PromptPilot Tab 隐私政策 / Privacy Policy

生效日期 / Effective date: 2026-08-26

最后更新 / Last updated: 2026-09-08

运营者与联系方式

PromptPilot Tab（以下简称“PromptPilot”或“本产品”）由个人开发者 JIANG ZIHAN 运营，运营地为新加坡。JIANG ZIHAN 是本政策所述个人数据处理活动的数据控制者或个人信息处理者。

如对本政策、个人数据或隐私权利有任何疑问、请求或投诉，请联系：support@promptpilot-tab.com。

Operator and contact

PromptPilot Tab (“PromptPilot” or the “Product”) is operated by JIANG ZIHAN, an individual developer based in Singapore. JIANG ZIHAN is the data controller（数据控制者）or personal information handler（个人信息处理者）for the processing described in this policy.

For questions, requests, or complaints concerning this policy, personal data（个人数据）, or privacy rights, contact support@promptpilot-tab.com.

适用范围

本政策适用于 PromptPilot Tab 浏览器扩展、promptpilot-tab.com 官方网站，以及由 PromptPilot 直接提供并明确链接到本政策的账号、社区、反馈和官方 AI 服务。第三方 AI 对话网站、用户自行配置的模型服务商，以及从本产品跳转的其他第三方网站适用其各自的隐私政策。

本政策不适用于未来尚未发布的功能。若新功能需要处理新的数据类型或以新的目的使用数据，我们会先更新本政策，并在法律或 Chrome Web Store（Chrome 网上应用店，CWS）政策要求时，在产品内另行醒目告知并取得同意。

Scope

This policy applies to the PromptPilot Tab browser extension, the official website at promptpilot-tab.com, and the account, community, feedback, and PromptPilot official AI（PromptPilot 官方 AI）services provided directly by PromptPilot and expressly linked to this policy. Third-party AI chat websites, model providers configured by the user, and other third-party websites linked from the Product are governed by their own privacy policies.

This policy does not cover unreleased future features. Before a new feature handles a new category of data or uses data for a new purpose, we will update this policy and, where required by applicable law or Chrome Web Store（Chrome 网上应用店，CWS）policy, provide a prominent in-product notice and obtain consent.

隐私要点

• 默认的本地规则引擎在浏览器内处理当前输入，不把提示词发送给 PromptPilot 服务器。
• 只有用户主动触发官方 AI 或用户自带密钥功能时，待优化内容才会发送到相应的模型服务。
• PromptPilot 不抓取完整对话历史，不建立用户的完整浏览历史，也不读取不受支持网站的页面内容。
• PromptPilot 不出售个人数据，不将个人数据用于个性化广告、再营销、信用评估或数据经纪业务。
• PromptPilot 不使用用户的提示词或 AI 输出训练自有模型。
• 当前版本的官网不使用广告 Cookie（网络存储标识）或第三方网站分析工具。

请勿在提示词、评论、投稿、举报或反馈中提交完成相关功能所不必要的密码、API Key（应用程序编程接口密钥）、身份证件、金融、健康或其他敏感个人数据。

Privacy summary

• The default local rules engine（本地规则引擎）processes the current input in the browser and does not send prompts to PromptPilot servers.
• Content is sent to a model service only when the user explicitly triggers PromptPilot official AI or Bring Your Own Key（用户自带密钥，BYOK）.
• PromptPilot does not scrape complete conversation history, build a complete browsing history, or read page content from unsupported websites.
• PromptPilot does not sell personal data, or use it for personalized advertising, retargeting, credit assessment, or data brokerage.
• PromptPilot does not use user prompts or AI outputs to train its own models.
• The current website does not use advertising cookies（广告 Cookie）or third-party website analytics.

Do not include passwords, API keys（应用程序编程接口密钥）, identity documents, financial, health, or other sensitive personal data in prompts, comments, submissions, reports, or feedback unless strictly necessary for the feature you requested.

AI 对话网站访问权限

PromptPilot 在安装时只请求 AI 对话网站的固定主机权限，当前权限范围包括 ChatGPT、Gemini、DeepSeek、Kimi、Perplexity、通义千问、Qwen、Grok、豆包、Claude、腾讯元宝和 NotebookLM，共 12 个产品、15 条域名匹配规则。12 个产品均已完成 Chrome 稳定版中的真实输入框识别、预览、插入和撤回冒烟；15 条规则是部分产品为兼容新旧官方入口而使用的精确域名数量，并不表示会访问任意网站或任意子域。

Content Script（内容脚本）只读取用户当前正在编辑的输入框内容，用于识别输入框、在浏览器内生成并显示可编辑预览，以及在用户按 Tab 或点击插入后写回同一输入框。它不会为了提示词增强而抓取完整对话历史。

默认本地规则在浏览器内处理当前输入，不将其上传到 PromptPilot 服务器或任何模型服务商。只有用户主动触发官方 AI 优化时，当前输入、待优化的本地草稿和必要场景信息才会发送到 PromptPilot 网关和所选模型服务商；使用用户自带密钥功能时，只有用户主动触发后才会直接发送到用户选择的服务商。PromptPilot 不将这些内容用于训练。云端失败不会关闭本地规则能力。

