Privacy Notice

Who is responsible for your data

The controller of your data is Damian Gaslawski, a sole trader trading as Unfussy Labs.

• Email: unfussylabs@gmail.com

You can use Provely without an account

You can paste a prompt and run one full check without signing up, without giving a name, and without giving an email. That one check is all you get without an account, and it is one in total, not one a day: "Daily limits and your IP address" below explains how we count it. Creating an account is optional. It lets you run more checks, save them and read them back later.

Some things do need an account. Connecting Provely to another app, such as ChatGPT or Claude, needs one, because there is no other way to know whose daily allowance to count or whose prompts to save; see "Using Provely from inside another app" below. Importing a file into a brief needs one too: briefs belong to accounts, and the daily import count is counted against yours. Anything to do with a team needs one as well, because a team is a set of accounts.

If you create an account

You can sign up with an email address and password, or with Google or GitHub. When you do, we store the email address tied to your account, the username you choose, an optional display name and avatar, and which method you signed in with. Email sign-up asks you to verify your email before the account is active, and sign-up is protected by a bot check (Cloudflare Turnstile).

You stay in control of the account. You can change your password at any time, and delete the account from your profile. Deletion is refused in one situation, and it is a situation you can get yourself out of: if you are the last admin of a team, we will not delete your account while other members are still in that team, or while its plan is still live or a payment is still in flight, because that would leave a team nobody could run. The refusal says which of those it is. Hand the team to another admin, or settle the plan and let the team empty, and the deletion goes through. Deleting the account removes your profile, your briefs and the checks saved to it, and your team membership goes with it. What stays is the work you put into a team and the name that was on it: a check you saved to a team stays with that team, still credited to the name you had when you saved it, and the same is true of the lines you added to either of the team's briefs, of the saves you made to them, and of the proposals you sent to the company brief, whether they were approved or declined. The notices the team space had sent you are deleted with your account, because they were addressed to you and to nobody else. That is the team's work and not only yours. "Teams: what your colleagues see, and what stays behind" below sets out exactly what remains. If you want a prompt taken out of a team space, remove it there before you delete the account, or ask a team admin to.

Provely shares its accounts with provely.dev, our Skill Check tool for Claude Agent Skills, because both are the same Provely account system. The same sign-in works on both sites. If you create an account here it works there too, and deleting your account removes it from both sites at once.

Age and school accounts

You must be at least 16 years old to create an account.

Some email domains, including a school's, are on a list that gets a larger free allowance. Accounts on those domains are never screen recorded, even if the account holder says yes to recordings. "Analytics" below explains what a recording is.

What we store, and for how long

When you run a check, we store the prompt you paste and the results the check produces.

• If you are not signed in, an unsaved check is automatically purged after 30 days, unless you save it or share it.
• If you are signed in, or you save a check after signing in, it is kept in your history until you delete it.
• Your browser also keeps a local, on-device record of your recent checks so they are there when you return. When you sign in, you choose whether to sync that local history to your account or clear it.

Saving or sharing keeps the text until you remove it.

How we hold what we store

Your account, your saved checks and your Context live in our database at Supabase, in the EU region. The database is encrypted at rest. Row level security is on, so a row is tied to the account that owns it, and the browser cannot reach another person's rows at all. We store what you need in order to read your own results back, and nothing further.

Some checks store nothing. The hallucination check, which reads one AI answer for claims it cannot back, writes a copy only when you are signed in, so that you can find it again in your history. Run it signed out and nothing is written down. Run it through a connected app and nothing is written down there either, so there is no id, no row and no link to come back to.

Secrets are scrubbed before storage

Before we store or submit your prompt, we scan it for obvious secrets, such as API keys, and strip them out. When that happens, we show you a warning. Please still avoid submitting credentials: automated scrubbing catches common patterns, not everything.

Sharing is explicit, and shared pages are public

Nothing you run is public by default. Sharing is a deliberate act. Before a page goes public, we show you a preview of exactly what will be visible, run a fresh secrets scan, and ask you to confirm with a click. Once shared, the page is public: anyone with the link can read it.

