EZ Prompt
Privacy policy
Last updated: 11 October 2026
This policy explains what personal data EZ Prompt collects when you use the website at ezprompt.app and the app at dash.ezprompt.app, why, and what your choices are. We collect as little as the service needs, we don’t sell your data, and we don’t use it for advertising.
Who we are
EZ Prompt is operated by Hexxu Services Ltd, a company registered in the Republic of Cyprus (“we”, “us”). We are the controller of the personal data described here. For any privacy question or request, email support@ezprompt.app.
What we collect
| Data | Why |
|---|---|
| Your email address | To create your account and send you sign-in codes. |
| If you sign in with Google: your Google account ID, email address and whether Google has verified it | To sign you in and keep your account linked to your Google account. We don’t receive your name, photo, contacts or any other Google data. |
| If you buy Pro: your plan, how your subscription stands (active, cancelled, when it renews or ends), and Lemon Squeezy’s references for you, your order and your subscription | To give you Pro and let you manage it. Your card details go to Lemon Squeezy and never reach us. |
If a link brought you to sign up: the affiliate’s code and the campaign tags in that
link (for example ?aff= and utm_source=)
|
To know which partners and campaigns bring people, and, if you buy Pro, to pass the affiliate’s code to Lemon Squeezy so the partner who recommended us is paid. Nothing is stored in your browser for this. |
| If we give you Pro: when, until when, and a note on why | To give you Pro, and to keep a record of it. |
| Scripts you save (title and text) | To keep your script library. |
| The script you send to a prompter session, with the session’s settings and position | To show it on the session’s screens, and so that a server restart doesn’t end the session. |
| Sign-in records: when you signed in, and your browser’s user-agent string (browser and operating system) | To keep you signed in and to recognise and end sign-in sessions. |
| IP addresses of requests to sign in | To limit abuse, such as floods of sign-in emails. Kept only in memory. |
| On the website, only if you agree: the pages you visit, how you got there, your device, browser and approximate location (from your IP address), and whether you came from one of our ads | To see how the website is used (Google Analytics) and to measure our ads (Meta pixel). See Cookies. |
Sign-in codes and sign-in session tokens are stored only in hashed form. The app doesn’t use analytics, advertising or tracking tools; the website uses them only if you agree (see Cookies).
Prompter sessions and viewer links
When you run a prompter session, the script you send to it is stored in our database, with the session’s settings and position, so that a server restart doesn’t end the session; it is deleted with the session (see below). Anyone who has a session’s viewer link or code can see the script being prompted in it, without signing in. Only share viewer links with people who should see that script.
Following your voice
Follow voice, on the phone remote, uses your browser’s own speech recognition. While it is on, your browser sends what the microphone hears to its speech service (Google’s, in Chrome; Apple’s, in Safari and on iPhone), under that company’s privacy terms, and gives the page back the words. The words are used on your phone only, to set the prompter’s speed; they aren’t sent to our server or stored. Listening stops when you stop following or leave the page.
Importing from Google Docs
If you import a script from Google Docs, Google’s file picker opens in your browser, and you give access only to the file you pick. The document is read in your browser and becomes your script. On iPhone and iPad, the pick happens in a Google tab instead, and our server passes the picked file and a short-lived access token back to your page, holding them only in memory for at most a few minutes. Nothing from Google is stored on our server.
Cookies and storage in your browser
On the website (ezprompt.app)
The website sets cookies only if you agree, in the banner shown on your first visit, and none of Google’s or Meta’s code loads until you do. You can change your choice at any time with “Cookie settings” at the bottom of every page; withdrawing it deletes these cookies.
| Cookie | Set by, if you allow | Purpose | Kept for |
|---|---|---|---|
| _ga, _ga_<ID> | Google Analytics (Analytics) | Tells visits apart, to count visitors and see how the site is used. | 2 years |
| _fbp, _fbc | Meta pixel (Marketing) | Recognises your browser, to measure whether our ads on Facebook and Instagram bring visitors. | 90 days |
Your choice itself is kept in your browser’s local storage for 12 months, so we don’t ask on every page; it isn’t sent to anyone. Google Analytics runs for us as our processor (Google Ireland Limited). For the Meta pixel, we and Meta Platforms Ireland Limited are joint controllers for collecting the data on our website and sending it to Meta; what Meta does with it afterwards is covered by Meta’s privacy policy.