首次使用 Google 登录、PromptPilot 官方 AI 或保存 BYOK 配置时，扩展会先以当前界面语言显示相应的数据处理说明。只有用户点击“同意并继续”后，扩展才会分别启动 Google 登录、发送官方 AI 请求，或申请所选模型服务商的精确主机权限并保存 Key；取消、关闭或拒绝不会执行对应操作。同意状态保存在当前浏览器，后续每次 AI 请求仍必须由用户主动触发。用户可以停止使用相关功能、退出账号、删除 BYOK 配置或撤销相应权限。

AI chat website access

PromptPilot requests fixed host access at installation only for AI chat websites（AI 对话网站）. The current permission scope covers 12 products and 15 hostname match patterns: ChatGPT, Gemini, DeepSeek, Kimi, Perplexity, Tongyi, Qwen, Grok, Doubao, Claude, Tencent Yuanbao, and NotebookLM. All 12 products have completed real-browser smoke testing in stable Chrome for composer detection, preview, insertion, and undo. The 15 patterns are exact hostnames used where a product has current and legacy official entry points; they do not grant access to arbitrary websites or subdomains.

The Content Script（内容脚本）reads only the composer content that the user is currently editing. It uses that content to identify the composer, generate and display an editable preview in the browser, and write the result back to the same composer only after the user presses Tab or clicks insert. It does not scrape complete conversation history for prompt enhancement.

The default local rules engine（本地规则引擎）processes the active input in the browser and does not upload it to PromptPilot servers or any model provider. Only when the user explicitly invokes PromptPilot official AI（PromptPilot 官方 AI）optimization are the current input, local draft to be optimized, and necessary scene information sent to the PromptPilot gateway and selected model provider. With Bring Your Own Key（用户自带密钥，BYOK）, content is sent directly to the provider selected by the user only after the user explicitly invokes the feature. PromptPilot does not use this content for training. A cloud failure does not disable the local rules engine.

Before the first use of Google sign-in（Google 登录）, PromptPilot official AI, or saving a BYOK configuration, the extension displays a data-processing explanation in the current interface language. The corresponding operation starts only after the user selects “Agree and continue（同意并继续）”: Google sign-in then begins, an official AI request may then be sent, or the exact provider-host permission may then be requested and the key saved. Canceling, closing, or declining does not start that operation. The consent state is stored in the current browser, while every later AI request still requires an explicit user action. Users may stop using the feature, sign out, delete a BYOK configuration, or revoke the relevant permission.

用户自带密钥与可选主机权限

PromptPilot 的用户自带密钥（Bring Your Own Key，BYOK）功能允许用户配置一个兼容 OpenAI 的模型接口。扩展在 Manifest 中声明 https://*/* 为可选主机权限，但不会在安装时自动获得所有网站访问权。

只有当用户主动保存 BYOK 配置时，扩展才会请求该配置中 Base URL 对应的精确 HTTPS origin，例如 https://api.example.com/*。未授权时，该 Provider 不会保存或发起请求。授权只用于由 Background Service Worker 向用户选择的模型服务商发送优化请求；当前业务代码不会向 Content Script 提供或使用 API Key，也不会借此浏览或收集该域名下的其他页面内容。

BYOK 请求会把用户当前输入、待优化的本地五模块草稿和必要的场景信息直接发送给用户选择的服务商。API Key 只保存在浏览器扩展的本地存储中，不上传到 PromptPilot 服务端，不进入账号同步、导出备份、日志或分析事件。服务商如何处理请求数据受其自身隐私政策约束。

用户可以拒绝权限，继续使用始终可用的本地规则引擎；也可以在浏览器扩展设置中撤销已授予的站点访问权。撤销后，对应 BYOK Provider 会停止工作，直到用户再次授权。

Bring Your Own Key and optional host access

PromptPilot’s Bring Your Own Key (BYOK) feature lets a user configure an OpenAI-compatible model endpoint. The extension declares https://*/* as an optional host permission, but it does not receive access to every website during installation.

PromptPilot requests only the exact HTTPS origin derived from the Base URL when the user explicitly saves a BYOK configuration, for example https://api.example.com/*. If the user declines, that provider is not saved and no request is sent. The permission is used only by the Background Service Worker to send an optimization request to the provider selected by the user. Current product code does not provide or use the API key in the Content Script, and PromptPilot does not use this permission to browse or collect other pages from that origin.

A BYOK request sends the user’s current input, local five-section draft, and necessary scene context directly to the selected provider. The API key stays in browser extension local storage. It is not uploaded to PromptPilot, synchronized with the account, included in exports, logged, or added to analytics. The selected provider processes request data under its own privacy policy.

Users may decline this permission and continue using the always-available local rules engine. They may also revoke a previously granted origin in the browser’s extension settings; the corresponding BYOK provider remains unavailable until access is granted again.

