Privacy Policy

01Who we are and how to reach us

The Service is operated by BaruzoTech Pvt. Ltd., a private limited company incorporated in India. For the purposes of the Digital Personal Data Protection Act, 2023 (the “DPDP Act”) we would be the Data Fiduciary; under the EU and UK General Data Protection Regulation we would be the controller; under United States state privacy laws we would be the business or controller. As set out throughout this policy, in the ordinary operation of the app there is no personal data for those roles to attach to.

We have not appointed a Data Protection Officer under Article 37 of the GDPR, and we are not presently designated as a Significant Data Fiduciary under section 10 of the DPDP Act, because our processing does not meet the thresholds for either. The Grievance Officer named above is the single point of contact for every privacy question, request, or complaint, whichever law you are relying on.

02Scope of this policy

This policy applies to:

• the Prompt Fall iOS application, in every version distributed through the App Store;
• the Prompt Fall website at promptfall.app, including this page; and
• correspondence you send us directly, such as support email, at the point where it reaches our inbox.

It does not apply to:

• The AI services you paste prompts into. ChatGPT, Gemini, Midjourney and any other tool you use are operated by other companies under their own privacy policies. Once text leaves your clipboard and enters their product, their terms govern it, not ours. We have no visibility into what you generate.
• Apple. The App Store, your Apple Account, App Store analytics, crash reporting you may have enabled at the operating-system level, and any in-app purchase processing are Apple’s services, governed by Apple’s privacy policy. See section 8.
• Third-party websites we may link to, including our own social accounts on platforms we do not control.

03Our position, stated plainly

This is a product decision before it is a legal one. The app is a reference tool. A successful session is somebody opening it, copying a prompt, and leaving inside thirty seconds. Nothing about that requires knowing who they are, and building the plumbing to find out would add cost, risk, and a login screen - all three of which make the product worse.

The practical consequence is that most of the machinery a privacy policy usually describes - retention schedules, profiling logic, data-sharing tables, processor lists, consent management platforms - has nothing to operate on here. Where a section below would ordinarily list something, and the honest answer is “nothing”, it says nothing.

04What we do not collect

For the avoidance of doubt, and because this list is what most people actually want to check, the app does not collect, request, receive, generate, or transmit any of the following:

• Your name, email address, postal address, or phone number
• Account credentials of any kind - there is no account
• Your Apple Account identifier, or any account identifier from any other service
• The Identifier for Advertisers (IDFA), the Identifier for Vendors (IDFV), or any other advertising or device identifier
• Contacts, calendars, photos, camera, microphone, or health data
• Precise or coarse location. The app never requests location permission and contains no location framework
• Your search terms inside the app
• Which prompts you view, save, copy, or fill in
• The text you type into a variable chip
• Your clipboard contents - the app writes to your clipboard and never reads from it
• Browsing or app-usage history, on this app or any other
• Biometric, financial, health, caste, religious, political, or any other sensitive category of data
• Anything used to build a profile, infer characteristics, or target advertising

We also do not operate any of the following in the app: an analytics SDK, a crash reporting SDK, an attribution or install-tracking SDK, an advertising network, a session replay tool, a customer messaging or push tool, a tag manager, or a social login provider.

05Information stored on your device

The app stores a small amount of information locally so that it works between launches. This information stays inside the app’s sandbox on your device. It is not transmitted to us, and we have no technical means of reading it.

You can erase all of it at any time by deleting the app, or from within the app where a reset control is provided. Deleting the app removes its entire container, including the cache. There is no server-side copy to request the deletion of, because there is no server-side copy.

06Network requests, and the one technical exception

The app has to fetch the prompt library from somewhere, and that is a network request like any other. This is the one place where information about you is processed at all, so it is worth being precise about it rather than burying it.