In the app (dash.ezprompt.app)
The app uses one strictly necessary cookie to keep you signed in (valid for 30 days after your last visit, removed when you sign out), and a short-lived cookie (10 minutes) while you complete a Google sign-in. It also keeps a few things in your browser’s local storage, on your device: unsaved changes to your script (so a reload doesn’t lose them), your light or dark theme, notes mode, the language for Follow voice, and each prompter screen’s mirroring and colours. All of these are needed for things you ask the app to do, so there is nothing to consent to; the app uses no analytics or advertising cookies.
How long we keep data
- Your account and saved scripts: until you delete them or ask us to delete your account.
- Deleted scripts are removed from the database immediately.
- Your plan and subscription records: while your account exists. Our log of billing events (payments, changes to plans) is kept for our records, no longer linked to you once your account is deleted. Lemon Squeezy keeps its own records of your purchase, as the law requires of a seller.
- Sign-in codes: they expire after 10 minutes and are deleted within a day.
- Sign-in sessions: until you sign out, or 30 days after your last visit, after which they are deleted.
- Prompter sessions, with the script sent to them: deleted 12 hours after the last controller or viewer disconnects. A server restart doesn’t delete them; they come back paused where they were.
- Website analytics and ad measurement: the cookies expire as listed under Cookies; Google and Meta keep the data they collected for their own retention periods.
Who processes data for us
- Hetzner Online GmbH (Germany) hosts our servers and database in the EU.
- Resend delivers our sign-in emails, so it processes your email address.
- Lemon Squeezy sells Pro for us as merchant of record: it takes your payment, handles tax and invoices, and is the controller of the details you give it at checkout, under its own privacy policy. It tells us your email address and how your subscription stands.
- Google: Google Analytics and Google Tag Manager on the website, only if you agree (Google Ireland Limited, as our processor); and sign-in with Google, only if you choose it, under Google’s own privacy policy.
- Meta Platforms Ireland Limited: the Meta pixel on the website, only if you agree (as joint controller; see Cookies).
Some of these providers may process data outside the EU/EEA; where they do, the transfer is covered by appropriate safeguards such as the EU Standard Contractual Clauses or the EU–US Data Privacy Framework. We don’t share your data with anyone else, unless the law requires us to.
Legal basis
We process your data under the EU General Data Protection Regulation (GDPR) and Cyprus’s Law 125(I)/2018, which supplements it: to provide the service you signed up for, including Pro if you buy it (performance of a contract); to keep the records the law requires of us (legal obligation); for security measures such as rate limiting, on the basis of our legitimate interest in keeping the service safe and available; and, for analytics and advertising cookies on the website, on your consent, which you can withdraw at any time with “Cookie settings”.
Your rights
You can ask us to access, correct, delete or export your data, to restrict or object to its processing, by emailing support@ezprompt.app. You can delete individual scripts yourself in the app at any time. If you believe we handle your data unlawfully, you can also complain to a supervisory authority: in Cyprus, the Commissioner for Personal Data Protection (dataprotection.gov.cy), or the data protection authority where you live or work.
Security
All traffic is encrypted (HTTPS). Sign-in codes and session tokens are stored only as hashes, and the sign-in cookie can’t be read by scripts or by other sites. No system is perfectly secure, but we work to protect your data and will inform you as the law requires if a breach affects it.
Children
EZ Prompt is not directed at children under 16, and we don’t knowingly collect their data.
Changes
We’ll update this page if our practices change, and change the date at the top. For significant changes, we’ll let account holders know by email.