Privacy policy
This policy explains what personal data Prolepsia collects when you use the service, why we use it, who receives it, how long we keep it, and the choices and rights you have.
1. Who we are and what this policy covers
Individual entrepreneur Danyil Proskurka provides Prolepsia (“Prolepsia”, “we” or “us”). The service includes the website at prolepsia.com, the app at app.prolepsia.com, the forecasts and reports the app makes, the public API, the MCP server, the AI connectors and the emails we send. This policy covers the personal data we handle through them. It does not cover other companies' services, such as the AI clients you connect.
We are the controller of the personal data this policy describes. This means we decide how and why it is used. If your organization needs a data processing agreement for content it puts into Prolepsia, write to us.
Write to contact@prolepsia.com with any question or request about your personal data. The operator's registered details are in Contact.
2. Information we collect
| Kind | What it includes | Where it comes from |
|---|---|---|
| Account details | Email address, name, handle, password (we store only a secure hash of it), organization, role and preferences. | You, an admin who invites you, or Google when you log in with Google. |
| Past access requests | The email address and the question, if you give one, that you sent when access on prolepsia.com required approval. Also our notes on the request, and whether we approved it. | You, and us when we decide on the request. |
| Your content | Questions, resolution criteria, instructions, notes, uploaded files, chat messages, voice input, decisions and feedback. | You and the members of your organization. |
| Forecasts and research | Forecasts, reports, the sources behind them, and full records of the research and Archimedes steps. | The service, when you or your organization ask. |
| Credits and billing | Credit balance, credit packs, amounts paid, expiry dates, charges, returned credits, billing notes, checkout and payment references, payment status, refunds, disputes, and who made each change or asked for each paid action. | Us, you, your organization and Creem. |
| Connections | API keys and AI client tokens (we store only secure hashes of them), the AI clients you connect and the permissions you approve, webhooks, share links, and when and from which IP address a key was last used. | You and your use of the service. |
| Usage and device data | IP address, browser and device details, pages and actions, errors, request times, login events and rate limit events. | Your browser and our servers. |
| Messages to us | What you write to us and our replies. | You. |
For an online credit pack purchase, we send Creem your account email, the pack and price, and references for your organization and checkout. Creem collects the payment and billing details you enter at its checkout. Prolepsia does not collect or store your full card number or security code.
Do not put sensitive personal data into questions or files unless you need to and have the right to. This includes data about health, religion, political opinions or sexual orientation.
3. How we use information and our legal reasons
Data protection law in the European Union and the United Kingdom requires a legal reason for each use. The table shows the reason we rely on.
| What we do | Legal reason |
|---|---|
| Provide the service: run your account, make forecasts, do research, show results, and send the emails the service needs. | Performing our contract with you. |
| Keep and answer past access requests, including related support questions. | Our legitimate interest in answering requests and keeping a record of earlier access decisions. |
| Take payments, add and charge credits, handle refunds and disputes, and keep billing records. | Performing our contract, and meeting accounting and tax duties. |
| Keep the service secure: protect logins, apply rate limits, prevent misuse and investigate incidents. | Our legitimate interest in keeping the service and its users safe. |
| Find and fix problems and improve the service, including staff reviews of forecasts and research records. | Our legitimate interest in a service that works well. |
| Product analytics that use cookies. | Your consent, which you can withdraw at any time. |
| Anonymous visit counts, and server records of account and forecast events. | Our legitimate interest in understanding how the service is used. |
| Send the briefing email and pick which of your forecasts to show in it. | Our legitimate interest in telling customers about forecasts they can use. You can turn it off at any time. |
| Meet legal duties, answer lawful requests, enforce our terms and defend legal claims. | Legal duties, and our legitimate interest in protecting our rights. |
We do not sell personal data. We do not use it for advertising. We do not use your content to train AI models.
4. AI models and research
- To make a forecast or answer a chat message, we send your question, instructions, notes, the text of uploaded files and the relevant chat messages to AI model providers. Their models do the research and the writing.
- Research tools send search queries and web page addresses to search engines, news and data providers and websites. The queries can contain words from your question. We do not add your account details to them.
- Archimedes runs code in an isolated container on our servers. Its AI model requests go through OpenRouter.
- When you use voice input, we send the recording to OpenAI to turn it into text. We do not store the recording.