When the app loads or refreshes the library, your device contacts our content servers and their content delivery network. Those servers necessarily observe, for the moment it takes to answer the request:

• your IP address, which is how the internet routes the response back to you;
• the approximate coarse region derived from that IP address by the network provider, used solely to pick a nearby edge server;
• a generic user-agent string identifying the app version and iOS version, used to serve compatible content; and
• which content file was requested.

These are transport-layer facts, not a data collection programme. We do not join this information to anything, we do not build logs into profiles, we assign no cookie or identifier to the request, and there is no account for it to be attached to. Our configuration is to retain operational logs only for as long as needed to serve and secure the request, and in no case beyond seven (7) days, after which they are deleted. We do not use them for analytics, measurement, personalisation, or any commercial purpose.

Because this data is not retained beyond servicing the request and is never linked to an identity, it falls outside what Apple defines as “collected” data. That is why the App Store privacy label for Prompt Fall reads Data Not Collected, and the declaration is accurate.

The app also makes a network request when you tap a Send to destination. That request is your device opening another app or website; the destination service then sees whatever its own systems record about an incoming launch. We do not send it anything about you, and we are not told what happens next.

07If you contact us

Email is the exception to “we hold nothing”, for the obvious reason that an email has a sender. If you write to us - for support, to report a listing, to exercise a right under section 12, or for any other reason - we will hold:

• your email address;
• whatever you chose to put in the message and any attachment; and
• our replies and the thread history.

Purpose: to answer you, and to keep a record that we did. Legal basis (GDPR): our legitimate interest in responding to correspondence (Article 6(1)(f)), or performance of a contract where your message concerns the Service (Article 6(1)(b)). Legal basis (DPDP Act): the certain legitimate use of processing personal data you have voluntarily provided for a specified purpose, under section 7(a). Retention: twenty-four (24) months from the last message in the thread, then deletion, unless a longer period is required to establish, exercise, or defend a legal claim or to comply with a legal obligation.

Our email is hosted by a standard business email provider acting as our processor. Please do not send us sensitive personal information, identity documents, or payment details by email. We will never ask you for a password, a card number, or a one-time code.

08Apple, Google, and data we never see

Distributing an app through a store means the store operator has its own relationship with you, entirely separate from ours. We want to be clear about the boundary, because users reasonably assume that anything happening “in the app” is us.

Apple

Apple operates the App Store, your Apple Account, app download and update delivery, and - if you have opted in at the operating-system level - App Analytics and crash reporting. Where you have enabled sharing with developers, Apple may make aggregated, anonymised statistics available to us in App Store Connect: install counts, territory-level totals, crash traces, and similar. We cannot identify any individual from these, we cannot link them to any behaviour inside the app, and we have no way to request more. You control this in Settings › Privacy & Security › Analytics & Improvements. Apple’s handling of that data is governed by Apple’s privacy policy.

If in-app purchases are offered in a future version, Apple processes the payment. Apple would send us a transaction receipt and an anonymous subscription status. We would not receive your name, your billing address, or your card details at any point.

Google

If and when Prompt Fall is distributed on Google Play, the equivalent applies: Google operates the store, the account, the billing system, and any Play Console statistics, under Google’s own privacy policy. Our Play Data Safety declaration will mirror this policy.

Your network and device

Your internet service provider, your mobile carrier, any VPN you use, and your device operating system all process traffic in the ordinary course. That is outside this policy and outside our control.

09The website

The website you are reading this on is a set of static pages. It behaves the same way as the app:

• No cookies. The site sets no cookies of any kind - not necessary cookies, not preference cookies, not analytics cookies. This is why you have not been shown a consent banner: there is nothing to consent to.
• No analytics. There is no analytics script, no pixel, no tag manager, and no heat-mapping or session-recording tool.
• No third-party embeds. Fonts are served from the same origin as the page. There are no social widgets, no embedded video players, and no chat widgets, so no third party is told that you visited.
• No forms. The site does not collect submissions. Where you can contact us, it is a plain mailto: link that opens your own email client.
• Server logs. Our host processes standard web-server request data on the same seven-day basis described in section 6.

