CLI data policy

The short version

Running the audit sends us nothing. Every path that transmits anything is a flag you type on purpose, and each one is listed below with what it sends and what it does not. Nothing the CLI sends is kept past 90 days — a waitlist address, which exists to be emailed once, is kept up to 12 months — and you can have any of it removed sooner. A report you shared you can delete yourself in one call; everything else takes an email to us, for a reason given at the end.

What leaves your machine, by command

Egress is tiered, and consent is proportional to it. The default is the top row.

How a request is identified

There is no account, so there is no user id. Two values do the work instead, and neither is tied to your name.

• An anonymous machine id accompanies scoring and report uploads. It is a truncated SHA-256 of your hostname and home directory — a one-way hash, not the values themselves — and it exists so repeat runs from one machine can be deduplicated rather than counted as separate people.
• An install key accompanies config reviews, which cost us model credits and therefore need a per-install budget. It is a random UUID generated on first use with no relationship to any machine attribute, stored at ~/.cc-audit/install.json. Delete that file and you get a new one.

The waitlist form

If you join the waitlist we store four things: your email address, which surface you submitted it from, the agent you said you use if you told us, and a SHA-256 hash of your IP address for abuse triage. The raw IP is never stored — only that hash. The surface and agent fields accept a fixed set of values rather than free text, so nothing else can end up in the row. It is not linked to any CLI run, joining is not required to use anything, and it is kept for up to 12 months rather than 90 days, for the reason given below.

We use it to tell you when the hosted version is ready. It does not go into a marketing sequence.

How long we keep it

90 days for anything the CLI sends, enforced by a scheduled job rather than by intention. Past that window every record is de-identified in place: identifiers are nulled, email addresses are cleared, shared report payloads are dropped, and the raw contents of reviewed config files are stripped.

What survives is the de-identified remainder — the scored findings and the aggregate shape, with nothing left that points at a person or a machine. We keep that because it is what calibrates the scoring, and because a count of how many audits ran in a given month should not require holding anyone's data to answer.

12 months for a waitlist address, and the difference is deliberate rather than convenient. The whole purpose of that row is to send one email at a date we cannot predict, so a 90-day window would delete the people it exists to contact and quietly break the promise on the form. It is not indefinite either: if the hosted version has not shipped in a year, the address goes.

A report you created with --open is public for as long as it exists. Treat its URL as published, and delete it if you would rather it were not.

Having it deleted sooner

An erasure request is a hard delete, not the de-identification the retention pass does. The rows are removed.

A shared report you can delete yourself, immediately. The last path segment of its URL is the handle, and the call takes the email attached to that report with it:

curl -X DELETE https://api.promptster.ai/v1/public/solo/data \
  -H 'content-type: application/json' \
  -d '{"reportId": "<last segment of the report URL>"}'

The response reports how many records were removed, so a mistyped handle reads as zeroes rather than as silent success.

Anything else goes through a person. Write to privacy@promptster.ai to remove a waitlist address, or every report from one machine at once.

That split is deliberate, and it is worth being explicit about why the slower path exists. A report URL is unguessable and is the only way to reach the report at all, so holding it is itself the proof of ownership — the way a password-reset link is. An email address is not: plenty of people know yours. An open endpoint that erased rows on the strength of an address alone would let anyone destroy your data, and the deleted-count in the reply would tell them whether you had ever signed up. Making that path slower is what keeps it from being a griefing tool wearing a privacy label.

To stop transmitting entirely, run the audit without --judge or --open. That is the default, and it is a complete answer — the local report is the product, not a teaser for a hosted one.

Who else sees it

Scoring runs on a hosted model provider, and the data is stored with the same infrastructure providers the rest of Promptster uses. They are listed on the sub-processors page. We do not sell any of it, and none of it is used to train a third-party model.

Changes

If the retention window or the deletion process changes, this page changes with the code that enforces it, and the date at the top moves. Questions go to privacy@promptster.ai.