我们处理哪些数据

1. 仅在浏览器本地处理或保存的数据

PromptPilot 可能在浏览器扩展存储中保存以下数据，以提供用户主动选择的功能：

• 当前输入和本地生成的五模块可编辑预览；当前页面关闭、输入变化或预览结束后，不作为云端记录保存。
• 用户创建或保存的本地提示词模板、文件夹、草稿、收藏及本地互动状态。
• 语言、主题、界面位置、功能暂停状态和其他产品偏好。
• 用户选择填写或从 Chrome 资料导入的本地用户名、邮箱和头像。
• BYOK 服务商名称、Base URL（基础地址）、模型、超时设置及 API Key。
• Supabase Auth（Supabase 身份认证）会话令牌，以维持用户登录状态。
• 为防止重复计数、执行本地额度控制和区分本机数据而生成的本地安装标识和状态记录。

本地数据不会因为创建 PromptPilot 账号而自动全部上传。用户可在扩展设置中删除相应数据；卸载扩展通常也会移除该扩展的本地存储，但具体行为由浏览器控制。

BYOK API Key 以明文值保存在浏览器扩展的本地存储中，不会上传到 PromptPilot、加入账号同步、包含在数据导出中或写入分析事件。该存储依赖用户设备、操作系统、浏览器资料和扩展环境的安全性。建议用户使用权限和额度受限的专用 Key，并在设备丢失、浏览器资料被入侵或不再使用服务时到相应服务商处撤销 Key。

2. 账号和身份数据

用户可以不登录并使用本地规则与本地模板。登录后，PromptPilot 可能处理：

• 邮箱注册或登录所需的邮箱地址、密码请求、账号标识和会话信息；密码由 Supabase Auth 处理，PromptPilot 应用服务器不保存明文密码。
• 使用 Google 登录时，由 Google 在用户授权范围内提供的账号标识、邮箱、显示名称和头像。
• 用户名、头像、语言、经验值、套餐和账号状态。
• 登录、退出、令牌刷新、资料更新时间等必要的账号安全信息。

用户还可以主动使用“Chrome 资料”功能，将当前 Chrome 资料的账号标识和邮箱保存为仅在本地使用的资料。该功能不等同于 PromptPilot 云端登录。

3. 官方 AI 数据

官方 AI 只有在用户登录并主动点击或选择 AI 优化后才会运行。每次请求可能包括：

• 当前输入框中的待优化文本；
• 本地规则已生成的五模块草稿；
• 当前任务场景、优化模式、提示词协议版本和所选模型路由；
• 账号标识、请求标识及提供额度、防滥用和故障排查所需的请求元数据；
• AI 返回的结构化优化结果。

待优化文本和 AI 输出会在 PromptPilot 的 Vercel Function（Vercel 函数）和所选上游模型服务中临时处理。PromptPilot 数据库不会保存完整提示词或完整模型输出，也不会将其写入产品分析或普通运行日志。PromptPilot 不使用这些内容训练自有模型。

官方 AI 当前可能调用：

• 阿里云百炼，作为主要模型服务；
• 智谱开放平台，作为独立的故障切换模型服务。

当前百炼请求使用 dashscope.aliyuncs.com 接入点。根据阿里云官方地域文档，该接入点对应华北 2（北京）；阿里云说明百炼会依据相关法律法规存储模型与应用调用产生的数据，但未在公开说明中给出适用于本项目的固定保存期限。智谱开放平台的公开隐私政策说明，其在中国境内运营中收集和产生的个人信息存储在中国境内。上述服务商可能依据其服务条款、隐私政策、安全要求和适用法律处理或保存请求内容。用户不应向官方 AI 提交不必要的敏感个人数据。

4. 社区、投稿、反馈和举报数据

登录用户可以提交或产生以下数据：

• 模板点赞、收藏、浏览和使用记录；
• 评论正文；评论发布后，用户名和头像可能随评论向其他用户公开显示；
• 社区模板的标题、正文、分类、标签和投稿状态；通过审核并发布后，这些内容及公开作者资料可被其他用户查看；
• 举报原因、详细说明和可选联系方式；
• 产品反馈正文和可选联系方式；
• 内容审核状态、必要的处理备注和安全审计记录。

举报、未公开投稿、反馈和内部审核记录仅向完成相关工作所需的管理员或服务提供商开放，不公开展示。用户主动公开的评论和已发布模板可由其他用户阅读。

5. 运行、安全和网站数据

为了提供额度、防止滥用、排查故障和衡量产品可靠性，PromptPilot 可能处理：

• 请求时间、接口路径、响应状态、执行时长、扩展版本、语言、AI 模式、路由模型、提示词协议版本、稳定错误代码和随机请求标识；
• 经服务器盐值单向哈希处理的安装标识、账号标识或网络地址，用于限流、并发控制和重复计数；
• 托管服务商为建立安全连接和运行服务而处理的网络地址、设备或浏览器类型、执行区域及类似连接元数据。

应用日志禁止记录 API Key、密码、授权头、完整提示词、完整模型输出或原始邮箱。PromptPilot 当前使用 Vercel Hobby 套餐；Vercel 官方文档列出的 Hobby 运行日志查看窗口最多为 1 小时。若套餐、日志转储或监控配置发生变化，我们会在扩大数据处理前更新本政策和必要的产品内告知。

当前官网不使用广告 Cookie、第三方分析脚本或数字指纹技术。网站演示输入只在当前页面内存中处理，不写入网址、日志、分析事件或浏览器持久存储。静态网站托管商和网络基础设施提供商仍可能为交付网页和保障安全而处理必要的连接元数据。

