Prisma7

Privacy Policy

Last updated: October 16, 2026

1. Who we are

Prisma7 is operated by SecureTechs, a company based in Pakistan, which is the data controller for your information. Our postal address is 506, AbdulAziz Building, Al Nahda 01, Dubai, United Arab Emirates. Prisma7 is a marketplace of prompts for AI image generation: you can browse, search, copy, like and submit prompts. Questions about this policy can be sent to [email protected].

2. Information we collect

2.1 Information you give us

• Account details: your name and email address. If you sign up with email, you also choose a password — we store only a salted, one-way hash of it (Argon2), never the password itself.
• Content you submit: prompts (title, prompt text, optional negative prompt, categories and tags) and any preview images you upload with them.
• Activity: prompts you like and reports you file about prompts, including the reason you give.
• Communications: messages you send to our support address.

2.2 Information from Google

If you choose “Continue with Google”, we receive limited profile information from your Google account. This is described in detail in section 3.

2.3 Information collected automatically

• Security tokens: when you sign in we issue a short-lived access token and a refresh token so you stay signed in. We store only a hash of the refresh token, along with its expiry.
• Device push token: if you allow notifications, the App obtains a push token from Google Firebase Cloud Messaging (FCM) and sends it to our server so we can notify you about new prompts and features. This is described in detail in section 4.
• Technical data: like most online services, our servers process your IP address and basic request information (such as time and endpoint) to deliver the service, apply rate limits and protect against abuse. We do not use this for tracking or advertising.

We do not collect your contacts, precise location, photos from your device (other than images you explicitly choose to upload), or advertising identifiers, and the App contains no third-party advertising or analytics SDKs.

3. Google Sign-In and Google user data

Prisma7 offers “Sign in with Google” (Google OAuth 2.0) as an optional way to create an account and sign in. This section explains exactly which Google user data we access and how it is used, stored, shared and deleted.

3.1 What we access

We request only Google’s basic sign-in scopes: openid, profile and email. With your consent, Google shares:

We do not request access to your Gmail, Google Drive, Google Photos, contacts, calendar or any other Google service, and we cannot read or modify any of your data in those services.

3.2 How it works

• In the Android app, Google Sign-In gives the App a signed ID token. The App sends it to our server, which verifies its signature, issuer, expiry and intended audience with Google before reading the fields above.
• On the web, you are redirected to Google’s consent screen; Google returns a one-time code that our server exchanges for your basic profile.
• Google access tokens and ID tokens are used only during sign-in and are not stored. We never see or store your Google password.

3.3 How we use it

Google user data is used only to:

• create your Prisma7 account or sign you in to your existing one;
• link Google Sign-In to an existing Prisma7 account that uses the same verified email address (and mark that email as verified);
• display your name and avatar within the App;
• contact you about your account.

We do not use Google user data for advertising, sell it, use it to build user profiles for unrelated purposes, or use it to develop, improve or train generalized artificial-intelligence or machine-learning models.

3.4 Sharing

We do not share Google user data with third parties except with the infrastructure providers that host our service on our behalf (see section 6), when you choose to make your name public by publishing a prompt, or when required by law.

3.5 Storage and protection

Your Google account ID, email, name and avatar URL are stored in our database with the rest of your account, protected as described in section 7.

3.6 Retention, deletion and revoking access

• We keep this data for as long as your account exists.
• When you delete your account (see section 9), the linked Google account ID, email, name and avatar URL are permanently deleted.
• You can revoke Prisma7’s access at any time from your Google Account at myaccount.google.com/connections. Revoking access stops future Google sign-ins; it does not by itself delete data we already hold — request deletion for that.

3.7 Google API Services User Data Policy

Prisma7’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

4. Push notifications

The Prisma7 app can send you push notifications. They are optional and are sent only if you allow them.

4.1 What we collect

When you allow notifications, the App registers with Google’s Firebase Cloud Messaging (FCM) service, which issues a device push token: an identifier for the App’s installation on your device that lets notifications be delivered to it. The App sends this token to our server, which stores it. The token does not contain your name, email address, contacts, location or any other content from your device.

To deliver a notification, our server sends the token and the notification’s content to FCM, and Google delivers it to your device. Google processes this data under its own privacy policy.

4.2 How we use it

We use the device push token only to notify you about:

• new prompts added to Prisma7;
• new features added to the App.

