Privacy policy

Summary

You can read every prompt, every tool entry and every article on this site without an account and without giving anything away. Signing in is optional and exists so that what you save follows you between devices. Sign-in itself is handled by Corenexis, so this site never sees or stores a password.

Advertising and measurement are the only places where a third party could ever see that you visited. Both are described in full below, including providers that are not yet in use, so that nothing appears on the site that this notice has not already told you about.

No account is needed to read anything.
No password is ever handled by this site.
No personal data is sold, rented or traded.
Advertising, where it runs, is served by named third-party networks under their own privacy notices.
Every part of your account can be deleted on request, and deletion means deletion.

Who is responsible for your data

WowPrompt is operated as a Corenexis product. Corenexis is the controller for personal data described in this notice, and requests about that data are handled through the Corenexis support desk. The contact page routes to the same place.

What this notice covers

This notice covers the website at wowprompt.in, its media and API subdomains, and the signed-in area. It does not cover the separate services this site links to. Every AI tool listed in the directory, every model you run a prompt in, and every site an outbound link points at is operated by somebody else under their own terms and their own privacy notice. Reading those is worth the few minutes, because what you type into a model is governed by that model's policy and not by this one.

Browsing without an account

The public pages are static files served from a content delivery network. Requesting one involves no lookup about you, no session and no database query tied to a person. There is no registration wall, no metered reading, and no requirement to accept anything before the content appears.

A content delivery network necessarily sees the request it is serving, which includes your IP address, the page you asked for, the time, and the user agent string your browser sends. That is how the internet works rather than something the site chooses to collect. It is used to deliver the page, to keep the cache working and to block traffic that is attacking the site, and it is not combined with your account or used to build any profile of you.

Signing in

Sign-in uses Corenexis as the identity provider over the standard OAuth authorization-code flow. You enter your credentials on Corenexis, not here. This site never receives your password and has no way to read it.

Once you have signed in, this site receives and stores your account identifier, your username, your display name, your email address and your profile picture, so that your account has a name and a face on it and so that support can identify you if you ask for help. These fields are refreshed from the provider each time you sign in, which means correcting them at Corenexis corrects them here.

Your session here is tied to your session at Corenexis rather than being independent of it. If you sign out at Corenexis, or an administrator there disables your account, the refresh token this site holds stops working and your session here ends at the next check instead of continuing on its own. Tokens held by this site are encrypted at rest.

What is stored against your account

The profile fields listed above, refreshed at each sign-in.
The prompts and tools you saved, and when you saved them.
The ratings you gave, and the value of each.
Which plan your account is on.
The time your account was created and the time it was last seen, so that dormant accounts can be identified.

That is the whole list. There is no advertising profile built from your account, no cross-site behavioural tracking of you as an identified person, and no inference about you stored anywhere.

Server logs and abuse prevention

The API writes a short-lived error log so that failures can be diagnosed. It records what failed and when. It is not an access log of who read what, and it is not used to study visitor behaviour.

Write actions such as saving, rating and starting a sign-in are rate limited. The limit is a counter that lasts a minute and is stored under a keyed hash, never under your address or your name, and old counters are cleared within the hour. It stops abuse without keeping a record of ordinary use.

View, copy and save counts

Every prompt shows how many times it has been viewed, copied and saved. Those counts are recorded against the prompt, never against a person, and they are aggregate numbers only.

The request that records one carries a rotating hash whose only purpose is to avoid counting the same visit twice within a short window. It is derived with a server-side secret, it is not an address, it is not stored next to anything that identifies you, and it cannot be reversed to a visitor. The counting request is sent after the page has finished rendering, so it never delays what you are reading. The numbers you see are real counts, not seeded or padded figures, and no single connection can add more than a small number of views to one prompt in a day, so a script cannot inflate them.

Cookies and local storage

This site sets one cookie of its own, and only once you have signed in. It holds a signed session identifier and nothing else. It is marked HttpOnly, so no script can read it, and Secure, so it never travels over a plain connection. It is scoped to this site's domain so the signed-in area and the admin portal can share a single session.

A second, short-lived cookie is used during the sign-in exchange to protect against cross-site request forgery. It is discarded as soon as the exchange completes.