6. 产品使用分析

为了了解提示词增强核心功能的使用情况、衡量功能可靠性并改进产品，扩展在启用产品使用分析后，会向 PromptPilot 服务发送以下白名单事件。站点标识使用受支持产品的内部标识，例如 chatgpt 或 gemini，不记录用户访问的完整网址。

每个事件还可以包含扩展版本、界面语言、随机会话标识和经单向哈希处理的安装标识。会话标识和安装标识哈希用于去重、统计使用漏斗和衡量可靠性，不用于直接识别用户。耗时等数值只按预先定义的区间记录，不保存精确值。

产品使用分析不会采集或保存提示词内容、AI 输出内容、模板搜索关键词原文、用户访问的具体网页地址、页面内容、邮箱、姓名、API Key、密码或授权头。服务端按照固定白名单校验事件名和属性；白名单以外的事件名和属性一律丢弃，不写入分析事件存储。产品使用分析事件最多保留 90 天，仅用于改进 PromptPilot 已公开的提示词增强单一用途、性能和可靠性，不用于广告、数据出售或训练模型。

What data we process

1. Data processed or stored only in the browser

PromptPilot may store the following data in browser extension storage to provide features selected by the user:

• The current input and the locally generated editable five-section preview. These are not kept as cloud records when the page closes, the input changes, or the preview ends.
• Locally created or saved prompt templates, folders, drafts, favorites, and local engagement state.
• Language, theme, interface position, pause state, and other product preferences.
• A local username, email address, or avatar entered by the user or imported from a Chrome profile.
• BYOK provider name, Base URL（基础地址）, model, timeout settings, and API key.
• Supabase Auth（Supabase 身份认证）session tokens used to maintain a signed-in session.
• Local installation identifiers and state used for deduplication, local quota controls, and separation of device data.

Creating a PromptPilot account does not automatically upload all local data. Users can remove the relevant data in extension settings. Uninstalling the extension will normally remove its local storage, although the browser controls the exact behavior.

A BYOK API key is stored as a plain value in the browser extension’s local storage. It is not uploaded to PromptPilot, synchronized with an account, included in data exports, or written to analytics events. Its protection depends on the security of the user’s device, operating system, browser profile, and extension environment. Users should create a dedicated key with limited permissions and spending limits, and revoke it with the provider if the device is lost, the browser profile is compromised, or the service is no longer used.

2. Account and identity data

Users may use the local rules and local templates without signing in. When a user signs in, PromptPilot may process:

• Email address, password request, account identifier, and session information needed for email registration or sign-in. Supabase Auth processes the password, and the PromptPilot application server does not store the plaintext password.
• Account identifier, email address, display name, and avatar supplied by Google within the authorization granted by the user.
• Username, avatar, locale, experience points, plan, and account status.
• Account security information required for sign-in, sign-out, token refresh, and profile updates.

Users may also explicitly use the “Chrome profile” feature to save the current Chrome profile identifier and email address as a local-only profile. This is not the same as signing in to a PromptPilot cloud account.

3. PromptPilot official AI data

PromptPilot official AI runs only after a signed-in user explicitly requests AI optimization. A request may include:

• The text currently entered for optimization;
• The five-section draft generated by local rules;
• Task scene, optimization mode, prompt protocol version, and selected model route;
• Account identifier, request identifier, and metadata needed for quota enforcement, abuse prevention, and troubleshooting; and
• The structured result returned by the AI service.

The input and AI output are processed transiently by a PromptPilot Vercel Function（Vercel 函数）and the selected upstream model provider. The PromptPilot database does not store full prompts or full model outputs, and PromptPilot does not add them to product analytics or ordinary runtime logs. PromptPilot does not use this content to train its own models.

PromptPilot official AI may currently use:

• Alibaba Cloud Model Studio（阿里云百炼） as the primary model service; and
• Zhipu BigModel（智谱开放平台） as an independent failover model service.

The current Alibaba Cloud Model Studio request uses the dashscope.aliyuncs.com endpoint. Alibaba Cloud’s official region documentation identifies this endpoint with the China North 2 (Beijing) region. Alibaba Cloud states that Model Studio stores data generated by model and application calls as required by applicable laws, but its public notice does not specify a fixed retention period applicable to this Product. Zhipu BigModel’s public privacy policy states that personal information collected and generated through its operations in mainland China is stored in mainland China. These providers may process or retain request content under their terms, privacy policies, security requirements, and applicable law. Users should not submit unnecessary sensitive personal data to PromptPilot official AI.

4. Community, submission, feedback, and report data

Signed-in users may submit or generate:

• Template likes, saves, views, and uses;
• Comment text. Once published, a username and avatar may be displayed publicly with the comment;
• Community template title, content, category, tags, and review status. Once approved and published, this content and public author profile may be visible to other users;
• Report reason, details, and optional contact information;
• Product feedback and optional contact information; and
• Moderation status, necessary review notes, and security audit records.

Reports, unpublished submissions, feedback, and internal moderation records are available only to administrators or service providers who need them for the relevant work. Comments and published templates intentionally made public by the user may be read by other users.

5. Operational, security, and website data

To enforce quotas, prevent abuse, troubleshoot failures, and measure product reliability, PromptPilot may process:

• Request time, API route, response status, duration, extension version, locale, AI mode, routed model, prompt protocol version, stable error code, and random request identifier;
• Installation, account, or network identifiers transformed with a salted one-way hash for rate limiting, concurrency control, and deduplication; and
• Network address, device or browser type, execution region, and similar connection metadata necessarily processed by hosting and network providers to establish secure connections and operate the service.

