The cookies, storage and third-party scripts we use, and how to change your choices.
Last updated: 7 November 2026
Cookies are small files a website saves in your browser. "Similar technologies" means browser storage (localStorage, sessionStorage and IndexedDB) and scripts from other companies that read or store information on your device. UK law (PECR) and EU law require your consent for any of these unless they are strictly necessary for a service you asked for. This page uses "cookies" for all of them.
tpi_consent cookie for 12 months. After that, or if we change the categories, we ask again.Advertising, everywhere: Google AdSense loads only after you allow Advertising, and we always ask Google for non-personalised ads. Google may still use cookies for frequency capping, ad measurement and fraud prevention. If you are in the UK, the EEA or Switzerland, Google's own certified consent message may then also ask about your advertising choices; you can change those later with the "Privacy and cookie settings" link Google shows on pages with ads, and you can turn off advertising entirely with Cookie preferences in our footer.
We do not monitor the behaviour of visitors in the EEA or Switzerland. For them, whatever they choose: Google Analytics never loads (the Analytics switch stays off and we record no Analytics "yes"); Google Ads conversion measurement never runs and its _gcl_ cookies are deleted; and if they allow Advertising, Google AdSense shows non-personalised ads only. To know where you are, our server looks up the country of your IP address in an offline database (MaxMind GeoIP2, kept on our host) when a page first needs it. We do not store your IP address or country; your browser keeps only the answer in tpi_rg (below) until you close the tab. If the check fails or we cannot tell where you are, we treat you as being in the EEA or Switzerland. A choice you made elsewhere is kept as you made it, but it has no effect while you are in the EEA or Switzerland.
| Name | Set by | Purpose | Lasts |
|---|---|---|---|
| PHP session cookie (PHPSESSID or similar) | Us | Keeps you signed in, protects forms against cross-site request forgery, and holds guest trial and short-lived tool state. AI Labs uses the same session to hold your OpenRouter key on our server until you sign out. If you are not signed in, the session also holds a random code that our own usage log uses to count tool use (see section 4). | Until you close the browser (signed-in sessions end after 2 hours idle, 24 hours at most) |
| tpi_remember | Us | "Remember me", only if you tick it at login | 30 days |
| __Host-tpi_ld_… | Us | Recognises a device that has signed in correctly, so login protection doesn't block you | 180 days |
| tpi_consent | Us | Stores your cookie choices (Analytics, Advertising, Embedded services), the banner version, the time and a random consent ID | 12 months |
| analytics_consent, cookie_consent_set | Us | Older copies of your Analytics choice that some of our pages still read; kept in step with tpi_consent (set to "denied" in the EEA and Switzerland) and deleted while you have not chosen | Up to 12 months |
| tpi_rg (sessionStorage, not a cookie) | Us | Remembers for this tab whether you are in the EEA or Switzerland ("r") or elsewhere ("o"), so we do not use Google Analytics or ad measurement where we have chosen not to (section 2a). Holds no IP address or country | Until you close the tab |
| ocr_trial | Us (OCR tool, guests) | Signed ticket for the guest free trial, to stop abuse | 24 hours |
| ocr_return | Us (OCR tool, guests) | Lets you return to your result after you sign up | 14 days |
| wa_gt | Us (Writing Assistant, guests) | Counts guest trial actions | 30 days |
| pg_gid, pg_gc | Us (Prompt Generator/Optimizer, guests) | Guest trial ID; remembers that you accepted the tool's AI notice | 30 days / 1 year |
| pg_gw | Us (Prompt Generator/Optimizer, guests) | Remembers that you withdrew from the tool's AI notice, so the tool does not run for you | 30 days |
| ps_fa_<link number> | Us (PromptShare shared links) | Records when you first opened a time-limited share link, so a share link whose access is limited in time after first opening can apply that limit | 1 year |
| sl_last_tool | Us (SoundLabs only) | Opens SoundLabs on the tool you used last | 180 days |
| sg_hp | Us (Skill Generator only) | Tells our server that your browser already holds Skill Generator projects, so it shows your projects instead of the welcome page. The projects themselves stay in your browser. | 1 year (deleted when you have no projects) |
| Google Sign-In (for example g_state) | Google (login and sign-up pages, and the sign-up prompts in PromptBook, Image Tools and SoundLabs; only after you press our Google button) | Lets you sign in with Google, if you choose to. Google's sign-in script loads only when you press "Sign in with Google" or "Sign up with Google"; until then nothing is loaded from Google. You then press Google's own button to continue. We do not use Google's "One Tap" prompt. | Set by Google |
| ps_visitor_token (on limited share links) | Us (PromptShare shared links) | Only on a shared link that limits how many people can open it or how long each person can see it: remembers your browser so that limit works for you (for example, so a return visit does not use up another opening). On other share links this cookie is an Analytics cookie (section 5). | As long as the limit needs: the per-person viewing window plus 1 day, or until the link ends plus 1 day; never more than 1 year (1 year for a link that limits opens but has no end date) |
| sc_own_<report code> | Us (Search & Cite, guests) | Set only when you share a Search & Cite report without being signed in. It holds a random key that lets you, on this browser, unpublish or delete the report later (we store only a one-way code of it). If you clear it, you lose that control and need to contact us. Your browser keeps at most 15 of these; the oldest is dropped first. | 1 year |
The cookies above that remember a setting in a tool (for example ocr_return, sl_last_tool and sg_hp) are first-party, are not shared with anyone and are not used for advertising. We treat them as strictly necessary because they only do something you asked a tool to do.
