Privacy notice.

With the built-in runtime, model inference, preview and automated checks run on your computer. Prompt and prototype content is sent to the local runtime, not to a hosted language model, and there is no Prompt to Page account or API key. If you configure Ollama or LM Studio on another private-network computer, generation requests go to the address you configure on that local network.

Optional lifecycle analytics are off by default. If you turn on Share limited usage statistics in Settings → Privacy, the app sends only app_started and app_exited events, with no custom properties, to Aptabase's EU service operated by Technov Solutions SRL. The purpose is to understand aggregate use and improve Prompt to Page. Aptabase's Tauri library adds a timestamp, a random session identifier that expires after four hours of inactivity, app and SDK versions, debug/release state, operating-system name and version, locale, and webview engine name and version.

Aptabase receives the connecting IP address and user agent and uses them with a daily, per-app salt to derive a server-side daily rotating identifier. Aptabase says analytics data may be stored for up to five years. Because the resulting records are not linked to contact or account details, Aptabase says it cannot locate an individual's records to delete them. The events contain no prompts, generated pages, project content, model names, file paths, account details, or persistent device/install identifier, and they are not used for advertising or profiling.

You can opt in or turn analytics off at any time in Settings → Privacy. Turning it off stops future events and does not reduce app functionality.

The automatic update check is a separate connection and is on by default. Shortly after launch, the app requests the static release manifest at github.com/digitalcourtney87/prompt-to-page/releases/latest/download/latest.json. The request contains no prompt, prototype or project content; GitHub receives ordinary request data such as the connecting IP address and user agent. The check reads release metadata only. An update artifact is downloaded and installed only after you choose the controls in Settings. You can turn the automatic check off in Settings → Updates; the manual Check for updates control remains.

Model setup is another connection. Choosing a managed model downloads model files from the revision-pinned Hugging Face addresses listed in the app's model catalog; Hugging Face or its download infrastructure receives the request. You can instead select a compatible model already on the computer. Once a model is installed, local generation does not need an internet connection.

Reports are user-initiated only — the app never sends a report in the background. You can start one from the once-per-install feedback invitation or from an error-report control. Before anything is sent you see the serialized report, and it leaves your device only when you explicitly press Send.

A feedback report contains the app version; coarse platform, runtime, active design-system pack and backend details; your message; and, only if you include them, the diagnostics bundle and a reply email. Both production composers currently set the modelId field to "" and the ramGb field to null. An error report also contains one incident code and redacted summary, redacted technical details, and recent local setup diagnostics; your context note and reply email are optional. Builders redact likely local paths. The report schema has no field for prompts, generated HTML or project content, and no install or device identifier.

The app makes one HTTPS POST to reports.prompttopage.xyz/v1/reports, with an eight-second timeout and no automatic retry or queue. If it fails, the app offers local copy and email alternatives. The app repository does not establish a fixed retention period for accepted reports.

Sharing starts only when you explicitly select Start share server. By default, the app binds an ephemeral HTTP server to 127.0.0.1 (loopback) and serves an in-memory snapshot of the selected project's pages only on your computer. If you select Allow other devices on my network to open this prototype before starting, the app instead binds the server to all network interfaces, so devices that can reach your computer on the local network can open the snapshot. Every page URL contains a random token. Anyone who can reach the server and receives a tokenized URL can view the snapshot while the server is running; in LAN mode, the app also shows a QR code for the LAN URL. There is no hosted copy or internet-facing URL created by Prompt to Page. Sharing stops when you stop it or close the app.

Once a model is in place, local inference, preview and checks work without a connection, including behind a firewall. For an air-gapped setup, leave optional analytics off and turn off the automatic update check before disconnecting. Model downloads, manual update checks, update downloads, explicit report sending, externally hosted documentation links and LAN sharing use their disclosed connections only when invoked or enabled.

Keeping generation local removes a category of risk: there is no hosted model, no prompt log held by a third party and no service content in transit. That is a real reduction, and it is the reason the app is built this way.

It is not a substitute for your organisation's own assurance. Installing any desktop application still raises questions your IT, security and data-protection colleagues are entitled to ask — software and model provenance, update and signing behaviour, endpoint security, and what content people are allowed to put into a prototype in the first place. Where a prototype would involve personal data, your organisation still needs to decide whether a DPIA is required. Prompt to Page running locally changes the shape of those questions; it doesn't answer them for you.

If you're assessing the app for a public-sector organisation and need detail that isn't on this page — hostnames, dependencies, model provenance — email the address below and ask. Anything I can document, I will.

Prototypes are for testing ideas, so synthetic content is the right default. Made-up names, addresses and reference numbers test a journey exactly as well as real ones.

Please don't paste real case files, resident or patient records, unpublished identifiable research, or anything else you wouldn't want sitting in a prototype folder on a laptop. The app keeps that content on your device, but it applies none of the controls a live service would — no access control, no retention rules, and an export or a local-network share can move it somewhere you didn't intend.

For any privacy question, email courtney.rj.allen@gmail.com.

Prompt to Page is an independent project by Courtney Allen. It is not affiliated with, endorsed by, or connected to the Government Digital Service, the Crown, or any UK government body. “GOV.UK” and the GOV.UK Design System are referenced descriptively.