last updated 22 September 2026
Privacy policy
AfterPrompt is built to know as little about you as possible. There are no ads, no analytics, and no tracking cookies. This page lists everything we do collect. inchi.dev is responsible for it.
From the agent client
When your coding agent works for a while, the client creates a game session on our server with the agent’s name (for example “claude” or “codex”) and timestamps. It never sends prompts, code, file paths, or transcripts. Sessions are deleted automatically after 24 hours. The client keeps its own state and a browser profile in ~/.afterprompt on your machine. We never see it.
When you play
- Account: your email address, a random user ID, a player number, and an optional username you choose.
- Authentication: short-lived email codes and account sessions. Codes are stored only as hashes and expire after ten minutes.
- Scores: your best verified run per level: move count, whether undo was used, and when. We replay the moves to verify them, then keep only the result.
- Challenges: when you create one, we keep its level revision, verified move count, undo mark, creation time, and the player name shown when it was created. Anyone with the link can see it and play the same level.
- Your device: local storage holds level progress and sound settings. The iOS app also stores its account session token so you stay signed in.
Usernames, player numbers, and best scores appear on public leaderboards. A challenge link is public and keeps its creator display name even if that profile is later renamed.
When you buy Supporter
Payment happens in Paddle’s checkout. Paddle is the Merchant of Record and handles your payment details, email, and address under its own privacy policy. We receive the transaction ID, Paddle’s customer ID, the amount, and the currency, and store them with your player so Supporter can be restored or refunded. We never see your card.
Service providers
- Cloudflare hosts the site and its data. It processes requests, including your IP address, and keeps short-lived logs to run and protect the service.
- Cloudflare Email Service sends sign-in codes to your email address.
- Google Fonts serves the typefaces, so your browser requests them from Google.
- Paddle handles payments, as above.
How long we keep it
Agent sessions: 24 hours. Account, profile, scores, and challenges: until you ask us to delete them. Sign-in codes: ten minutes. Purchase records: as long as tax and accounting rules require.
Your rights
You can ask to see, correct, or delete your data. Email hello@inchi.dev with your account email address. We may send a fresh verification code before acting on the request. You may also complain to your local data protection authority.
Children
AfterPrompt is not directed at children under 13, and we don’t knowingly collect their data.
Changes
If we start collecting anything new, such as analytics, we’ll update this page first.