Privacy Policy

Effective September 26, 2026

This Privacy Policy explains how DayTwoAI LLC, a Texas limited liability company doing business as Promptforce.ai ("we," "us"), handles information in connection with the Prefex software (the "Software") and the promptforce.ai website (the "Site").

Our guiding principle: Prefex is self-hosted and runs on infrastructure you control. We do not operate a cloud service in your request path, and we do not receive your prompts, responses, or source code.

1. Prefex Software: what stays local

When you run the Prefex Software:

• Your prompts and responses flow from your client, through your self-hosted proxy, to the third-party LLM provider you configure (e.g., Anthropic, OpenAI, Google). They are handled under that provider's privacy policy, not ours. We never see or receive them.
• Operational data (request metadata such as token counts, model, latency, cost, cache indicators and hashes, and, depending on your configuration, locally retained items such as recoverable compacted-output originals, extracted session-memory facts, an opt-in advisor corpus, your configuration, and your license metadata) is stored only on infrastructure you control. You can inspect and delete it at any time. See Trust for specifics.

We do not collect this operational data. The Software sends us nothing automatically. An anonymous daily usage summary is sent only if you opt in (see Section 2).

• Optional governance features (a policy gateway appliance, hosted guardrail or content-moderation providers, an OpenTelemetry collector, and offload targets) send data only to endpoints you configure, never to us. All are off by default. Depending on the feature, what is sent can include tool-call arguments, text from your newest message, or trace metadata. Those endpoints handle the data under their operator's terms.
• The optional signed audit log, policy and guardrail decision records, and personal-data masking all run and store data on your machine. Masked values are held in memory only for the request that needs them.

2. Information we may receive

Sent automatically unless you turn it off:

• Anonymous daily usage report (off by default, opt-in): if you opt in, once a day the Software sends a summary of counts and percentages: version, operating system, token and turn counts, cache and compaction rates, the mix of providers and model tiers, and which features are on. It never includes prompts, responses, tool output, file paths, project or repository names, model names, API keys, session or device identifiers, or dollar amounts, and it carries no identifier that links one day's report to another. Our collector discards any field outside a fixed list. Nothing is sent unless you opt in: an absent setting means off. During installation it is disclosed and, in a terminal, you are asked [y/N] (default No); without a terminal it stays off, and a re-run or upgrade keeps your earlier choice. Opt in with prefex install --usage-reporting, prefex toggle usage-reporting on, or the Settings · Privacy toggle in the dashboard; turn it off the same ways. Trust lists every field.
• Install and upgrade ping (opt-in): only when you set PREFEX_USAGE_REPORTING=1 on the install command, the install script sends one request to our Site carrying the version, operating system, processor architecture, and whether it was an install or an upgrade. Nothing else, and never again until the next install or upgrade. Without that variable no ping is sent; PREFEX_NO_PING=1 (or DO_NOT_TRACK=1) suppresses it even when it is set.

Requests that send nothing about you: once a day the Software asks GitHub for the latest public release tag (on by default; turn off with prefex toggle update-check off), and prefex advisories downloads a signed security advisory file. Neither request carries a version, identifier, or anything about your installation. GitHub, as the host, sees the request.

Opt-in, user-initiated paths:

• Leaderboard submission (optional): if you choose to submit to the public leaderboard from the dashboard, we receive aggregate statistics (such as request counts and savings totals, never prompt or response content) plus the username and email you enter so your entry can be attributed.
• Marketplace catalog fetch (optional): if you enable telemetry, the Software downloads an optional catalog from our endpoint. This is a download; it does not upload your usage data.
• Website & contact: if you visit the Site or email us (e.g., contact@daytwoai.com), we receive standard web-server/log information and any details you choose to provide. The Site may use basic, privacy-respecting analytics and essential cookies.
• License issuance: if you request a license key, we receive the information you provide for that request (such as your email and tier). License verification happens offline on your machine and requires no call to us.

3. How we use information

We use the limited information above to understand how many installations are running and which features earn their place (usage reports and install pings), operate the leaderboard, respond to your inquiries, issue and support licenses, and maintain and improve the Software and Site. We do not sell your personal information, and we do not use your prompts, responses, or source code for any purpose (we never receive them).

4. Sharing

We do not sell personal information. We may share limited information with service providers who help us operate the Site and communications (e.g., hosting, email), under confidentiality obligations, and as required by law or to protect our rights. Publicly submitted leaderboard entries are, by design, public.

5. Retention

We retain the limited information we receive only as long as needed for the purpose described (e.g., to maintain a leaderboard entry or answer your inquiry) or as required by law. Operational data created by the Software stays on your infrastructure and is controlled and deleted by you.

6. Your choices

• Leave the anonymous usage report off (the default; prefex toggle usage-reporting off or the dashboard's Settings · Privacy toggle) and the update check (prefex toggle update-check off), and install without PREFEX_USAGE_REPORTING=1 (so no install ping), to limit automatic outbound connections to your configured LLM provider. Leave telemetry off (the default) to skip the marketplace catalog download, and don't configure governance endpoints you don't want data sent to.
• A team subscription's monthly billing report is off by default (team.billing.enabled); when on, it sends aggregate dollar figures only, and the dashboard shows the exact payload before you enable it.
• Don't submit to the leaderboard if you'd rather not share a username/email.
• Contact us at contact@daytwoai.com to ask about, correct, or delete information you've provided to us. Depending on where you live, you may have additional rights under applicable law; we will honor them as required.

7. Children

The Software and Site are not directed to children under 13 (or the minimum age in your jurisdiction), and we do not knowingly collect their information.

8. International

We operate from the United States. If you contact us or submit information from outside the U.S., you understand it may be processed in the U.S.

9. Changes

We may update this Policy. Material changes will be reflected by updating the effective date above and, where appropriate, a notice on the Site.

10. Contact

DayTwoAI LLC d/b/a Promptforce.ai, contact@daytwoai.com, Texas, USA.