Application logs are prohibited from recording API keys, passwords, authorization headers, full prompts, full model outputs, or raw email addresses. PromptPilot currently uses the Vercel Hobby plan, for which Vercel’s public documentation lists a runtime-log viewing window of up to one hour. If the plan, log drains, or monitoring configuration changes, we will update this policy and any required in-product notice before expanding the processing.

The current website does not use advertising cookies, third-party analytics scripts, or fingerprinting. Website demo input is processed only in current-page memory and is not placed in the URL, logs, analytics events, or persistent browser storage. Static hosting and network infrastructure providers may still process connection metadata needed to deliver the website and protect the service.

6. Product usage analytics（产品使用分析）

To understand how the core prompt-enhancement features are used, measure feature reliability, and improve the Product, the extension sends only the allowlisted events below after product usage analytics（产品使用分析）is enabled. A site identifier is an internal identifier for a supported product, such as chatgpt or gemini; it is not the full URL visited by the user.

Each event may also include the extension version, interface locale, a random session identifier, and a one-way-hashed installation identifier. The session identifier and hashed installation identifier are used for deduplication, usage-funnel measurement, and reliability measurement, not to directly identify a user. Duration and similar numeric values are recorded only in predefined ranges rather than as exact values.

Product usage analytics does not collect or store prompt content, AI output content, raw template-search terms, the specific page URL visited by the user, page content, email address, name, API key, password, or authorization header. The server validates event names and properties against a fixed allowlist. Any event name or property outside that allowlist is discarded and is not written to analytics storage. Product usage analytics events are retained for up to 90 days and are used only to improve PromptPilot’s disclosed single purpose（已公开的单一用途）, performance, and reliability—not for advertising, data sales, or model training.

浏览器权限说明

PromptPilot 只将浏览器权限用于以下已公开的单一目的：在受支持的 AI 对话网站输入框内生成、预览、管理和插入提示词，并提供用户主动选择的账号、社区和 AI 增强能力。

• storage：保存本地模板、偏好、登录会话和 BYOK 配置。
• activeTab：在用户操作扩展时识别当前标签页是否为受支持网站，并向对应标签页发送用户请求的界面或操作消息。
• identity：打开 Google OAuth（开放授权）登录流程并接收安全回调。
• identity.email：仅在用户主动使用 Chrome 资料功能时读取当前 Chrome 资料的账号标识和邮箱。
• 固定站点权限：在受支持 AI 对话网站中识别当前输入框、读取当前输入、显示本地预览，并在用户按 Tab 或点击插入后写回。
• 可选 https://*/* 权限：只在用户保存 BYOK 配置时，按实际 Base URL 请求对应的精确 HTTPS origin（安全超文本传输协议来源）权限。

PromptPilot 不使用这些权限读取完整浏览历史、抓取完整对话记录、访问不受支持网站的内容或进行广告画像。扩展不下载或执行远程 JavaScript；远程模板数据和模型输出仅作为数据处理，不作为代码执行。

Browser permission use

PromptPilot uses browser permissions only for its disclosed single purpose: generating, previewing, managing, and inserting prompts inside supported AI chat composers, together with the account, community, and AI enhancement features explicitly selected by the user.

• storage: stores local templates, preferences, sign-in sessions, and BYOK configuration.
• activeTab: determines whether the active tab is supported when the user interacts with the extension and sends the requested interface or action message to that tab.
• identity: opens the Google OAuth（开放授权）sign-in flow and receives its secure callback.
• identity.email: reads the current Chrome profile identifier and email address only when the user explicitly uses the Chrome profile feature.
• Fixed site access: identifies the active composer on supported AI chat sites, reads the current input, shows a local preview, and writes back after the user presses Tab or clicks insert.
• Optional https://*/* access: when a user saves a BYOK configuration, requests access only to the exact HTTPS origin（安全超文本传输协议来源）derived from its Base URL.

PromptPilot does not use these permissions to read a complete browsing history, scrape complete conversations, access content on unsupported websites, or create advertising profiles. The extension does not download or execute remote JavaScript. Remote template data and model output are treated only as data, not executable code.

处理目的与法律依据

根据用户所在地适用的法律，PromptPilot 依赖以下一项或多项依据处理个人数据：

• 履行用户请求或提供产品所必需，例如本地增强、账号登录、社区互动和 AI 优化；
• 用户同意，例如 Google 登录、官方 AI、BYOK、可选联系方式以及法律要求的跨境传输；
• PromptPilot 或用户的合法利益，例如保障安全、防止滥用、保持服务可靠、处理举报和改善不包含完整提示词的性能；
• 履行适用法律、监管要求或保护用户及他人合法权利。

当处理依法需要同意时，用户可以撤回同意，但撤回不影响此前处理的合法性。撤回可能使依赖该数据的功能无法继续使用。

Purposes and legal bases

Depending on the law applicable where the user is located, PromptPilot relies on one or more of the following bases:

• Processing necessary to perform the user’s request or provide the Product, including local enhancement, account sign-in, community interaction, and AI optimization;
• Consent, including for Google sign-in, PromptPilot official AI, BYOK, optional contact information, and cross-border transfers where consent is required;
• Legitimate interests of PromptPilot or its users, including security, abuse prevention, service reliability, report handling, and performance improvement without full prompt content; and
• Compliance with applicable law or regulatory requirements, and protection of the lawful rights of users or others.

