Privacy policy

1. Introduction

This privacy policy explains how Prototype handles your information. It applies to the Prototype application and to this marketing site. By using either, you agree to the practices described here. We have tried to keep this in plain English so you can understand what we collect and why.

2. Information we collect

We collect the following categories of data:

• Account information. When you sign up, our authentication provider stores your name, email address, and organization membership so we can identify you and your team.
• Content you create. The specifications, components, documents, and other records you add to Prototype, along with the files you upload.
• Usage and analytics data. How you interact with the product — pages visited, features used, and similar events — so we can understand what works and what needs improvement.
• Technical data. Information your device sends automatically, such as IP address, device type, and browser.

3. How we use your information

We use the data we collect to:

• Provide, operate, and improve the service.
• Authenticate you and keep your account secure.
• Respond to your questions and provide support.
• Protect the service against abuse, fraud, and security threats.
• Understand product usage through analytics so we can prioritize the right work.

4. Third-party services we use

Prototype relies on a small set of trusted providers to run the service. Each processes some of your data on our behalf and maintains its own privacy policy, which governs its handling of that data:

• Clerk. Authentication and organization management.
• Supabase. Database and file storage — Postgres with row-level security.
• PostHog. Product analytics and session insights.
• Sentry. Error monitoring and crash reporting.
• Vercel. Hosting and web analytics.

5. Data storage & security

Your data is stored in a Postgres database with row-level security enforced on every table, so records are only readable by people with permission to see them. Uploaded files are kept in scoped storage with access tied to the same permission model. Authentication is handled by our auth provider, Clerk. No system is perfectly secure, but we take reasonable measures to protect your information.

6. Data retention

We keep your information for as long as your account is active and we need it to provide the service. If you ask us to delete your data, we will remove it within a reasonable period, except where we are required to retain it by law.

7. Your rights

Depending on where you live, you may have the right to access, correct, export, or delete the personal information we hold about you. To exercise any of these rights, contact us at the email address in the contact section below and we will respond as required by applicable law.

8. Cookies

We use cookies and similar technologies for two purposes: authentication and session management (to keep you signed in), and analytics (to understand how the product is used). You can control cookies through your browser settings, though disabling them may affect how the service works.

9. Changes to this policy

We may update this policy from time to time. When we do, we will revise the “Last updated” date shown near the top of this page. Significant changes may be communicated through the product or by email.