- We send question text and forecast records to TypeSafe, an AI service. It judges how much a new question matters, describes how a forecast changed, and picks forecasts to show in the briefing email. It does not receive your name or email address.
- We use these providers' business services. We do not allow them to train their models on your content, and where a provider offers a setting that stops training or data collection, we turn it on. Providers may keep what we send for a limited time under their own terms, for example to detect abuse.
- A forecast is an estimate about events in the world. Prolepsia does not make automated decisions about you that have legal or similarly significant effects on you.
5. Emails we send
We send account emails, such as address checks, password resets and the welcome email. You cannot turn these off while you have an account. We also send notices about your own forecasts, questions and decisions, such as a finished forecast or a resolved question. Turn off forecast and resolution emails in Settings, under Notifications.
Accounts with a verified email address also get the briefing email each weekday morning. It lists the day's news with questions you can forecast. The briefing email is on by default. Turn it off in Settings, under Notifications, or with the unsubscribe link in any briefing email.
For readers who used Prolepsia in the last 30 days, the briefing also shows their own forecasts that cover a story. To pick them, we send the text of questions you can see to an AI model provider, which judges how relevant each one is.
6. AI connectors and Telegram
When you connect Prolepsia to ChatGPT, Claude, Perplexity or another MCP client, that client sends the tool requests you approve and receives the Prolepsia results. We store the client's name, the permissions you approved, connection times, secure hashes of the access tokens, and records of tool use. We need these to run and secure the connection. We never receive your password for the AI client.
The AI client is a separate service with its own privacy policy. Read it before you connect. Disconnecting stops the client's access to Prolepsia, but it does not delete results the client already received.
If you give the Prolepsia bot on Telegram an API key, it posts each finished forecast, with its probability and report, into the Telegram chat you choose. Telegram is a separate service with its own privacy policy.
7. Who can see your information
- Your organization. Members can see questions you share with the organization while sharing is on. Admins can see the member list and the credit history. An admin can hand the questions you created in a team organization to another member, including after you leave it.
- People with a share link. Anyone with a share link can read that question and its forecasts.
- Public pages. We do not make a question you created public without your agreement.
- Prolepsia staff. Authorized staff can read questions, forecasts and research records, including private ones, when they need to give support, run and check the service, find and fix a problem, investigate misuse, or meet a legal duty.
- Service providers. The companies listed in Service providers receive data to do work for us.
- The law and safety. We disclose data when the law requires it, or when we need to protect people, our rights or the service.
- A sale of our business. If we merge with another company or sell all or part of our business, personal data may pass to the buyer. This policy continues to apply to it, and we will tell you before it changes.
8. Service providers
We use these providers to run the service. Each one receives only what it needs for its task.
Creem also acts as a separate controller for payment data it needs as the merchant of record. Its privacy notice explains how it uses that data and how to contact it about your rights.
| Provider | What it does | What it receives |
|---|---|---|
| Contabo | Hosts our servers, database and file storage in the European Union. | All data the service stores. |
| Vercel | Hosts prolepsia.com on servers in the United States, and counts its visits without cookies. | Usage and device data from visits to prolepsia.com, and past access requests sent there. |
| Neon | Stores past access requests sent on prolepsia.com. | The email address and question in each access request. |
| Creem | Sells online credit packs as merchant of record. Handles payments, tax, receipts, refunds and disputes. | Account email, pack and price, organization and checkout references, and the billing and payment details you enter at checkout. |
| OpenAI | AI models and speech to text. | Content needed for forecasts, chat, reports and voice input. |
| Anthropic | AI models. | Content needed for forecasts, chat and reports. |
| OpenRouter | Passes requests to AI models made by other companies, such as Anthropic, Google and OpenAI. | Content needed for forecasts and Archimedes. |
| TypeSafe | AI service that rates questions, describes forecast changes and matches forecasts to the briefing. | Question text and forecast records. |
| Research and data providers | Search, news, social media, market and statistics data for research. | Search queries and web page addresses. |
| Resend | Sends our emails. | Your email address, name and the email content. |
| PostHog | Product analytics, error reports, server logs and traces, in its European Union region. | Usage data, your account ID, error reports, server logs and records of the steps a forecast chat reply takes, including what each step read and wrote. |
| Login with Google, when you choose it. | The login request. | |
| Linear | Tracks the work our team does to fix problems. | Short extracts of forecasts and research records when we report a problem. |
9. International transfers
The app's servers are in the European Union. prolepsia.com runs on Vercel's servers in the United States. Some providers, including the AI model providers, process data in the United States and in other countries. Where data protection law requires it, we rely on safeguards such as the European Commission's standard contractual clauses, the EU-US Data Privacy Framework, and the United Kingdom and Swiss versions of these. Write to us for more detail.