Because we do not track you, we have nothing to change when your browser sends a Global Privacy Control or Do Not Track signal. We honour them by construction. If we ever introduce anything that reads such a signal, we will treat a GPC signal as a valid opt-out of sale and sharing under United States state law.

10Purposes and legal bases

Set out below is every purpose for which any personal data is processed in connection with the Service, with the legal basis under the GDPR and UK GDPR and the corresponding ground under the DPDP Act. There are three.

We do not process any special category data under Article 9 of the GDPR, and we do not rely on consent as a legal basis for anything, because nothing we do requires it. We do not carry out automated decision-making or profiling that produces legal or similarly significant effects, within the meaning of Article 22 of the GDPR.

11Disclosure, sharing, and selling

The only parties who process anything on our behalf are the infrastructure providers needed to serve a website and an inbox:

We may also disclose information in these limited circumstances:

• Legal compulsion. Where we are required to by a valid order of a court or a competent authority, or by applicable law. We will assess each request, resist those that are overbroad or unlawful, and where permitted, tell you.
• Claims and safety. Where necessary to establish, exercise, or defend a legal claim, or to protect against fraud, abuse, or a threat to anyone’s safety.
• Corporate transaction. If the Service or its assets are merged, acquired, or transferred, information may pass to the successor, who would remain bound by this policy or a policy no less protective. We would give notice before any change of controller took effect.

12International transfers

We are established in India. Content delivery is by nature distributed: edge servers sit in many countries so that a request from Berlin is answered from a server near Berlin rather than one in Mumbai. That means the transient request metadata in section 6 may be processed on infrastructure outside your country, including outside the European Economic Area and the United Kingdom.

Where such processing involves a transfer that requires a safeguard, we rely on:

• Standard Contractual Clauses adopted by the European Commission (Decision 2021/914), and the UK International Data Transfer Addendum where the UK GDPR applies, incorporated into our agreements with the relevant providers;
• an adequacy decision where one covers the destination; and
• for transfers out of India, the position under section 16 of the DPDP Act, under which transfer is permitted other than to a territory that the Central Government has restricted by notification. We do not transfer personal data to any restricted territory.

You may request a copy of the relevant transfer mechanism by writing to info@baruzotech.com. We will send the executed clauses with commercial terms redacted.

13Your rights

Your rights depend on where you are. They are set out in full below. Please note the practical point that runs through all of them: for the app itself, we hold no personal data about you, so a request for access, correction, or erasure will usually be answered with a confirmation that we hold nothing. Where you have emailed us, we hold that correspondence and every right below applies to it normally.

India - Digital Personal Data Protection Act, 2023

If you are a Data Principal in India, you have the right to:

• Access a summary of your personal data being processed and the processing activities undertaken (section 11);
• Correction, completion, updating and erasure of your personal data (section 12);
• Grievance redressal through the readily available means described in section 15 below, before approaching the Data Protection Board (section 13);
• Nominate another individual to exercise your rights in the event of your death or incapacity (section 14); and
• Withdraw consent as easily as it was given, where processing rests on consent.

The DPDP Act also places duties on you as a Data Principal under section 15, including not impersonating another person and not raising false or frivolous grievances.

European Economic Area and United Kingdom - GDPR / UK GDPR

You have the right to:

• be informed about processing - this document (Articles 13–14);
• access your personal data and receive a copy (Article 15);
• have inaccurate data rectified (Article 16);
• erasure, the “right to be forgotten” (Article 17);
• restrict processing (Article 18);
• data portability in a structured, commonly used, machine-readable format (Article 20);
• object to processing based on legitimate interests, including at any time and for any reason where the processing is for direct marketing (Article 21) - we do no direct marketing;
• not be subject to solely automated decision-making with legal or similarly significant effects (Article 22) - we carry out none; and
• lodge a complaint with a supervisory authority (Article 77), as described in section 15.