Briefs: the context you write, and what reads it

A brief is a document you write about your work, so a check does not have to be told the same things every time. You can keep one General brief and up to ten named ones. We store the text you type, the last few saved versions of it, and, for a line you kept from a check you ran, a note of which check it came from. A line you brought in from a file is stored exactly like a line you typed; the file it came from is not stored at all, and "Where your prompts are sent" below says what happens to it.

Your briefs are read for your own checks and nothing else. A check you run while signed in, on the website or from a connected app, reads your General brief, a named brief as well if you started the check from one, and your team's company brief as well if you are a member of a team on a live plan. That is the default; where the run offers you a choice of context, it reads what you chose, down to nothing at all, and the check page says so. A team's project brief is never read automatically: it goes into a check only when you pick it there, and the check records which one it read, by name. Those lines are put into the text we send to the model providers along with your prompt. That is what a brief is for, and it is the only thing it is used for: we do not read your brief to profile you, and it goes nowhere but the run.

Every check says what it read. The check page names the briefs the run drew on, lists the lines that went in, marks the ones that came from the team, and says plainly when a run read nothing. That record is yours alone: it is not shown on the page to anyone else who opens the check, and brief content is removed from a check before it can appear on a public share page. Sharing a check never publishes your brief.

If you are not signed in, your brief stays on your device and is sent with the check for that one run. The lines it contributed are recorded on that check, as they are for a signed-in run.

Deleting a brief deletes its text and its versions. Deleting your account deletes all of your briefs. Lines you added to a team's briefs are not yours alone and are covered below.

Teams: what your colleagues see, and what stays behind

If you join or buy a team, some of what you do stops being private to you. This section says exactly which parts.

What your teammates see of you. Your display name, or your username if you have not set one, or the words "A teammate" if you have set neither. Never any part of your email address. The prompts you save to the team, with their evidence, credited to you by that name. The lines you have added to the team's company brief and to its project briefs, each one marked "added by" you, and each save of either document recorded against the name of whoever made it. The team's project briefs are visible to every member, like the rest of the team space. A personal brief only if you choose to share it, read-only, and you can stop sharing it at any time. Every check, answer check and chat rescue you run while you are working in the team space, whether or not you save it. Anything you run outside the team space and do not save to the team stays private to you.

What a proposal to the company brief holds. The lines you proposed, scrubbed for secrets on the way in like every other line you write here, the note you wrote to the admins if you wrote one, your display name as it stood when you sent it, and the time you sent it. Once an admin decides, the row also holds which admin decided, their name at that moment, and when. Admins see the proposals waiting, with the name of whoever made each one; you see what became of your own. A proposal is kept after it is decided, approved and declined alike: there is no way to withdraw one or delete one, and the only thing that removes it is the team being closed. If you delete your account, the link between you and the proposal is removed and the name snapshot stays, as it does everywhere else in a team.

What a notice holds. Who it is for, which of the five kinds of event it was, the display name of the person who did the thing, a count of the lines involved or, for a seat change, the new number of seats with a word for which kind of change it was and the count a cancelled reduction would have dropped to, a link to the page in the team space where the thing itself can be read, and the times it was created and read. Never any brief text, and no account identifier but the reader's own: the lines live in the brief, which is why the notice carries a link to it rather than a copy of it. We keep the newest hundred for each person and delete the rest, so an unread notice can be pushed out by newer ones, and we drop the ones about a team you are no longer in, because their links lead somewhere you can no longer open; the proposal queue, the brief and its history all hold the events independently. Your notices are deleted when your account is.

Who is told what. The admins, when a member makes a proposal. Whoever made a proposal, when an admin approves or declines it. Every member, when the company brief changes, however it changed. The admins, when another admin changes the number of seats, because they are the people paying for them; a reduction that was scheduled earlier and simply arrives at the next invoice announces nothing, because nobody did anything that day. Nobody is ever told about their own action. Saving a project brief tells nobody.

How much you have used. The team's usage page shows the shared pot and the breakdown of who has drawn from it, by name. Every member sees it, not only admins.

