Privacy
What [Legal entity name] stores when you use InstantPRD, who else sees it, and what you can ask for.
Effective[YYYY-MM-DD]
This page describes what InstantPRD actually does with your data and under what terms it is offered. It is written from the code, not by a lawyer, and it is not legal advice.
Account data
When you create an account we store your name, email address, whether that address has been verified, an avatar URL if you have one, your interface language and your role.
How you sign in decides what sits beside it. Email and password means we store an argon2 hash of your password and never the password itself. Signing in with Google, where the operator has configured it, means we store the tokens Google issues for your session along with the scope you granted. Short-lived verification records are kept while a sign-in or reset flow is in progress.
Session data
Each signed-in session stores its token, its expiry, and the IP address and browser user-agent it was created from. The IP address and user-agent are personal data and we name them here rather than leave them implied.
Sessions are deleted with your account and expire on their own.
What you create
Plans, PRD versions, features, tasks, comments, revision-chat messages and repository scan results are stored in our database.
They are visible to the members of the plan they belong to, and to any coding agent holding an access token scoped to that plan. Publishing a plan makes its contents readable by anyone who has the link, until you revoke it.
AI providers
Generating a PRD or a task board sends your idea, and the plan content it produces, to a third-party model provider. Which one depends on how the operator has configured this deployment: Anthropic, OpenAI, OpenRouter, or any OpenAI-compatible endpoint the operator names — which may be a service they run themselves.
Content you submit for generation leaves our systems and reaches that provider under that provider's own terms. Do not submit content you do not have the right to send to a third party.
AI usage records
For every generation request we keep a usage record: your user id, the plan id, the step name, the provider and model used, input and output token counts, how long it took, whether it succeeded, and — when it failed — the error message the provider returned.
This is metadata rather than a copy of your content. The one honest caveat: a provider's error message can quote part of the request that caused it, so a failed request may leave a fragment of its input in that record.
Evidence screenshots
A coding agent working on your plan can upload screenshots as evidence that a task is done. They are stored on the server's disk or in an S3-compatible bucket, depending on how the operator configured storage, and are served to plan members through this application.
These screenshots are kept until something deletes them, and one thing now does: when a plan's owner resets that plan's task board, the screenshots belonging to it are deleted along with the tasks. Nothing else deletes them yet — not reopening a task, and not deleting the plan. If you need one removed, ask us at [privacy@example.com].
Access tokens
Tokens issued to your coding agents are stored as an argon2id hash plus a short readable prefix, so we can identify a token without being able to reproduce it. The token itself is shown to you once, when it is created, and never again.
Revoking a token takes effect within seconds and cannot be undone.
Your own provider keys
If you supply your own AI provider API key, it is encrypted with AES-GCM before it is stored and is never sent to the browser. It is decrypted only on the server, to make the request you asked for.
Payments
Checkout runs through Midtrans and/or Stripe, depending on the operator's configuration. Card and bank details are handled by those providers and never reach us.
We receive and store the result: your subscription tier, its status, and the usage quota that follows from it.
Rate-limit counters
We keep a short-lived counter per access token per time window, so an agent cannot exhaust the service for everyone else. It holds a count and a window, not the contents of the requests.
Your rights, stated honestly
You can export any plan at any time, as a PRD in Markdown or as a ZIP bundle, from the plan itself. That is a self-serve action and needs no request.
Deleting your account is not self-serve today: this product has no in-app account-deletion path, so deletion, correction and access requests are handled by email to [privacy@example.com]. We would rather say that than draw a button that does not exist.
Depending on where you live you may have rights to access, correct, export or erase your personal data, and to object to some processing. [Legal entity name] is the controller for those requests; the AI providers above act as processors for the content you send them.
Contact
Privacy questions and requests: [privacy@example.com]. Postal address: [Registered address].