California - CCPA as amended by the CPRA

If you are a California resident, you have the right to:

• know what personal information is collected, used, disclosed, and sold or shared;
• access the specific pieces of personal information we hold;
• delete personal information, subject to statutory exceptions;
• correct inaccurate personal information;
• opt out of the sale or sharing of personal information, and to limit the use of sensitive personal information - neither applies to us, because we do neither; and
• not receive discriminatory treatment for exercising any right. We offer no financial incentives and run no loyalty programme.

In the twelve months preceding the date of this policy we have collected no categories of personal information as defined in Cal. Civ. Code § 1798.140(v), sold no personal information, and shared no personal information for cross-context behavioural advertising. You may use an authorised agent to submit a request on your behalf, with written proof of authorisation.

Other United States states

Residents of Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Delaware, Iowa, Nebraska, New Hampshire, New Jersey, Tennessee, Minnesota, Maryland, and other states with comprehensive privacy statutes in force have broadly equivalent rights of access, correction, deletion, portability, and opt-out of targeted advertising, sale, and profiling. We honour all of them on the same basis, and where a state provides an appeal from a refused request, we will tell you how to appeal at the time we respond.

Elsewhere

If you are covered by Brazil’s LGPD, Canada’s PIPEDA, Australia’s Privacy Act, South Africa’s POPIA, Japan’s APPI, South Korea’s PIPA, Switzerland’s FADP, or a comparable law, write to us and we will honour the equivalent rights under that law. We do not require you to identify a statute to be helped.

14How to exercise a right

Write to info@baruzotech.com with “Privacy request” in the subject line. Tell us what you want and, if you know it, which law you are relying on. There is no form and no portal.

Verification

Because there are no accounts, we cannot verify your identity against a record - there is no record. In practice this means:

• For a request about app usage, we will confirm in writing that we hold no personal data about you. No verification is possible or necessary.
• For a request about correspondence you have sent us, we verify by reference to the email address that sent it. Please write from the same address.

We will not ask you for identity documents, and we will never ask you to create an account in order to exercise a privacy right.

Timeframes

Requests are free. If a request is manifestly unfounded or excessive, particularly because it is repetitive, we may charge a reasonable fee or refuse to act - and if we do, we will tell you why and how to challenge it.

15Retention

When a retention period ends, data is deleted or irreversibly anonymised. Where deletion is not immediately possible - for example, because data sits in an encrypted backup that rotates on a schedule - we isolate it from further processing and delete it when that backup expires.

16Security

Holding almost nothing is the strongest security control available, and it is the one we have chosen. Beyond that:

• All traffic between the app, the website, and our servers uses TLS 1.2 or higher.
• Data on your device is protected by iOS file-level encryption and the application sandbox, which prevents other apps from reading Prompt Fall’s storage.
• Administrative access to our infrastructure and inbox is limited to personnel who need it, protected by multi-factor authentication, and reviewed periodically.
• We keep dependencies patched, and we do not compile third-party SDKs into the app that would widen the attack surface.

No system is perfectly secure, and we do not claim otherwise. If a personal data breach occurs that is likely to result in a risk to your rights, we will notify the competent supervisory authority - and, where the risk is high, you directly - within the periods required by applicable law, including 72 hours under Article 33 of the GDPR and the intimation requirements of section 8(6) of the DPDP Act and the CERT-In directions of 28 April 2022.

If you believe you have found a vulnerability, please report it to info@baruzotech.com with “Security” in the subject line. We will not pursue legal action against good-faith research that respects user privacy and does not degrade the Service.