Where processing legally requires consent, the user may withdraw it. Withdrawal does not affect the lawfulness of earlier processing and may make the relevant feature unavailable.

数据共享与服务提供商

PromptPilot 不出售或出租个人数据。只会在提供本政策所述功能、保障安全、遵守法律或取得用户明确同意所必要的范围内向以下接收方提供数据：

• Supabase：提供账号认证、PostgreSQL 数据库和头像对象存储；PromptPilot 生产项目选择新加坡区域。
• Vercel：托管官网、平台 API 和官方 AI 网关。Vercel 及其子处理者可能在美国及其他运营地区处理连接和客户数据。
• Google：在用户选择 Google 登录或 Chrome 资料功能时提供身份数据；Google 对其自身处理适用 Google 隐私政策。
• 阿里云百炼和智谱开放平台：仅在用户主动使用官方 AI 时处理本次请求所需的输入和输出。
• 用户选择的 BYOK 服务商：直接接收用户主动发送的内容和认证信息，并作为独立第三方按其政策处理。
• Cloudflare：提供域名、域名系统（Domain Name System，DNS）及可能启用的网络安全服务；若启用代理或安全功能，可能处理必要的连接元数据。
• 专业顾问、监管或执法机构：仅在有必要建立、行使或维护合法权利，响应有效法律程序，或处理安全事件时提供必要信息。

如发生合并、收购或资产转让，只有在符合适用法律和 CWS Limited Use（有限使用）规则、并在需要时事先取得用户明确同意后，才会转移相关个人数据。

Data sharing and service providers

PromptPilot does not sell or rent personal data. Data is provided to the following recipients only to the extent necessary to deliver the functions described in this policy, maintain security, comply with law, or act with the user’s express consent:

• Supabase: account authentication, PostgreSQL database, and avatar object storage. PromptPilot selects the Singapore region for its production project.
• Vercel: website hosting, platform Application Programming Interface（应用程序编程接口，API）, and PromptPilot official AI gateway. Vercel and its subprocessors may process connection and customer data in the United States and other locations where they operate.
• Google: identity data when a user selects Google sign-in or the Chrome profile feature. Google’s own processing is governed by the Google Privacy Policy.
• Alibaba Cloud Model Studio and Zhipu BigModel: input and output necessary for an official AI request, only when the user explicitly invokes that feature.
• The user’s selected BYOK provider: directly receives the content and authentication information explicitly sent by the user and processes it as an independent third party under its own policy.
• Cloudflare: domain registration, Domain Name System（域名系统，DNS）, and any enabled network security services. If proxy or security features are enabled, Cloudflare may process necessary connection metadata.
• Professional advisers, regulators, or law enforcement: only where necessary to establish, exercise, or defend lawful rights, respond to valid legal process, or address a security incident.

If a merger, acquisition, or asset transfer occurs, relevant personal data will be transferred only in compliance with applicable law and CWS Limited Use（有限使用）rules, and after obtaining the user’s explicit prior consent where required.

数据保存期限

PromptPilot 按下列规则保留数据；如法律要求更长时间、正在处理争议或安全事件，将仅在必要范围内延长，并限制其他使用：

账号删除后，无法再关联到个人的汇总模板计数可继续保留。PromptPilot 可能在生产数据库变更前，由开发者在本地设备上手动创建数据库逻辑备份；这类副本可能包含账号、社区和审核记录，用途仅限迁移验证与故障恢复，不会用于产品分析、训练或日常运营。2026 年 8 月 27 日创建的新恢复点使用高级加密标准 256 位（Advanced Encryption Standard 256-bit，AES-256）备份级加密，密钥与备份文件分开保存；但代码仓库之外仍存在旧版可读恢复副本，且计划中的 30 天自动到期机制尚未生效。因此，本政策目前仍不承诺所有开发者恢复副本的固定最长保存期限。

Supabase 管理的服务日志和灾难恢复副本由 Supabase 根据项目套餐、服务条款和平台配置处理，PromptPilot 无法通过应用数据库定时任务逐项控制或立即删除。若服务商管理的恢复副本在有效删除请求后被恢复，PromptPilot 将在可控制的活动系统中重新执行该删除请求。

Data retention

PromptPilot applies the following retention periods. Where law requires a longer period, or a dispute or security incident is being handled, retention will be extended only as necessary and other uses will be restricted.

Aggregate template counters that can no longer be linked to a person may remain after account deletion. Before a production database change, the developer may manually create a logical database backup on a local device. Such a copy may contain account, community, and moderation records and is used only for migration validation and recovery, not product analytics, training, or routine operations. The new recovery point created on August 27, 2026 uses Advanced Encryption Standard 256-bit（高级加密标准 256 位，AES-256）backup-level encryption, with keys stored separately from backup files. Readable legacy recovery copies nevertheless remain outside the code repository, and the planned automatic 30-day expiry is not yet active. This policy therefore does not currently promise a fixed maximum retention period for all developer-created recovery copies.

