The short version: this is a plain website with no accounts. (An episode page and a Short’s page embed YouTube’s player, which is Google’s and is described below.) There are two visitor counters: Cloudflare’s, which stores nothing in your browser, and Google Analytics, which uses cookies; on the course pages Microsoft Clarity joins Google Analytics, under the same answer. All of them are described below. There are also three ad tags, Meta’s pixel, LinkedIn’s Insight Tag and TikTok’s pixel, which tell Meta, LinkedIn and TikTok you visited and what you did here, with a scrambled copy of the email you type into a form, so my ads can find you again (below). In the EU, Iceland, Liechtenstein, Norway, the UK and Switzerland, and wherever the server cannot tell which country you are in, Google Analytics and the ad tags stay off until you say yes. You can send me something in one place: the mailing list. A second box, Yip, sends a question to an AI to be answered, and I keep only counts of it. If you never use any of them, and never email me, I never learn anything about you personally.
What I collect
Nothing you type, except on the Just Prompt It Yourself sign-up and Yip. The search box runs entirely inside your browser. The index is a file your browser downloads, and your search words are never sent anywhere. Everything else on the site is a page to read. The sign-up and Yip are the exceptions, and each gets its own section below.
What this site stores in your browser: your answers about Google Analytics and the ad tags, once you give one, in a cookie and in local storage on your own device. The cookie applies to promptityourself.com and its subdomains, so one answer holds on all of them. Your browser sends it with each request to the site, but the site stores nothing from it. Clearing your browser data removes both copies. When you confirm the mailing list for the first time, the site sets a cookie, piy-new, that lasts ten minutes and says that you just signed up; the page reads it once and removes it, so a sign-up is counted once. With the ad tags allowed, it also sets piy-eid, which lasts ten minutes and carries one random number, so the ad platforms count your sign-up once and not twice. Google Analytics and the ad tags set their own cookies and local storage, described below. (Press play on a video and YouTube’s player stores its own things from that point on, which is Google’s; see further down.)
Guest agreements
There is no agreement to sign on this site. If you come on the show, I send you the agreement myself, by email, and it is kept like any email. An agreement signed on this site before is kept as a record: the PDF and the details printed on it (your name, address, email, the time you signed, the IP address it came from and a fingerprint of the wording), in my own files. It is no longer on this site’s servers. I keep it for as long as I need to be able to show what was agreed. Ask me and I will send you what I hold.
The mailing list
The Just Prompt It Yourself sign-up puts you on a mailing list, and the list is kept on purpose, so this section says exactly what is in it.
What it asks for: your email address, nothing else. You get Just Prompt It Yourself: news from the show and my courses, now and then, once a month at most. A few people joined an earlier list, PIY news, before this one; nothing is sent to it. This site has no accounts. The courses, and the account you register for them, are on learn.promptityourself.com, and its own privacy page describes them. If you register at learn.promptityourself.com and tick the newsletter there, or switch it on in your profile there, that site sends me your email address, your first name and your consent: the words beside the box, the time, your IP address and your browser. You then join Just Prompt It Yourself here exactly as if you had used the form on this site. Switch it off there and you leave it here; delete your account there and you leave every list here: your address and your lists go, and the consent record stays as it is, with one line added that you left.
Nothing happens until you confirm. Sending the form gets you one email, from hello@promptityourself.com, with a link in it. You are not on any list until you open that link and press the button. If you never do, you get no other email. If you are on the list already, the email says “You are on Just Prompt It Yourself” instead, with no link, because there is nothing to do. Send the form again within ten minutes and no second email goes out.
