Security & data handling

In short

PromptQuorum does not host or run any AI models and has no server that receives your prompts or API keys. Requests go from your device directly to the AI providers you choose.

Prompts and AI responses

Prompts and responses are handled in your browser and sent straight from your device to the provider you selected (for example OpenAI, Anthropic or Google). They do not pass through PromptQuorum servers. What each provider does with that data is governed by the provider's own terms and privacy policy. Local models you run yourself stay on your machine.

API keys

You bring your own keys. They are stored only in your browser's localStorage and are used for direct calls to your chosen provider. PromptQuorum servers never receive or transmit them. localStorage is not encrypted storage: anyone with access to your browser profile or device, or malicious software or browser extensions running on it, could read it. Use provider keys with spending limits, and revoke a key at the provider if you suspect exposure.

What the website itself processes

The website and its public MCP server process a small amount of personal data: hosting and server logs, cookie-consent records, rate-limiting hashes and an optional pseudonymous MCP profile. We collect no payment data. The full list, purposes, lawful bases and processors (including their locations) are in the Privacy Policy.

Website analytics (Umami and Microsoft Clarity) run in cookieless mode.

Responsible party and GDPR

The data controller is Hans Kuepper, Germany (see the Impressum). You can request access, correction or deletion of your data, or withdraw consent, at any time by emailing the address below. MCP profiles can also be viewed and deleted with the my_profile and forget_me tools.

Report a vulnerability

If you find a security issue, email hello@promptquorum.com with enough detail to reproduce it. Please give us reasonable time to fix it before disclosing it publicly. We do not run a paid bug-bounty programme.