Supabase-managed service logs and disaster-recovery copies are processed by Supabase under the project plan, service terms, and platform configuration. PromptPilot cannot selectively control or immediately delete them through its application database retention jobs. If a provider-managed recovery copy is restored after a valid deletion request, PromptPilot will reapply that request to the active systems it controls.

跨境处理

PromptPilot 由新加坡运营，账号、资料、社区和审核数据所在的 Supabase 生产数据库选择新加坡区域。官方 AI 是另一条独立的数据流：只有用户主动发起 AI 优化后，请求内容才会先由 PromptPilot 的 Vercel 网关临时处理，再发送到当前位于中国境内的百炼北京接入点或智谱开放平台。Vercel 及其子处理者可能在美国和其他运营地点处理必要的请求和连接数据。BYOK 请求则直接发送到用户自行选择的服务商和地域。因此，PromptPilot 的数据流既不应被描述为“全部位于境外”，也不应被描述为“全部位于中国境内”。

PromptPilot 将通过服务协议、数据处理条款、安全措施和必要的同意机制保护跨境数据。对于中国境内用户，在法律要求时，我们将在向境外接收方提供个人信息前另行告知接收方、处理目的、数据种类和权利行使方式，并取得单独同意。用户可以选择不登录、不使用官方 AI 或不配置 BYOK，继续使用本地规则能力。

International processing

PromptPilot is operated from Singapore. Its Supabase production database for accounts, profiles, community activity, and moderation records is configured for Singapore. PromptPilot official AI is a separate data flow: only after the user explicitly invokes AI optimization is request content processed transiently by the PromptPilot Vercel gateway and then sent to the current Alibaba Cloud Model Studio Beijing endpoint or Zhipu BigModel in mainland China. Vercel and its subprocessors may process necessary request and connection data in the United States and other locations where they operate. A BYOK request is sent directly to the provider and region selected by the user. PromptPilot’s data flows therefore should not be described as entirely outside mainland China or entirely within mainland China.

PromptPilot uses service agreements, data-processing terms, security measures, and consent mechanisms where required to protect international transfers. For users in mainland China, where required by law, we will separately identify the overseas recipient, processing purpose, data categories, and method for exercising rights, and obtain separate consent before providing personal information overseas. A user may decline to sign in, use PromptPilot official AI, or configure BYOK and continue using the local rules engine.

用户选择和权利

根据适用法律，用户可以：

• 在扩展设置中查看、更正用户名、头像、语言和其他资料；
• 导出当前产品支持导出的账号数据；当前自动导出包括资料、社区投稿、评论和点赞或收藏记录，其他数据可通过联系邮箱申请；
• 删除本地模板、草稿、偏好、BYOK 配置和 API Key；
• 在浏览器扩展设置中撤销已授予的站点权限；
• 退出账号、撤销 Google 授权或删除 PromptPilot 账号；
• 请求访问、更正、复制、删除或限制处理个人数据；
• 撤回基于同意的处理，或对基于合法利益的处理提出异议；
• 向所在地的数据保护监管机构投诉。

为保护账号安全，我们可能需要验证请求者身份。部分请求可能受法律例外限制。请通过 support@promptpilot-tab.com 提交请求，我们会在适用法律规定的期限内回复。

User choices and rights

Subject to applicable law, users may:

• View or correct username, avatar, locale, and other profile information in extension settings;
• Export account data supported by the current Product. The automated export currently includes profile, community submissions, comments, and like or save records. Other data may be requested by email;
• Delete local templates, drafts, preferences, BYOK configuration, and API keys;
• Revoke granted site permissions in browser extension settings;
• Sign out, revoke Google authorization, or delete the PromptPilot account;
• Request access to, correction, a copy of, deletion of, or restriction of personal data;
• Withdraw consent or object to processing based on legitimate interests; and
• Complain to a data-protection authority where the user lives.

We may need to verify the requester’s identity to protect the account. Legal exceptions may limit some requests. Submit a request to support@promptpilot-tab.com; we will respond within the period required by applicable law.

安全措施

PromptPilot 采用与产品规模和数据风险相匹配的技术与组织措施，包括安全超文本传输协议（Hypertext Transfer Protocol Secure，HTTPS）、短期访问令牌、行级安全（Row Level Security，RLS）、服务端密钥隔离、请求校验、限流、权限最小化和管理员访问控制。官方模型密钥、Supabase Service Role Key（服务角色密钥）和授权头不会进入扩展包或公开客户端。

任何网络或存储系统都无法保证绝对安全。发生可能依法需要通知的数据泄露时，PromptPilot 将评估影响、采取缓解措施，并根据适用法律通知受影响用户和监管机构。

Security

PromptPilot uses technical and organizational measures proportionate to the Product and data risks, including Hypertext Transfer Protocol Secure（安全超文本传输协议，HTTPS）, short-lived access tokens, Row Level Security（行级安全，RLS）, server-side secret separation, request validation, rate limiting, minimum permissions, and administrator access controls. Official model credentials, the Supabase Service Role Key（服务角色密钥）, and authorization headers are not included in the extension package or public client.