What gets recorded: your address, a first name if you gave one on the earlier form, and which lists you are on. For each list, a consent record is also kept: the exact words you agreed to, whether it was a request, a confirmation or you leaving, when, the page or link it came from, and the IP address and browser it came from. That record is how I can show you asked to be on the list. It is only ever added to, never edited. When you sign up for the first time, the site also records which ad or post brought you there: the labels in the address you arrived on (utm_source, utm_medium, utm_campaign and utm_content), and the click number an ad platform adds to it (fbclid from Meta, gclid from Google, ttclid from TikTok), if there was one, plus the page the form was on and when you confirmed. I use it to count which ads and posts bring sign-ups. Nobody else sees it, and the count I share with the team that runs the ads has no addresses or click numbers in it. To carry these labels from the page you arrive on to the page with the form, your browser keeps them for that tab only, and only when Google Analytics is allowed.
Where it lives: in a database on Cloudflare, on this site’s own account. The confirmation and “You are on” emails go out through Cloudflare’s email service, and the list’s emails through Amazon SES, from hello@promptityourself.com. A log is kept of which edition went to which address, so nobody gets the same one twice. I use the list only to send you what you asked for, and I never sell it or share it for anyone else’s marketing. What goes to the ad platforms, and only while the ad tags are allowed, is a scrambled copy of your address and that you joined (below).
How long I keep it: nothing on the list is deleted automatically. Your address and name, and the record of what brought you, stay while you are on a list and after you leave, marked as having left, so you are never added back by mistake. The consent record is kept for as long as the list exists, because it is the proof of what each person agreed to. Ask me and I will delete your address, your name and that record.
Leaving: every email sent to the list carries an unsubscribe link. One press, no login, and you are off every list straight away. Or email contact@promptityourself.com and I will take you off by hand.
Links in my posts
Links in my posts go through piy.show. It records which link was opened, when, and which website sent you. It records no IP address, no device details and no cookie. It adds a label to the address, such as utm_source=tiktok, that names the platform and the post, never a person. Google Analytics reads the label. I use it only to count which posts bring people here, never to build a profile of you.
On this site the label follows the same rule as Google Analytics: where the site asks first, nothing happens to it until you say yes. Then it is taken out of the address bar, so a link you copy does not carry it.
The spam check
A public form with no guard on it fills up with junk within a day, so the sign-up and Yip carry Cloudflare Turnstile. It’s a “prove you’re a person” check that usually asks you to do nothing at all. It loads the first time you touch a field on one of those forms. Read the page and never type in it, and nothing about it ever runs. It isn’t set up to leave a pass cookie on your browser, it isn’t advertising, and it isn’t used to follow you anywhere; what it does is Cloudflare’s, under their privacy policy.
Yip
Yip, the site’s AI, is in the menu of every page. You can ask it about the page you are on, or about anything on the site. It is an AI, not me, and it can get things wrong.
What it sends: your question, the few questions and answers before it in the same chat, and the address of the page you ask on go to Anthropic, the company that makes Claude, which writes the answer. Anthropic is in the United States, and what it does with them is under their privacy policy.
What I keep: counts, never words. For each page and day, how many questions were asked, how many were declined, and what they cost. Not the question, not the answer, not your IP address. Google Analytics, when it is on, counts that a question was sent and whether it was one of the ready ones, and that a link in an answer was opened, never what it said.
In your browser: the chat stays in that tab’s session storage, so you can open a page it suggests and come back to it. “New chat” empties it, and closing the tab deletes it. Please do not type anything personal into it.
What the host sees
The site is served by Cloudflare. Like every web host, it processes the technical details of a request (IP address, browser type, which page, when) to deliver the page and to protect against attacks and abuse. That processing is Cloudflare’s, under their privacy policy. I don’t get a copy of it and it isn’t used to build a profile of you. To know whether to ask you about Google Analytics and the ad tags, the site’s own server looks at which country Cloudflare says your request came from, answers ask or do not ask, and keeps nothing. It also compares your IP address with my own network’s, so that my own visits are not counted, and keeps nothing of that either.
Analytics
There is a counter, and it is Cloudflare’s. Every page loads a small script from Cloudflare that records the visit: which page, roughly where in the world, what kind of browser. It’s how I know whether anybody is reading this.