We keep our own log of which tools are used, so we can fix problems and decide what to improve. For signed-in users it is linked to the account; for guests it uses a random code held in the PHP session cookie above, which is new each browser session. The log records the tool, what happened (for example "run" or "error"), the plan, the browser type and the site you came from. It is not used for advertising and is not shared. UK law allows this kind of first-party statistics without consent only if we tell you and make it easy to object. To object: if you are signed in, switch it off in your Workspace (Account → Security and access → Usage statistics), which also deletes the records already linked to your account. If you are not signed in, choose Reject all (or turn Analytics off) in Cookie preferences, or use a browser that sends Global Privacy Control, and we record nothing about your tool use. You can also use the contact form ("Your data") or email us. Closing your browser ends a guest code. How long we keep the log is in the Privacy Policy.
| Name | Set by | Purpose | Lasts |
|---|---|---|---|
| _ga, _ga_<ID> | Google Analytics 4 (G-7N9TV5XPHH) | Counts visits and pages and shows how people find and use the site (for example sign-ups and tool runs). Google Analytics does not log or store IP addresses. | Up to 2 years |
| tpi_ga_ack | Us | Stops the same analytics event being sent twice | 48 hours |
| ps_visitor_token (on other share links) | Us (PromptShare shared links) | On a shared link that does not limit opens or viewing time, it gives your browser a random ID so the person who shared it sees a count of different viewers. On these links it is set only if you allow Analytics. It is not linked to your account, not shared and not used for advertising. (On limited links the same cookie is strictly necessary: see section 3.) | 1 year |
We do not send your name or email to Google Analytics, and we have turned off its advertising-personalisation signal.
| Name | Set by | Purpose | Lasts |
|---|---|---|---|
| _gcl_au and other _gcl_ cookies | Google Ads (conversion tracking) | Tells us whether a Google ad led to a sign-up or purchase. Not used to personalise ads. | Up to 90 days |
| __gads, __gpi, __eoi | Google AdSense (on free and guest pages and blog articles) | Shows non-personalised ads, limits how often you see the same ad, measures ads and detects ad fraud | Up to 13 months (__eoi: 6 months) |
| IDE, DSID and other doubleclick.net cookies | Google (on its own domain) | Ad delivery, frequency capping, measurement and fraud prevention | Up to 13 months |
Google is an independent controller for the data AdSense collects: how Google uses information from sites that use its services. On our main database and prompt pages, signed-in Basic and Pro members do not see AdSense ads.
| Service | Where | What it receives | When it loads |
|---|---|---|---|
| Google Programmable Search | Prompt Search | Your search terms, IP address and browser; Google may set cookies and show ads in the results | Only after you allow Embedded services, or when you choose "Allow this time" as you search |
| EmailOctopus sign-up form | Newsletter forms in some pages | IP address and browser; your email if you subscribe. We have not yet confirmed whether the form sets cookies of its own (on EmailOctopus's domains), so we treat it as if it may, and it loads only with your consent. | Only after you allow Embedded services, or when you click to load the form. Our own pages' footers link to the newsletter page instead. |
| Service | Where | What it receives | When it loads |
|---|---|---|---|
| Google Fonts; jsDelivr, cdnjs (Cloudflare) and jQuery CDN | Most pages; the AI Detector downloads its model library from jsDelivr | IP address, browser and the page that asked. They set no cookies for us. | On page load, because the page needs them to display and work |
| goQR.me (api.qrserver.com) | AI Courses certificates | The certificate link and the viewer's IP address and browser, to draw the QR code. No cookies for us. | When a certificate is opened |
| Stripe | Stripe's own checkout and billing pages (stripe.com) | Stripe sets its own fraud-prevention cookies on its pages | Only when you go to checkout or the billing portal |
| Telegram, X, LinkedIn | Links in footers | Nothing until you click a link and leave our site | Never on our pages |
Some features save information in your browser's localStorage or sessionStorage instead of on our servers. It stays on your device, is not used for tracking, and needs no consent because it is part of a feature you are using. Clear it any time in your browser settings.
For security and fair-use limits, our servers create one-way codes (hashes) from your IP address, for example to cap guest free trials and stop sign-up spam. These are not stored on your device. The Privacy Policy explains them and how long we keep them.
We update this page when we add or remove cookies. If we add a new category, we will ask for your consent again.
Steve Smith, trading as The Prompt Index
Suite RA01, 195-197 Wood Street, London, E17 3NU, United Kingdom
Email: steve@thepromptindex.com
Last updated: 7 November 2026