Email addresses. An invitation that is waiting for an answer holds one of the team's seats until it is accepted or runs out of time, and members see the address on the invitations that are currently holding a seat, because that is the address it was sent to. An invitation that has run out of time holds no seat, and members are told only how many of those there are, not the addresses. Admins see every invitation in full, waiting or expired, because they are the people who send one again or take one back. A revoked invitation and an accepted one are not listed to anybody. Once someone joins, the team surfaces show their display name and not their address.

What an admin can do. Admins invite people by email, change roles, remove members, manage the plan and its seats, and download an export of the team's proved prompts. That export carries, for each prompt, its Provely reference, its title, the model it was proved on, the dates it was proved and shared, how much of the intent held, its state, and the name of the person who shared it. It does not carry prompt text, and it does not carry anyone's account identifier.

Names stay after an account is deleted, by design. When you delete your Provely account, the link between you and the team's records is removed, but the name you had at the time is not. It stays on the prompts you saved to the team, on the lines you added to the team's company brief and to its project briefs, on the saves you made to either, and on the proposals you sent to the company brief. This is deliberate: those records belong to the team, and a team that lost every name would be left with work nobody could account for. Your teammates are shown the same name you had when you were there. If you would rather a prompt did not stay, take it out of the team space before you delete the account, or ask an admin to.

Removal and closure. If an admin removes you from a team, the prompts you saved to it stay there and remain credited to you; ask an admin to take one out, or take it out yourself before you go. A personal brief you had shared stops being visible to that team the moment you are no longer a member. When a team is closed, its company brief, its project briefs, the proposals made to it and the notices it sent are deleted with it, and each prompt in the space goes back to the person who shared it, including anyone who was removed from the team earlier, as long as that person still has a Provely account. A prompt whose sharer has already deleted their account is deleted with the team, because there is no history left to return it to.

Daily limits and your IP address

If you are not signed in, you get one check in total. We count it against a salted hash of your IP address, and we keep that record with no end date, because deleting it would give the same address a fresh check. On the website, daily limits are also keyed to a salted hash of your IP address. We do not store your raw IP address. The hash lets us count usage without holding the address itself. When you use Provely through a connected app, limits are keyed to your account instead, for the reason given in "Using Provely from inside another app". Importing a file into a brief is counted against your account as well, on the website too, because it takes a signed-in person to have a brief to import into.

For what today's limits actually are, see the Usage limits page.

The run step uses a bot check

The run step, where we send your prompt to the models, is protected by Cloudflare Turnstile, a bot check. It is there to stop automated abuse of the run button.

Where your prompts are sent

When you run a test, your prompt is sent to one or more of these three model providers, so we can see what the prompt actually produces. Which of them receive it is decided by the models selected for that test, and only the selected ones are sent anything:

• Anthropic (Claude Sonnet 5)
• OpenAI (GPT-5.6 Luna)
• Google (Gemini 3.6 Flash)

How many of them see it depends on who is running the test and what they picked. Signed out, your one test runs on all three models, so all three providers receive your prompt. Signed in, you tick which models to run before the test starts; two are ticked by default and the third is opt-in. A test is only ever sent to the providers you selected. Through our MCP server a test starts on the model matching the tool you are calling from, and reaches the others only if you ask for them.

When you rewrite a prompt and run it again, we send it only to the models that missed the first time: a model that already did what you asked has nothing left to prove, and not re-running it means one fewer provider sees your prompt. The result page names any model that was left out.

We pay for those calls ourselves. You never supply an API key, and your prompt is never billed to or run under your own account with them. We test on these models and we say so. We do not test your own model, your own account, or your own setup.

What the model providers do with your prompt

We use commercial API access to these providers, not their consumer chat products. Under those API terms they do not train their models on what we send. They keep a short operational copy so they can investigate abuse, typically up to 30 days, and then it goes. It is held under their data processing terms for us, and it is theirs to protect rather than theirs to use.

To be plain about it, your prompt does leave our servers when a test runs. It has to, because the point of the check is to see what a real model does with your exact wording. This is the same arrangement any company has when it runs on a cloud provider. The providers publish data processing agreements and hold SOC 2 reports, and our calls run under those terms.

Stricter options exist on the provider side, such as endpoints that retain nothing and requests pinned to one region. We do not have those today. They are things we can take up as we grow into larger customers, and this notice will say so when we do.

