We never see your images, your prompts or your keys.
Not as a policy. As an architecture: there is no Re-Prompter server between your browser and your model provider, so there is nothing for us to log even if we wanted to.
Where each task runs
The panel tells you, task by task.
Because different tasks go to different providers, "where does my data go" has more than one answer. So Re-Prompter prints all of them:
| Task | Provider | Destination |
|---|---|---|
| Prompt and brief writing | Ollama | Runs locally |
| Image generation | OpenAI | Sent to OpenAI |
| Vision analysis | Gemini | Sent to Google |
| Title generation | Ollama | Runs locally |
Turn on local-only mode and every cloud provider is refused outright. Features that genuinely need one are disabled and labelled, rather than quietly rerouted.
Your keys
Two modes, and an honest description of both.
Session only
The key lives in the browser's session storage, cleared when Chrome closes, unreadable by page scripts, never written to disk. The default.
Encrypted local storage
AES-GCM under a key derived from your passphrase with PBKDF2 at 250,000 iterations. You type the passphrase once per browser session.
What that is not: hardware-grade secret storage. A browser extension has no keychain. Encryption here stops a casual read of extension storage and stops a synced profile carrying your keys in plain text. Anything this page can decrypt, software running as you on that machine can too. We would rather say that than let you assume otherwise.
What never happens
A short list, because it should be short.
No telemetry
None. Not usage counts, not prompts, not error reports. The only request Re-Prompter makes to us is licence activation, which sends a key and a random device id.
Keys never travel
Not in a URL, a log line, an exception payload, image metadata, or the normal data export. Headers are excluded from stored generation metadata, so an exported project cannot carry one.
Permissions asked when needed
The only standing host permission is this website. Every provider host is optional and requested at the moment you enable that provider. There is no all-sites permission and no background content script.
Pages are read on your click
Pulling a page's title or a video's thumbnail happens through a one-off injection after you press a button. Nothing is watched while you browse.
Your work
Local, measured, and yours to take.
Projects, generations, personas, styles, titles and every image live in your browser's own database. The storage screen shows what each is using, measured from the stored files rather than estimated, and clears old images without touching your projects. Export everything as JSON whenever you like; API keys are excluded by construction, and there is a separate, explicitly requested, encrypted credential backup if you want one.