Your theme preference and whether the sidebar is collapsed are kept in your own browser's local storage. They never leave your device and the server cannot read them.

This site sets no analytics cookie and no advertising cookie of its own. Where an advertising or measurement provider is enabled, that provider may set its own cookies or use similar storage; this is described in the next two sections, and you can control it through your browser settings and through the provider's own controls.

Advertising

This site is free to read, and advertising is how a free reference site of this kind is funded. Advertising may be displayed on public pages, including the gallery, prompt pages, the tools directory and articles.

Providers that may be used for this include Google AdSense, Google Ad Manager and Google AdX, and comparable third-party advertising networks, exchanges and header-bidding partners. Naming them here is not a statement that any of them is live today; an account with a network may be pending, under review or not yet applied for. The purpose of naming them in advance is that nothing can appear on the site that this notice has not already disclosed.

Where such a provider is enabled, it is a third party acting under its own privacy notice, and it may:

Set or read cookies, device identifiers or similar storage in your browser.
Receive your IP address, the page you are on, your approximate location derived from that address, your browser and device details, and the time of the request.
Use that information to select an advert, to measure whether it was seen or clicked, to cap how often you see the same one, and to detect invalid traffic and fraud.
Personalise advertising based on information it already holds about your browser, where the law and your own choices allow that.

This site does not send an advertising provider your name, your email address, your account identifier or the contents of your library. It does not sell or share personal information for money.

Where consent is legally required for personalised advertising or for non-essential storage, it is requested before that processing begins, and a refusal is respected: you continue to get the site, with non-personalised advertising or none at all. You can also manage Google advertising personalisation in your Google account settings, and adverts served by other networks through those networks' own opt-out pages and through your browser's cookie and tracking controls.

Regardless of provider, the layout rules for adverts on this site do not change. Every advert slot reserves its dimensions before anything loads, so no advert pushes content you are reading out of place, and no advertising script is allowed to run before the page is usable.

Analytics and measurement

The counts described above are the site's own measurement and they are aggregate by design. In addition, a third-party analytics or search-performance service may be used to understand which pages are useful and which are broken. Services that may be used for this include Google Analytics, Google Search Console, Bing Webmaster Tools and comparable privacy-respecting alternatives.

Search Console and Bing Webmaster Tools report on how the site appears in search results and receive no data about you as an individual visitor. Where a page-level analytics service is enabled, it may set its own storage and receive the same request-level details an advertising provider receives. It is never given your name, your email address or the contents of your library, and IP-address handling is configured to the most privacy-preserving option the service offers.

Embedded content and outbound links

Articles and tool entries may embed content hosted elsewhere, such as a video player or a code example. Loading an embed lets that host see the request in the same way visiting it directly would. Outbound links to AI tools are ordinary links; following one takes you to a service governed by its own notice, and the fact that a tool appears in the directory is not an endorsement of its privacy practices.

Images on this site are served from this site's own media subdomain rather than from third-party image hosts, so viewing a prompt does not hand your request to an unrelated service.

Prompts, reference photos and generated images

Prompts are text that you copy and run in a tool of your choosing. The generation happens there, not here. This site does not receive, store or see the images you produce.

Some prompts need a reference photo, which is flagged on the page above the copy control so you know before you start. That photo goes from your device to the tool you are using. It is never uploaded to this site, and this site has no access to it. Anything you type into a third-party model is subject to that provider's policy on training and retention, which is worth checking before you paste in anything sensitive.

Published prompts on this site never contain a hidden instruction that watermarks your output, inserts this site's name or otherwise marks what you generate.

Plans, payment and billing data

Every feature of this site is currently free. There is no paid plan at present, no subscription, no card on file and consequently no payment or billing data of any kind.

Paid plans may be introduced in the future. If and when that happens, payments will be processed by an established third-party payment provider that handles the card details directly; this site would receive a confirmation and a billing record rather than your card number, and this notice will be updated to name the provider and to describe the billing data kept before any charge is possible. Introducing a paid plan will not retroactively make an existing free feature paid without that change being stated plainly in advance.

Email and support

If you contact support, the message you send and the address you sent it from are held for as long as needed to resolve the matter and to keep a record of it. Support correspondence is handled through the Corenexis support desk.