One other thing is sent to a model provider, and only when you ask for it. If you import a file into a brief, the whole text of that file is sent to Anthropic, with an instruction to pull out lines of durable context. If the model's first answer comes back unreadable we send it once more and no further. The card tells you a model will read it before you choose the file. We do not store the file: it is read for that request and dropped, there is no copy of it on our side, and nothing from it reaches a brief until you have seen the lines, edited them if you want to, and pressed the button. If you close the page instead, none of it lands in a brief and none of it is kept.

What we do keep about an import is arithmetic. Twenty imports a day per person is the limit, and it is counted against your account rather than your address, because the import needs you to be signed in; the row that holds it carries your account, a date, a kind and a number, and no part of your file is in it. We also record what the call cost us in our own running total of the day's model spend, which is money and nothing else. Both of those rows are written when the import runs and stay after it, whether or not you keep any of the lines; neither holds the file, the lines it produced, or the name of the file.

Work packs, voice notes, photos and to-dos

A work pack turns a description of your work into a set of prompts. Work packs need an account.

• What you type or paste into a pack is stored on your account, with the jobs and prompts made from it, until you delete the pack or your account. To sort it into jobs, the text is sent to one of the model providers named above (OpenAI or Google). Prompts you then test from a pack go to the providers like any other test.
• Voice notes. If you add a voice note, the audio is sent to OpenAI to be turned into text. We do not store the audio. The text comes back to your paste box, and it is only stored if you then use it in a pack.
• Photos. If you add a photo, for example of handwritten notes, the image is sent to Google to read the text off it. We do not store the image.
• Files. If you add a PDF, Word or PowerPoint file, we take the text out of it on our own servers. No model provider sees the file for that step, and we do not store it. The text comes back to your paste box, like a voice note.
• To-dos you make from a pack are stored on your account until you delete them or your account.
• Teams. A pack you make while working in a team space can be opened by every member of that team.

Chat rescue

Chat rescue reads a conversation you had with an AI chat and suggests what went wrong. You can use it with or without an account. You can paste the conversation, upload a file with it, or give us a share link, and we then open that link to fetch the conversation. The conversation text is sent to the model providers named above to be read and diagnosed. We store the conversation text with the result, and we delete that text after 30 days. A short record of the kinds of problems found is kept after that, without the conversation. We do not store an uploaded file itself.

Using Provely from inside another app

You can connect Provely to an app you already use, such as ChatGPT, Claude, or Claude Code, and check a prompt without leaving it. What that involves:

• Connecting needs your permission, once. The app sends you to a Provely page that names the app asking, says what it will be able to do, and waits for you to allow or cancel. Nothing happens until you allow it. You can disconnect it later in that app's own settings.
• We never see your password. The approval step signs you in to Provely in the normal way, and hands the connected app a limited key that only works with Provely. The app never receives your password, and we never receive it from the app.
• Only the prompt you ask about is sent. The connected app passes us the prompt being checked, not the rest of your conversation. We do not ask for, receive, or store the surrounding chat, your files, or anything else in that app.
• We record which app connected. For each check made this way we store the name of the app and the client it identified itself as, so we can support it and count usage. Nothing else about the app or the conversation is kept.
• Checks are saved to your account, exactly as they are on the website, and they appear in History with their results.
• Prompts still go to the model providers named above when a test runs, on the same basis as a check run on the website.
• Your briefs are reachable, and so is your team's. A connected app can read the briefs on your account and, if you are in a team, that team's company brief, so it can work with the context you have already written. It can add to your own brief when you ask it to. It cannot write to the company brief from a connected app, and it cannot propose a change to it either; both happen on Provely itself, where colleagues can see who added each line. The team's project briefs are not reachable from a connected app at all.
• Your team's saved prompts are reachable too. If you are in a team, a connected app can list and open the prompts your team has saved, and save one to the team on your behalf. It reaches only the team you are in, worked out from your account, never another one.

Daily allowances for connected apps are counted against your account rather than an IP address, because a connected app talks to us from its own servers rather than from your device.

