Security and data handling at HyperPrompt

Accounts and sessions

• You sign in with an email address and a password of 8 to 128 characters.
• You must verify your email address before you can use account features. Verification links expire after one hour.
• Password reset links expire after one hour. Resetting your password signs out your other sessions.
• Sessions last up to 30 days.

Who can see your content

• Personal prompts are visible only to you unless you publish them. A prompt appears publicly only when it is marked public, is not a draft, and is approved.
• Prompts saved from the editor are private. Prompts saved from the Chrome extension or imported from JSON start as private drafts.
• Prompts in a Team workspace are visible only to that workspace's members, and they can't be made public.
• If you request a private prompt you don't have access to, the API answers “not found”, so it doesn't reveal that the prompt exists.
• Evaluation suites, enhancement history, context snippets, and folders belong to a single account.

Team workspace access

• Each member has a role: owner, editor, or viewer. The server-side API enforces these roles. Viewers can't change prompts, and only the owner can approve prompts or manage members.
• Invitation links are single-use, contain a random token, and expire after 7 days. HyperPrompt stores only a hash of the token. The invitation can only be accepted by someone signed in with the invited email address.
• Active members plus pending invitations can never exceed the number of seats the owner paid for.
• Deleting a workspace requires typing its name, and it permanently deletes the workspace's prompts and discussions.

API keys and the browser extension

• API keys can be created in Settings on Pro and Team. The full key is shown once. HyperPrompt stores a SHA-256 hash of it plus a short prefix so you can tell keys apart.
• Keys created in Settings expire after 90 days. Through the API, you can set an expiry of 1 to 365 days or none. Each account can have up to 10 active keys, and Settings shows when each key was last used.
• Revoking a key blocks it on its next request. A general API key can call the same API routes as your signed-in account, so keep it as secret as a password.
• The Chrome extension uses its own credential. That credential can only improve a prompt, read your library, save a prompt, check its connection, and disconnect. It can't reach billing or account settings.
• The extension credential is issued only from a signed-in session on the HyperPrompt site. Connecting again revokes the previous extension credential.
• The extension sends text only when you choose an action such as Improve or Save.

Services that process your data

• AI requests go through OpenRouter. That includes prompt enhancement and evaluation runs, which send your template, test cases, and any judge request. Don't put secrets in text you send to a model.
• Stripe processes payments. According to our privacy policy, HyperPrompt does not store full card details.
• Postmark delivers transactional email, such as verification, password reset, and workspace invitations.
• Our privacy policy lists Vercel for hosting and analytics.

Abuse controls

• Rate limits apply to AI requests (10 per minute per account), prompt submissions, imports, comments, workspace invitations, and content reports.
• Signed-in users can report a public prompt as spam, unsafe, copyright, misleading, or other. Administrators review reports and can unpublish a prompt.
• The site sends headers that stop other sites from framing HyperPrompt pages and stop browsers from guessing content types.

Exporting and deleting your data

• On Pro and Team, Settings can export your account as a JSON file. The export includes your prompts with their versions and folders, rules, skills, MCP configs, context snippets, enhancement history, saved prompts, evaluation suites with their runs, workspace memberships, comments, and reports.
• On any plan, you can download library items one at a time.
• You can delete your account in Settings by typing DELETE. You have to cancel a paid subscription first, and you have to delete or transfer any workspace you own that has other members or prompts.
• Deleting your account removes your personal prompts, rules, skills, MCP configs, history, and other account records from HyperPrompt's application database. Prompts you wrote inside someone else's workspace stay with that workspace.

What HyperPrompt does not offer yet

If your organization needs any of the following, HyperPrompt does not provide it today:

• Two-factor authentication
• Single sign-on (SSO or SAML) or SCIM provisioning
• An exportable audit log (workspaces show a recent activity feed)
• A choice of data-residency region or customer-managed encryption keys
• Using your own model-provider API key
• Third-party security certifications, audit reports, or an uptime commitment. This page doesn't claim any.