Privacy Policy

Tests run on your own computer. Here is exactly what our server keeps, what it doesn’t, and where data goes.

Source draft of November 13, 2026. Deployment and operation are unverified. This is a pre-launch draft. It will be reviewed by a lawyer and finalized before we take payments. Anything not yet decided is marked as such.

01

About this policy

  • This describes how the Prefly desktop app, website, and subscription server handle personal information.
  • This document does not guarantee deployment, delivery or payment readiness. It describes implementation source; actual configuration, provider acceptance and retention/refund policies remain unfinished.
  • The privacy officer and operating company details will be added to this page before the official launch.

02

What stays on your computer

  • Run records, screenshots, and reports stay in Prefly’s data folder on your computer and aren’t sent to the server. You can delete old records in the app’s settings.
  • AI keys, test account passwords, and the subscription sign-in token are kept in the operating system’s keychain. AI keys and passwords are never sent to the server.
  • The Chrome used for testing starts with a fresh temporary profile each time, and that profile is deleted afterwards.
  • The app has no crash reporting. App screen usage records (screen recording) are sent as described under the app screen usage section and can be turned off in settings.

03

What the server receives, and why

  • Account: email (only if the identity provider verified it), name (the part of the email before @ if there is none), language, the sign-in method you used last, your user ID at the identity provider, and whether the email is an Apple hide-my-email address. Used to create and recognize your account.
  • Devices: the name of the computer you signed in from (macOS’s “Computer Name”, which may include your real name), operating system, app version, and last-used time. Used to show connected devices and let you disconnect them.
  • Phone number (if you add one): the number and when it was verified. Used to make sure a number belongs to only one account. Verification codes are stored without the original.
  • Usage records: each time AI is called through Prefly’s servers, the time, device or CI token, run ID, model, token counts, image count, duration, success or failure, and credits charged. Used for credit accounting and troubleshooting.
  • Subscription and payments: plan, period, amount, payment status, and the payment company’s payment ID and receipt link. The payment-method value used for renewals (issued by the payment company) is stored encrypted.
  • CI tokens: name (if given), last 4 characters, creation time, expiry, and last-used time.
  • Notification emails: recipient address, subject, and body (amount, device name, token ending, and similar). Used for receipts, failed payments, subscription endings, new devices, CI tokens, and account deletion.
  • Waitlist: email, language, the page you signed up from, inquiry topic, and sign-up time.
  • Connections: IP addresses are used only to count request limits and are kept only in server memory. Server logs record only the request method, path, and request ID.
  • Website: the language cookie lasts 1 year, and we use no analytics. Temporary authentication state and one-use account handoffs use same-tab sessionStorage. The sign-in method you used last is remembered only in your browser.

04

App screen usage recording (screen recording)

  • What: we record how you use the desktop app screens (where you click, screen changes, and how the screen layout changes) and send it to the subscription server. Typed text is masked, and the screens of the sites you test (live views, screenshots, evidence, videos) and secrets such as tokens, keys, and test accounts are left out.
  • Why: to improve the service and to see what went wrong when you contact support.
  • When: it is on by default, and the app tells you once when you first open it. It is sent only while you are signed in to the subscription server and is linked to that account.
  • Retention: deleted after 30 days, and deleted together with your account.
  • Turning it off: switch off "Send usage recordings (screen recording)" in desktop app Settings > Data and it stops right away.

05

What we don’t store

  • When AI is called through a Prefly plan without a key (in preparation), screenshots, instructions, and responses aren’t kept in the server database or logs. An automated test checks this.
  • We never handle passwords. Sign-in is handled by the identity provider.
  • Sign-in tokens and CI tokens are stored only as hashes (values that can’t be turned back), never as the original.
  • Notifications from the payment company are stored only as a hash for duplicate checks, without their contents.

06

Where data goes

  • AI companies (with your own key or a program on this computer): screenshots and instructions go straight to the company you chose (for example OpenAI, Anthropic, or Google), or Codex or Claude Code on this computer sends them. That company’s terms and privacy policy apply.
  • AI companies (Prefly plan without a key, in preparation): Prefly’s server sends requests to OpenAI or Anthropic with Prefly’s key. No account information is included, and requests to OpenAI ask it not to store them. We’re confirming both companies’ data retention and training terms through contracts.
  • The source uses self-hosted Keycloak OIDC. Actual email, SMS and payment providers, service deployment and operating settings need separate confirmation and disclosure. Source availability is not delivery or payment readiness.
  • The waitlist may be forwarded to a tool the team uses. Which tool will be listed here once chosen.
  • When filling in a new project’s name and icon, the engine reads the first screen at that address. Apart from a label identifying itself as Prefly, it sends no cookies or account information.
  • The list of virtual customers is downloaded from Hugging Face.

07

Retention and deletion

  • Cleanup code exists for phone verification records and sent notification emails. A digest barrier for the deleted issuer and subject is retained without expiry to prevent old-token re-registration or attachment to another account. It is not a sign-in link deleted after 30 days.
  • Local deletion removes personal data, payment methods and unsent mail, and revokes app and CI access. Identity-provider cleanup is separately pending, retrying, blocked or complete. External billing remains notConfirmed. Actual provider, refund, compensation and retention policies are unfinished.
  • Only phone verification records from the last 24 hours are kept one more day, detached from the account, to prevent abuse, then deleted.
  • After deletion, usage records, credit records, subscription and payment records, device names and operating systems, and CI token names remain, linked to the account number.
  • How long these records are kept, and whether to remove the account number from them, hasn’t been decided. It will be set after legal review.
  • Durable work records deletion of the original identity-provider user. Local deletion does not guarantee that external deletion succeeded. Delays, blocks and unknown results are shown separately.

08

Your rights

  • On the account page you can see your email, connected devices, phone number, and plan; disconnect devices; remove your number; and delete your account.
  • A channel for other requests to access, correct, or stop processing your information will be added to this page before the official launch.

09

Not decided yet

  • AI companies’ data retention and training terms (being confirmed through contracts)
  • Actual email, text-message and payment providers, and identity/server operating settings
  • How long payment and usage records are kept, and whether to remove the account number from deleted accounts’ records
  • Privacy officer, operating company details, and a contact email