Paid plans

Paid plans are paid for through Stripe, on Stripe's own hosted pages and under its own terms. Your card details are given to Stripe and never reach us: we do not ask for them, receive them, or store them. Pro and Max, the paid plans for individuals, can be bought today. The Team plan can be bought too, and a team can also start with a 14-day pilot that needs no card. Nothing else on Provely can be paid for.

What we store about a paid individual account is the Stripe customer and subscription identifiers for it, which plan it is on, whether it is billed monthly or yearly, when its current period starts and ends, whether it has been set to stop at the end of that period, and any plan change waiting to take effect at the same boundary.

What we store about a paid team includes the Stripe customer and subscription identifiers for it, how many seats it pays for, whether it is billed monthly or yearly, when its current period ends, whether it has been set to stop at the end of that period, and any seat reduction waiting to take effect at the same boundary. Before a purchase completes we also hold the choices made on the checkout form: the team name, the number of seats, and the interval.

We keep no copy of an invoice. The billing page reads invoices from Stripe when you open it, and the PDF link on it points at Stripe. We do keep each billing notification Stripe sends us, exactly as Stripe sends it, so that a repeated delivery is not acted on twice.

Emails we send

We send these emails, and only these, because they are part of running your account or a purchase:

• a verification email when you sign up with email and password, and a password reset email when you ask for one;
• a welcome email when your account is created;
• a thank-you email when a purchase goes through, and a confirmation when you change plan;
• for teams: an invitation to the address a team admin gave, carrying a single-use link that expires, plus emails when a team is ready, when you join one, and when someone joins yours; we keep the address on the invite so the admin can see whether it arrived and send it again;
• for a team pilot: a reminder to the team's admins when the pilot has a week or less left, and an email when it ends;
• one welcome email if you join the waiting list; we record whether you ticked the box asking for news from Unfussy Labs.

Apart from that one box, nothing here puts you on a mailing list. If you send us feedback from a check, that note is emailed to us, together with the address you gave if you chose to leave one.

The verification and password reset emails are sent by Supabase, which runs our sign-in. The others, and the feedback note, are sent through Resend, an email provider. Each receives the address and the message in order to deliver it.

Analytics

Counting, for everyone. Whether you are signed in or not, we count how the site is used: page views, anonymous counts of what was clicked and which features were used, clicks that did nothing, and errors. This runs through PostHog, on its EU servers. It is kept in your browser's memory only, so nothing is written to your device for it. We also use Vercel Analytics and Vercel Speed Insights, which count visits and page speed without cookies.

Linking usage to your account. If you are signed in, those usage events are linked to your account id, so we can see how the product is actually used and where it goes wrong. Nothing is stored on your device for this either. We do this on the basis of our legitimate interest in improving the product. You can object at any time: turn off "Link my usage to my account" under Your account > Settings > Privacy choices.

Screen recordings, only if you say yes. If you are signed in, we ask whether we may record your sessions: a replay of what happened on screen, so we can see where the product goes wrong. We record only after you say yes, on the consent bar or in Privacy choices. Text you type is masked in those recordings, as are the prompt, the answer and the findings shown on screen. Recordings are kept for 30 days and then deleted. While recordings are on, PostHog stores an identifier on your device, in local storage and in a cookie, so a recording can continue after you reload the page. You can withdraw your consent at any time in the same place, under Your account > Settings > Privacy choices. Withdrawing does not affect recordings made before you withdrew. Accounts on the school domain list described in "Age and school accounts" are never recorded, even with consent.

Your choice is recorded. We store the choice you made, with the time you made it and the version of this notice you saw, so we can respect it and show that we did. A "Privacy choices" link in the site footer takes you back to it.

Cookies and device storage

These are strictly necessary for the site to work, so they do not need your consent:

• the cookies that keep you signed in, set by our sign-in provider, Supabase;
• the cookie that remembers your language;
• cookies that remember which space you are working in (your own or your team's), carry a team invitation through sign-in, and hold your choices on the way to a checkout;
• the record of your privacy choices described in "Analytics" above;
• things kept in your browser's local storage so the site works as you left it: drafts, your recent checks, a brief when you are not signed in, your theme and your view preferences.