11. How long we keep information
We keep personal data only as long as we need it for the purposes in this policy.
| Data | How long we keep it |
|---|---|
| Account details | While you have an account. When you ask us to close it, we delete or anonymize them without undue delay, except records we must keep as this table describes. |
| Past access requests | Until you ask us to delete them. |
| Questions, forecasts and uploaded files | Until the question is deleted. Deleting a forecast hides it, but we keep the record. Removing an uploaded file hides it, and we delete the file when the question is deleted. |
| Full research records | 365 days, or until the question is deleted. |
| Login sessions | A session lasts 14 days. We delete its record, including the IP address and browser details, 7 days after it ends. |
| Links in emails | Address check and password reset links work for 3 days. Unsubscribe links work for 365 days. |
| AI client connections | Access tokens last 1 hour and refresh tokens 30 days. We delete expired tokens within an hour. We keep the record of each connection you approved while you have an account. |
| API key use | We clear the IP address of last use after 90 days. |
| Credit and billing records | For as long as accounting and tax law requires. Deleting a question does not delete its credit charges. |
| Security, audit and event records | While you have an account, and afterwards as long as we need them to keep the service secure and to deal with legal claims. Some event records name a question and the email address of the person who asked for a forecast. |
| Server logs on our own servers | About 7 days. |
| Backups | We keep encrypted backups for about 5 weeks, so deleted data can stay in a backup for that long. |
Our providers keep data under their own terms. PostHog keeps analytics, error reports, logs and traces for the period our PostHog account sets.
12. Security
We protect the service with encryption in transit, secure hashes of passwords, API keys and tokens, access controls, checks that keep each organization's data apart, logging, monitoring and encrypted backups. No system is perfectly secure. If a breach puts your personal data at risk, we will tell you and the authorities as the law requires.
13. Your rights and choices
You can do these yourself in Prolepsia:
- change your name, handle, preferences and password;
- delete questions you created;
- revoke API keys, share links and AI client connections;
- turn emails off in Settings, under Notifications; and
- change your cookie choice with Manage cookies.
Depending on where you live, you also have the right to ask us to:
- give you a copy of your personal data;
- give you your data in a format a machine can read;
- correct data that is wrong, including your email address;
- delete your data or close your account;
- limit how we use your data; and
- stop using your data where we rely on our legitimate interests.
You can also withdraw your consent at any time. This does not affect what we did before you withdrew it.
To use these rights, write to contact@prolepsia.com from the email address on your account, or the one you gave in your access request. We may need to confirm who you are. We reply within one month. Where the law allows, we may extend this by two more months for a complex request, and we will tell you if we do. If a request concerns content that belongs to a team organization, we may involve that organization's admins. We may keep data we must keep by law or need for a legal claim.
If you are in the European Union or the United Kingdom, you can complain to the data protection authority where you live or work, or where you think a breach happened. We would like the chance to help first.
United States
If a US state privacy law applies to you, you may have the right to know what personal data we hold about you, and to have it corrected or deleted. We do not sell personal data, and we do not share it for advertising based on your activity across other companies' services. We will not treat you differently for using your rights. If we refuse a request, you can appeal by replying to our answer. You can also ask someone to make a request for you, if you confirm that you gave them permission.
14. Children
Prolepsia is not for anyone under 18, and we do not knowingly collect personal data from children. If you think a child has given us personal data, write to us and we will delete it.
15. Changes to this policy
We may update this policy when the service or the law changes. We post the new version on this page with its effective date. Before a material change takes effect, we tell you by email or in Prolepsia. See also the terms of service.
16. Contact
Write to contact@prolepsia.com with any question, request or complaint about privacy.
Legal operator: Individual entrepreneur Danyil Proskurka
Legal form: Individual Entrepreneur
Identification number: 305546861
Registration date: 08/07/2022
Registering authority: LEPL National Agency of Public Registry
Legal address: Georgia, Tbilisi, Vaki district, Nutsubidze pl., micro/district IV, building 21, apartment N103