Effective for all PromptLeaf users
Your data, in plain English
PromptLeaf tracks the estimated carbon and water footprint of your AI prompts. This page explains exactly what that requires us to know about you — and, just as importantly, what it doesn't.
Last updated: 10 August 2026
The short version: PromptLeaf counts the words you type into ChatGPT or Claude — never the words themselves. Your prompts and the AI's replies never leave your browser and are never seen, sent, or stored by us.
01 Overview
PromptLeaf is a browser extension and dashboard that estimates the CO₂ and water footprint of your AI usage, styled around a plant that thrives or struggles with your weekly total. This policy covers the PromptLeaf Chrome extension and the dashboard at promptleaf.co.uk, together referred to as "PromptLeaf," "we," or "us."
We built PromptLeaf around a simple rule: estimate your footprint without reading your conversations. Everything below follows from that.
02 What we collect
We collect only what's needed to show you your footprint and keep your account working.
| Data | Where it comes from | Why we need it |
|---|---|---|
| Email address | You, when you create a dashboard account | Sign-in, and to link your extension to your stats |
| Word count per prompt | Counted locally by the extension as you type | The only input to your CO₂/water estimate |
| Estimated CO₂ & water figures | Calculated from your word count on your device | What your dashboard and tree visualization show |
| Daily prompt count | Tallied when you log a prompt | Powers your weekly/30-day charts |
| Sync token | Generated by us, stored in your browser | Lets your extension prove it's really you when syncing — instead of anything more identifying |
That's the complete list. We don't collect browsing history, the sites you visit beyond ChatGPT/Claude/ the PromptLeaf dashboard, your location, or device fingerprinting data.
03 What we never collect
This is the part we'd want to know if we were you:
- We never read your prompts. The extension counts words locally in your browser using simple text-splitting — it never copies, transmits, or stores the text itself.
- We never see the AI's responses. Only your own typing is measured; replies from ChatGPT or Claude are never touched.
- We don't track you elsewhere on the web. The extension only activates on
chatgpt.com,chat.openai.com, andclaude.ai. - We don't sell data, run ads, or use third-party trackers or analytics pixels. There is nothing in PromptLeaf to sell — no advertiser has ever received data from this product.
04 How we use it
We use your data for exactly three things:
- Turning your word counts into the CO₂/water estimates shown on your dashboard and in the extension popup.
- Authenticating you, so only you can see your own stats.
- Occasionally emailing you about your account (e.g. sign-in confirmations) — never marketing, unless you separately ask us to.
We do not use your data to train any AI model, ours or anyone else's.
05 Extension permissions, explained
Chrome requires extensions to declare upfront what they can access. Here's what each PromptLeaf permission is actually for:
storageKeeps your sync token and a short-lived word count cache in your browser, locally.scriptingLets the word-counter attach to ChatGPT/Claude tabs that were already open when you installed or updated the extension.chat.openai.com, chatgpt.com, claude.aiWhere the word-counting itself happens — nowhere else.promptleaf.co.ukWhere your word counts are synced to your dashboard.
06 Sharing & service providers
We don't sell or rent your data. We do use a small number of infrastructure providers to run PromptLeaf, each bound to only use your data to provide their service to us:
- Supabase — hosts our database and handles account sign-in.
- Vercel — hosts the dashboard website.
We may disclose data if required by law, or to protect the rights, safety, or property of PromptLeaf or our users — this has never happened and we hope it never does.
07 Security
All traffic between the extension, dashboard, and our servers is encrypted over HTTPS. Your extension authenticates using a private sync token unique to your account — generated randomly, never guessable, and something you can view and copy from your dashboard at any time.
Your account data is protected by row-level database security, meaning even we can only access it through code paths that check it's really yours.
08 Retention & deletion
We keep your usage logs for as long as your account is active, so your dashboard can show a running history. If you'd like your account and all associated data deleted, contact us (details below) and we'll remove it within 30 days.
09 Your rights
If you're in the UK or EU, data protection law (UK GDPR / GDPR) gives you the following rights over your data. Contact us and we'll action any of these within one month.
If you're not satisfied with our response, UK users can complain to the Information Commissioner's Office (ICO); EU users can contact their local supervisory authority.
10 Children's privacy
PromptLeaf isn't directed at children, and we don't knowingly collect data from anyone under 16. If you believe a child has created an account, contact us and we'll delete it.
11 Changes to this policy
If we make a material change to this policy, we'll update the date at the top of this page and, where reasonably possible, let existing account holders know by email.
12 Contact us
Questions, requests, or just want to know more about how PromptLeaf works? We're happy to talk.