engage as a processing partner for hosted AI, and each user is assigned a per-user key capped in USD. Every PrysmAI request is sent with Zero Data Retention (ZDR) routing, which instructs OpenRouter and the model providers serving the request not to store your prompts or outputs and not to use them for training. Each request is served by an efficient, effective model selected by region, with fallbacks chosen for reliability and cost. PrysmAI is refused for requests from restricted jurisdictions (currently Russia and Belarus). We keep these arrangements under review. We recommend you do not enter sensitive personal data (such as health, religion, or financial details in special-category terms) into AI prompts. See OpenRouter's privacy policy for how OpenRouter processes data on its side.

Bring Your Own Key (BYOK). If you connect your own key (OpenAI, Gemini, DeepSeek, or OpenRouter), your prompts go directly to the provider you choose using your own key, and that provider's privacy policy applies. OpenRouter is a US gateway (EU-US DPF certified, no-training) but routes DeepSeek models across multiple hosting providers, some of which may be located in China; you can restrict routing or enable Zero Data Retention in your OpenRouter settings.

Voice Data. Voice capture uses different paths depending on your browser. In Chrome and Safari, the browser's built-in Web Speech service processes your speech directly on your device and sends the audio to Google's speech service; Google's terms apply to that processing. In browsers where that service is blocked or unavailable (Firefox, Brave, VPNs, ad-blockers), Prysm Note records your audio and sends it to our server, where it is transcribed via OpenRouter's Whisper model with Zero Data Retention (ZDR) routing, so the provider does not retain your audio or transcript. We do not store audio recordings; only the resulting text is kept as part of your chat session.

Google Calendar and SSO. Google OAuth and Calendar tokens are encrypted at rest with Fernet and decrypted in memory only when a request is made. GitHub OAuth is used only for sign-in.

6. Third-Party Processors

We share personal data with the following processors, only to the extent needed to provide the service:

  • OpenRouter (AI gateway for hosted PrysmAI, with Zero Data Retention enabled on every request).
  • AI model providers (selected regionally for hosted PrysmAI, with Zero Data Retention demanded on every request).
  • Your chosen BYOK LLM providers (OpenAI, Gemini, DeepSeek, OpenRouter) when you connect a key.
  • Netcup (hosting provider).
  • Cloudflare (CDN and network tunnel).
  • Brevo (transactional email).
  • Google (OAuth sign-in and Calendar).
  • GitHub (OAuth sign-in).
  • Payment processor (for paid plans).

7. Cookies

We use only strictly necessary cookies (session auth, CSRF protection, and OAuth flow state). We do not use advertising, marketing, or tracking cookies. See our Cookie Policy for details.

8. How We Measure Product Usage

We use first-party, cookieless product analytics to understand how Prysm Note is used and to improve it. No third-party trackers, advertising pixels, or analytics cookies are involved.

  • What is collected: events such as "signed up", "task created", "voice capture used", and "trial started", keyed to your account, together with a random per-session id stored in your browser.
  • What is not collected: task content, chat messages, or anything you type into the app. Analytics never reads your personal data.
  • Retention: raw events are kept for 90 days and then deleted; only anonymized daily aggregates are kept.
  • Legal basis: legitimate interest in measuring and improving the product (Art. 6(1)(f) GDPR). The data is not sold or shared with third parties.

Separately, the public site uses Cloudflare Web Analytics, a cookieless, privacy-friendly traffic measurement that does not identify individual visitors.

9. Contact

For privacy-related inquiries, contact us at:

[email protected]