4.3 What we don’t do

• No spam. We send notifications only when there is something new in Prisma7, and we keep them infrequent.
• We do not use the token or notifications for advertising, to promote third-party products, or to track you across other apps or websites, and we do not sell the token or share it with anyone other than Google for delivery.
• The notification permission is used only to show notifications. Allowing it does not give Prisma7 access to any other permission or data on your device (such as your location, contacts, camera or files), and we do not use the token for any purpose unrelated to notifications.

4.4 Your choices

On Android 13 and later, the App asks for your permission before it can show notifications. You can turn notifications off at any time in your device settings (Settings → Apps → Prisma7 → Notifications); everything else in the App keeps working. When you delete your account, we delete the device push tokens linked to it.

5. How we use information

• To provide the App: accounts, sign-in, browsing, search, likes and prompt submission.
• To verify your email address and send transactional emails (verification, account and security notices). We do not send marketing email without your consent.
• To send push notifications about new prompts and features, if you allow them (see section 4).
• To review and moderate submitted prompts and handle reports.
• To power search: the title and text of published prompts are converted into numerical “embeddings” so you can search by meaning.
• To keep the service secure, prevent abuse (for example, rate limiting) and fix problems.
• To comply with legal obligations and enforce our Terms & Conditions.

Where the GDPR or similar laws apply, we rely on: performance of our contract with you (providing the App), our legitimate interests (security, moderation, improving search), your consent (where requested, such as for push notifications), and legal obligations.

6. Sharing and service providers

We do not sell or rent personal information. We share it only with service providers that process it on our behalf under contract, only as needed to run Prisma7:

We may also disclose information if required by law, to protect the rights, safety or property of our users or others, or as part of a merger or acquisition (in which case this policy will continue to apply to your information).

Public content: prompts you publish, their preview images and your display name are visible to other users once approved.

7. Storage and security

• All traffic between the App and our servers is encrypted in transit (HTTPS/TLS).
• Passwords are stored only as Argon2 hashes; refresh tokens and email verification tokens are stored only as SHA-256 hashes.
• Uploaded images are stored in private cloud storage and served through short-lived signed links.
• Access to production systems is limited to authorized personnel.

No method of transmission or storage is 100% secure, but we work to protect your information and will notify you and the relevant authorities of a breach where the law requires.

8. Retention

• Account information and content: for as long as your account is active.
• Refresh tokens: until they expire or you sign out; email verification links expire after 24 hours.
• Device push tokens: for as long as your account exists, and deleted along with it.
• Server logs: kept for a short period for security and debugging, then deleted.
• We may retain limited information longer where required by law or to resolve disputes.

9. Deleting your account and data

You can request deletion of your account and associated data at any time, without the App installed, using our account deletion request form. You can also email [email protected] from the email address linked to your account, with the subject “Account deletion request”. We complete deletion within 30 days of receiving a request.

Deletion permanently removes:

• your profile (name, email, avatar, password hash);
• linked Google Sign-In data (Google account ID);
• prompts you submitted and images you uploaded;
• your likes, reports, sign-in tokens, verification tokens and device push tokens.

Backups are overwritten on a rolling basis, after which deleted data is no longer recoverable. We keep only a minimal record of the deletion request itself (the email address, the date and its outcome) so we can show the request was handled.

10. Your rights

Depending on where you live (for example under the GDPR, UK GDPR or California privacy laws), you may have the right to access, correct, delete or export your personal information, to object to or restrict certain processing, and to withdraw consent. To exercise any of these rights, contact [email protected]. We will not discriminate against you for exercising them. You may also lodge a complaint with your local data-protection authority.

11. Children

Prisma7 is not directed to children under 13 (or the minimum age required in your country), and we do not knowingly collect their personal information. If you believe a child has provided us information, contact us and we will delete it.

12. International transfers

Our service providers may process data in countries other than your own, including the United States, the European Union (Sweden) and Japan. Where required, we rely on appropriate safeguards such as Standard Contractual Clauses.

13. Changes to this policy

We may update this policy from time to time. We will change the “Last updated” date above and, for material changes, notify you in the App or by email before they take effect.

14. Contact us

SecureTechs
506, AbdulAziz Building, Al Nahda 01, Dubai, United Arab Emirates
Privacy: [email protected]
Support: [email protected]