It puts nothing in your browser: no cookie, no local storage, nothing to delete. I’ve checked that rather than taken their word for it. It doesn’t have a profile of you, it can’t follow you to another site, and I can’t see individual visits, only totals. What Cloudflare does with the request at their end is theirs, under their privacy policy. It is switched on by Cloudflare for the whole domain, not in the site’s own code, which is why this page missed it at first and said there was no analytics at all. That was wrong. It’s described here now because it’s here.
The second counter is Google Analytics. It tells me which pages people read, where they came from and what they click, which the Cloudflare counter cannot. It sets two cookies on this site, _ga and _ga_9D7CHFQ1CB, to tell a returning visitor from a new one, and Google receives your IP address, browser and the pages you visit. I see totals and trends, not names. If you also said yes to ads (below), Google may use the visit for my Google ads too: to show them to people who visited, and to count which ads bring sign-ups; arrive from a Google ad and it also sets _gcl_aw. When you join the mailing list, your email address goes to Google as well, scrambled (hashed) in your browser before it leaves, so Google can match the sign-up to an ad. Without that yes, the advertising side stays off. What Google does with it is under their privacy policy.
On the course pages at learn.promptityourself.com, the landing pages and the registration form, the same yes also turns on Microsoft Clarity. It records how a page is used, the clicks, taps and scrolling, so I can see where people get stuck. It never records what you type: the form fields are hidden from it before anything leaves your browser. It sets two cookies, _clck and _clsk, and Microsoft receives your IP address and browser. What Microsoft does with it is under their privacy statement.
That site also counts a few steps on its course pages: a landing page opened, a question passed, the form started. They are counted per day, per landing page and per ad label, with no cookie, no IP address kept and nothing that tells one visitor from another.
If you are in the EU, Iceland, Liechtenstein, Norway, the UK or Switzerland, or the server cannot tell which country you are in, it stays off until you answer yes on the small question at the bottom of the page: nothing is sent to Google before that, and a no is kept so you are not asked again. Everywhere else it is on. Wherever you are, you can change your answer here at any time, and turning it off also deletes the cookies of Google Analytics and Clarity from this browser, on this page and on every page after it while the answer is no:
On this browser, Google Analytics and Microsoft Clarity are .
Any ad blocker or Google’s opt-out add-on blocks it too. Clearing your browser data asks the question again.
Google never gets the private part of a link. The confirm and leave links in a mailing list email carry a code that belongs to you, and the address sent to Google has it removed.
The ad tags
The site also loads small scripts from three ad platforms: Meta (Facebook and Instagram), LinkedIn and TikTok. They do one job: they let me show my ads to people who visited this site, and count which ads bring people who apply to the show or join the mailing list. All three go on and off together, with the ads answer below.
What they send:
- The visit: the address of the page, your IP address and your browser.
- What you do here: that you opened an episode or a Short, pressed Apply, joined the mailing list or confirmed it. Meta and TikTok also record button presses on their own.
- Your contact details, scrambled: Meta and TikTok can read the details you type into a form on this site (your email) and send them hashed, scrambled in your browser so the original cannot be read back, to match the visit to your account with them.
- From my server, later: the first time you confirm the mailing list, my server tells Meta and TikTok so too, with the same hashed address, your IP address, your browser and the cookie each one’s tag set in your browser, if there is one, so an ad can be counted even when a blocker stops the scripts. It does this only if your ads answer is yes, or you have not answered and the site would not ask you.
The ad tags never load on the pages behind a mailing list link, because those addresses carry your code. Each platform sets its own cookies on its own domains as well as the ones named below on this site, and keeps a few things in this browser’s local and session storage. If you use that platform, it can connect the visit to your account; I see only totals, never who you are.
The Meta pixel
Meta’s pixel is the small script from the company behind Facebook and Instagram. It sets _fbp on this site so Meta can recognise this browser again, and _fbc when you arrive from a Meta ad. What Meta does with it is under their privacy policy.