No network or storage system can guarantee absolute security. If a data breach may require notification, PromptPilot will assess its impact, take mitigation measures, and notify affected users and regulators as required by applicable law.

未成年人

PromptPilot 面向年满 16 周岁的一般用户，不专门面向儿童，也不会明知故意收集 16 周岁以下儿童的个人数据。PromptPilot 当前不收集出生日期，也不使用自动化年龄验证；年龄门槛依赖用户及其监护人如实判断和声明。未达到所在地独立同意年龄的用户应在监护人同意和指导下使用本产品。

若收到可信举报称某账号用户未满 16 周岁，我们会尽快开始核实，并可能向举报人、账号用户或监护人索取完成核实所必需的最少信息；核实期间可以暂时限制该账号的登录或云端功能。确认用户未满 16 周岁且没有适当监护人授权后，我们会在确认之日起 30 天内删除或匿名化活动系统中的相关账号和个人数据，适用法律要求保留的除外。服务商管理的恢复副本不能立即逐项删除时，按本政策“数据保存期限”一节处理；若恢复副本被恢复，我们会重新执行有效删除请求。

Children

PromptPilot is intended for general users aged 16 or older and is not directed to children. We do not knowingly collect personal data from children under 16. PromptPilot does not currently collect a date of birth or use automated age verification; the age threshold relies on truthful assessment and representation by the user and, where relevant, a parent or guardian. A user below the age at which they can independently consent under local law must use the Product with a parent or guardian’s consent and guidance.

If we receive a credible report that an account user is under 16, we will begin reviewing it promptly and may request the minimum information needed from the reporter, account user, or parent or guardian. We may temporarily restrict sign-in or cloud features while the review is pending. If we confirm that the user is under 16 and lacks appropriate parental or guardian authorization, we will delete or anonymize the related account and personal data from active systems within 30 days after confirmation, except where applicable law requires retention. Provider-managed recovery copies that cannot be edited immediately are handled as described in the Data retention section; if such a copy is restored, we will reapply the valid deletion request.

Chrome Web Store 有限使用声明

PromptPilot 对从 Google API（Google 应用程序编程接口）和 Chrome 扩展权限取得的信息的使用，将遵守 Chrome Web Store User Data Policy（Chrome 网上应用店用户数据政策），包括 Limited Use（有限使用）要求。PromptPilot 仅将这些信息用于提供或改进本产品已公开的单一用途及必要的安全、可靠性和合规工作；不会将其用于个性化广告，不会出售给数据经纪商，也不会允许人员读取用户数据，除非用户明确同意读取特定内容、为安全目的所必需、为遵守法律所必需，或数据已经依法汇总并匿名化用于内部运营。

在 Claude、Gemini 等第三方 AI 网站上运行 Content Script 的唯一用途，是识别用户当前正在编辑的输入框、在浏览器本地生成并显示可编辑预览，并在用户按 Tab 或点击插入后写回同一输入框。默认情况下，输入框内容不会上传、外传、用于训练或用于分析；只有用户主动触发官方 AI 或 BYOK 优化时，才会按本政策所述的明确数据流发送必要内容。

Chrome Web Store Limited Use disclosure

The use of information received from Google APIs（Google 应用程序编程接口）will adhere to the Chrome Web Store User Data Policy（Chrome 网上应用店用户数据政策）, including the Limited Use requirements（有限使用要求）. PromptPilot uses such information only to provide or improve the Product’s disclosed single purpose and for necessary security, reliability, and compliance operations. It is not used for personalized advertising, sold to data brokers, or made available for human reading, except with the user’s explicit consent to read specific content, where necessary for security, where necessary to comply with law, or where the data has been lawfully aggregated and anonymized for internal operations.

The sole purpose of running the Content Script（内容脚本）on third-party AI websites such as Claude and Gemini is to identify the composer that the user is currently editing, generate and display an editable preview locally in the browser, and write the result back to the same composer after the user presses Tab or clicks insert. By default, composer content is not uploaded, transferred, used for training, or used for analytics. Necessary content is transmitted through the specific data flow disclosed in this policy only when the user explicitly invokes official AI or BYOK optimization.

政策变更

我们可能因产品、服务商、法律或平台政策变化而更新本政策，并更新页面顶部日期。若变化会实质扩大个人数据的收集、使用或共享，我们会在变化生效前通过扩展界面、官网或账号联系方式进行醒目通知，并在需要时重新取得同意。继续使用不需要同意的功能并不代表用户放弃依法享有的权利。

Changes to this policy

We may update this policy when the Product, service providers, law, or platform policies change, and will revise the date at the top. If a change materially expands the collection, use, or sharing of personal data, we will provide prominent notice through the extension, website, or account contact before it takes effect, and obtain renewed consent where required. Continued use of a feature that does not require consent does not waive any rights provided by law.

联系我们

• 数据控制者 / 个人信息处理者：JIANG ZIHAN
• 运营地：新加坡
• 产品：PromptPilot Tab
• 邮箱：support@promptpilot-tab.com
• 网站：https://promptpilot-tab.com

Contact us

• Data controller（数据控制者）/ personal information handler（个人信息处理者）: JIANG ZIHAN
• Place of operation: Singapore
• Product: PromptPilot Tab
• Email: support@promptpilot-tab.com
• Website: https://promptpilot-tab.com