17Grievance redressal and complaints

Come to us first. We would rather fix a problem than have you discover an authority. Our Grievance Officer, appointed under the DPDP Act and under Rule 3(2) of the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, is:

If we have not resolved your complaint, you may escalate:

• India - to the Data Protection Board of India, once you have exhausted the grievance mechanism above, as required by section 13(3) of the DPDP Act.
• European Economic Area - to the supervisory authority of the Member State of your habitual residence, place of work, or the place of the alleged infringement.
• United Kingdom - to the Information Commissioner’s Office at ico.org.uk, or by telephone on 0303 123 1113.
• California - to the California Privacy Protection Agency or the California Attorney General.
• Elsewhere - to your national or state data protection authority.

18Children

Prompt Fall is a general-audience reference tool. It is not directed at children, it is not designed to appeal to children, and it contains no child-directed features, characters, or incentives.

• United States (COPPA). We do not knowingly collect personal information from children under 13. Since we collect no personal information from anyone, there is nothing to collect from a child either.
• India (DPDP Act, section 9). The Act treats anyone under 18 as a child and requires verifiable parental consent before processing their personal data, and prohibits tracking, behavioural monitoring, and targeted advertising directed at children. Because we process no personal data through the app, do no tracking, and serve no advertising, our processing is consistent with these requirements without needing to obtain consent.
• EEA and UK. Article 8 of the GDPR sets the digital-consent age between 13 and 16 depending on Member State. We rely on consent for nothing, so no age gate is engaged.
• UK Age Appropriate Design Code. The app applies its highest-privacy posture to every user by default, uses no nudge techniques, profiles nobody, and does not use engagement-maximising design. Session length is explicitly not a metric we optimise for.

If you are a parent or guardian and you believe a child has sent us personal information by email, write to info@baruzotech.com and we will delete it promptly.

19App Store and Play Store disclosures

Store privacy labels are a summary written to the store operator’s taxonomy. This section records what we declare, so that you can hold the declaration against the document.

Apple App Store privacy label

The app includes no tracking domains and does not call the App Tracking Transparency framework, because it has no reason to: there is no tracking to request permission for.

Google Play Data Safety

For any future Play release, we would declare: no data collected, no data shared, data encrypted in transit, no unique device identifiers used, and a route to request deletion - the last being satisfied by deleting the app, since all data is local.

Required permissions

The app requests no runtime permissions. It does not ask for location, contacts, photos, camera, microphone, notifications, tracking, or local network access. If a future version needs a permission, we will request it in context, explain why at the point of asking, and update this policy before shipping it.

20Third-party services and links

The Send to feature copies the finished prompt and opens the destination application or website. At that moment you leave Prompt Fall. What that service records about you, how it uses your prompt, whether it trains on your input, and what it does with the image you generate are all governed by that service’s own privacy policy and terms.

This is worth pausing on if the text you type into a variable chip is personal or confidential. On your device, that text is only ever held in memory for the copy action. Once you paste it into another company’s product, it is subject to their rules.

We name those services in the interest of usefulness and compatibility only. We are not affiliated with, endorsed by, or sponsored by any of them.

21Accessibility of this policy

This document is published as accessible HTML with semantic headings, a linked table of contents, text that reflows without horizontal scrolling, and colour contrast meeting WCAG 2.2 Level AA. It is readable with a screen reader and at any system text size.

If you need this policy in another format - large print, plain text, or a different language - write to info@baruzotech.com and we will provide it at no cost.

22Changes to this policy

We will update this policy when the Service changes, when the law changes, or when we can explain something better.

• Every version carries a version number and an effective date at the top of the page.
• Material changes - anything that would expand what we collect, change why we process it, introduce a new recipient, or reduce your rights - take effect no earlier than 30 days after we publish them, and we will surface an in-app notice before the change takes effect.
• Non-material changes, such as correcting a typo or clarifying wording, take effect on publication.
• Where a change requires consent under applicable law, we will ask for it before the change applies to you, and continuing to use the Service will not be treated as consent.
• We keep previous versions and will send you any of them on request.

23Definitions

24Contact

For anything in this document - a question, a request, a correction, or a complaint - write to:

The Terms & Conditions govern your use of the Service and should be read alongside this policy.