Service messages related to your account may be sent to the address held by your identity provider. There is no marketing mailing list on this site, and you will not be added to one without asking.

Why we are allowed to process this data

For readers in jurisdictions that require a stated legal basis, the bases relied on are:

Performance of a contract, for running your account, your saved library and your ratings. Without this data there is no signed-in service to provide.
Legitimate interests, for keeping the site available, preventing abuse, diagnosing failures, and counting views and copies in aggregate so that the library can be ranked and improved.
Consent, for non-essential storage and for personalised advertising or analytics where the law requires it. Consent can be withdrawn at any time, and withdrawing it does not cost you access to the content.
Legal obligation, where data must be kept or disclosed to comply with a law that applies to us.

Personal data is not sold, rented or traded. It is shared only with the categories of service provider needed to run the site, and only to the extent each needs:

Corenexis, as the identity provider and as the operator of the support desk.
Hosting and content delivery providers, which serve the pages, the media and the API.
Advertising and measurement providers, as described above, and only the request-level information described there.
A payment provider, if and when paid plans exist.

Data may also be disclosed where we are legally required to do so, or where it is necessary to establish or defend a legal claim, or to protect the safety of a person. If the service ever changes hands, any transfer of data would be subject to this notice, and material changes would be stated here first.

Where your data is processed

The site is served from a content delivery network with locations worldwide, so a page is delivered from wherever is closest to you. The database and the API run on hosting in India. Service providers named above may process data in other countries, including the United States. Where personal data leaves its country of origin, we rely on the transfer mechanisms those providers make available, such as standard contractual clauses.

How long data is kept

Account and profile data: for as long as your account exists, and deleted when it is deleted.
Saved items and ratings: for as long as your account exists, or until you remove them yourself.
Sessions and tokens: until the session ends, expires or is revoked.
Individual interaction events: aggregated into per-prompt counters on a schedule and pruned after ninety days. The aggregate counters remain; the individual rows do not.
Error logs: rotated and discarded in the ordinary course of operating the service.
Support correspondence: for as long as needed to resolve and record the matter.

How data is protected

Traffic is served over HTTPS throughout, with strict certificate validation between the edge and the origin. Session identifiers are signed, tokens are encrypted at rest with authenticated encryption, and every database query is parameterised. The media host is a document root that cannot execute code, so an uploaded file cannot become a running program. The admin portal is reachable only through the same identity provider and enforces per-area permissions.

No system is beyond reach. What is described here is care taken, not a guarantee, and the retention limits above exist partly so that there is less to lose.

Your rights

Depending on where you live you may have the right to ask for a copy of the data held about you, to have it corrected, to have it deleted, to restrict or object to how it is used, to receive it in a portable form, and to withdraw a consent you previously gave. You also have the right to complain to your local data protection authority.

Ask through the support desk. Requests are answered without charge and within one month wherever that is practical; if a request is genuinely complex we will say so and give a date. You will not be treated differently for exercising a right.

Removing your account and data

Ask on the support desk and your account here, along with everything saved and rated under it, is deleted. Deletion removes the rows rather than flagging them as hidden. Aggregate counters that your activity contributed to remain, because they contain no reference to you and cannot be unpicked into individuals.

Deleting your Corenexis account removes your ability to sign in here as a matter of course, and you can ask for both in one request.

Children

This site is not directed at children, accounts are not knowingly created for them, and no data is knowingly collected from them. If you believe a child has created an account, tell the support desk and it will be removed.

Automated decisions and profiling

No decision affecting you is made automatically. Ranking, related prompts and recommendations are produced from aggregate counts and from the structure of the library, not from a profile of you as an individual.

If something goes wrong

If a breach occurs that is likely to affect you, affected accounts are notified and the relevant authority is informed where the law requires it. What happened and what was done about it will be stated plainly rather than described in terms designed to sound smaller than it was.

Changes to this notice

The date at the top of this page is the date it last changed. A change that affects what is collected, who it is shared with, or the introduction of a new advertising, measurement or payment provider will be reflected here before that change takes effect on the site, not after.

Contact

Questions about any of this, and any request about your data, go to the contact page, which routes to the support desk. See also the terms of use for the rules that govern using the site.