One item needs your consent: the PostHog identifier stored in local storage and a cookie while screen recordings are on. It is only set after you say yes to recordings.

Where your data is hosted

Your account and saved prompt-check data are hosted on Supabase (EU region) and Vercel. Your briefs, and a team's records including its company brief, its project briefs, the proposals made to it and the notices it sends, are held the same way. To run a test, your prompt is also sent to the model providers listed above, and, on the website, to Cloudflare for the bot check.

Sending data outside Switzerland and the EU

Some of the services we use are based in the United States, or are run by companies headquartered there. The model providers, OpenAI, Anthropic and Google, receive your prompt when a test runs, as described above. Others, such as Supabase, Vercel, Stripe, Resend, Cloudflare and PostHog, process data for us as part of running the service.

When data goes to a country without an equivalent level of protection, we rely on the EU Standard Contractual Clauses, and on the EU-US and Swiss-US Data Privacy Framework where the provider is certified under it.

What we never do

• We never sell your data.
• We never use your prompts to train our own models.
• We never let the model providers train on your prompts either. The API terms we run on exclude it.
• We never make sharing a default or a trick. It is always an informed choice, with a preview and a confirmation.
• We never handle your card details. Stripe processes payments on its own pages, not us.

Your rights under GDPR and the Swiss FADP

Why we are allowed to use your data. Each use has a legal basis:

• Contract. Running the checks, tests, packs and rescues you ask for, keeping your account, your saved work and your team, taking payment for a plan, and sending the emails listed in "Emails we send".
• Legitimate interest. Keeping the service safe and fair: the bot check, scrubbing secrets, and counting limits against a salted hash of your IP address. Counting how the site is used, and linking usage events to your account when you are signed in, so we can improve the product. You can object to this.
• Consent. Screen recordings, and news from Unfussy Labs if you ticked that box on the waiting list. You can withdraw consent at any time. Withdrawing does not affect what we did before you withdrew.
• Legal obligation. Keeping records the law requires us to keep, such as payment records, and answering lawful requests from authorities.

Your rights. Whether you are in the EU, the UK, Switzerland, or anywhere else, you have these rights over your data:

• Access. You can ask what data we hold about you.
• Rectification. You can ask us to correct data that is wrong.
• Erasure. You can ask us to delete your data.
• Restriction. You can ask us to limit how we use your data while a question about it is settled.
• Portability. You can ask for a copy of your data in a format you can take elsewhere.
• Objection. You can object to how we use your data, including to the linking of your usage to your account.
• Withdrawing consent. Where we rely on your consent, you can withdraw it at any time.

To exercise any of these rights, contact unfussylabs@gmail.com. On request, we delete all data we hold about you, not only what a self-serve delete button reaches.

Complaints. If you think we have handled your data wrongly, you can complain to the Swiss Federal Data Protection and Information Commissioner (FDPIC), or to the data protection supervisory authority in the EU or EEA country where you live.

Deleting your account

Deleting your account from your profile removes your profile, your saved checks, and the other account data described above right away. Account data that is not removed at that moment, such as anonymised usage records kept for counting daily limits, is deleted within 30 days of the deletion request. The record of the one check used without an account is different: it is keyed to a salted hash of an IP address, not to your account, so deleting your account does not remove it, and we keep it with no end date.

Team records are the one thing that does not work that way, and "Teams: what your colleagues see, and what stays behind" above sets out exactly which records they are. The link between you and them is removed when your account goes, and the name you had at the time stays on them. They are not on a 30 day clock, because they are the team's records rather than yours: a prompt you saved to a team stays there until you or an admin takes it out of the team space, and the lines, saves and proposals you left on the team's briefs stay until the team is closed. Closing a team deletes its briefs, its proposals and its notices with it. If you would rather a prompt did not stay, take it out before you delete the account, or ask an admin to.

AI providers do not train on your prompts

Prompts and outputs sent to our AI providers (Anthropic, OpenAI, and Google) through their commercial APIs are not used to train their models. This is a term of the API agreements we run on, separate from their consumer chat products, which is why we can say it plainly rather than as a promise about how any one provider behaves in general.

Contact

Questions about your data, or a request about it: unfussylabs@gmail.com.