It follows the same rules as Google Analytics, with its own answer. Where the site asks first, it stays off until you press Yes on the question at the bottom of the page; Count only keeps Google Analytics and leaves all four ad tags off. Everywhere else it is on. Wherever you are, you can change your answer here at any time, for all four ad tags at once, and turning it off also deletes their cookies on this site from this browser, on this page and on every page after it while the answer is no:
On this browser, the ad tags (Meta, LinkedIn, TikTok) are .
Cookies on Meta’s, LinkedIn’s and TikTok’s own domains are theirs to delete, not mine. An ad blocker blocks the tags too. In your Facebook or Instagram settings, under ad preferences, you can also stop Meta using activity from other sites for your ads.
The LinkedIn Insight Tag
LinkedIn’s Insight Tag does the same job, for LinkedIn, and it sends the visit only: LinkedIn counts a sign-up by the address of the page it lands on. It sets li_fat_id on this site when you arrive from a LinkedIn ad, and its other cookies on linkedin.com. What LinkedIn does with it is under their privacy policy. In your LinkedIn settings, under advertising data, you can also stop LinkedIn using visits to other sites for your ads.
The TikTok pixel
TikTok’s pixel does the same job, for TikTok, and sends what the list above says. It sets _ttp, _tt_enable_cookie and a few starting ttcsid on this site to recognise this browser, and ttclid when you arrive from a TikTok ad. What TikTok does with it is under their privacy policy. In the TikTok app, under Settings and privacy, then Ads, you can also stop TikTok using activity from other sites for your ads.
Other people’s sites
Links out to YouTube and Twitch are ordinary links. They learn nothing about you until you click one, and once you’re there, you’re on their terms and their privacy policy.
An episode page shows a picture of the episode, and a Short’s page a picture of the Short. Nothing is requested from YouTube until you press play. The picture is served from here. There is no player on the page, no YouTube script and no cookie of theirs, so opening one of those pages and reading it tells YouTube nothing at all. (Google Analytics, above, is a separate thing.) Press play and the real player is put on the page at that moment, which is the point where you have chosen to watch something.
The home page shows when a show is on air, and your browser does not ask YouTube that either. This site’s own server asks, once a minute for everybody, and the page asks the server. So the strip at the top can say the show is live without a single visitor being introduced to Google to find that out. It says nothing at all if the answer is no, or if the check fails.
Once you press play it is on youtube-nocookie.com, their version that does not set advertising or tracking cookies. Be clear about what that does and does not mean: from the click on, Google knows you are watching, the same as if you had opened the video on their site. Every video is also on the channel anyway, where you are on their terms regardless.
Who else gets what you type: Cloudflare, whose spam check runs on the forms and Yip, who stores the mailing list and the agreements signed here before, and sends the list’s confirmation emails, and who serves this whole site anyway; Amazon Web Services, whose email service carries the list’s emails; Anthropic, which writes Yip’s answers; Google Workspace, which holds my inbox; and, while the ad tags are on, Google, Meta and TikTok, scrambled, as above. Nobody else gets any of it.
Your rights
Australian privacy law gives you the right to ask what personal information is held about you, to ask for it to be corrected, and to ask for it to be deleted. In practice the only things likely to be held are an email you sent me, your place on the mailing list if you joined it, and, if you have been on the show, the agreement you signed. Write to contact@promptityourself.com and I’ll deal with it. If you also have a course account on learn.promptityourself.com, say so in the same email and I delete both. An email is one message and takes a minute. A signed agreement is not: it is a record I keep on purpose, as described above, and deleting it is something to talk through rather than something I can do without a word.
If you’re unhappy with how that’s handled, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.
Who I am
I’m one bloke, writing as Prompt It Yourself, in Brisbane, Australia. The site is operated by Mergodon Pty Ltd, and that company is the one legally responsible for the handful of personal information described above, and I’m the only person who reads the email. Questions about this page go to contact@promptityourself.com.
Changes
If this page changes, the date at the top changes with it. There’s no version history, so if something here matters to you, the honest advice is to check back rather than assume.
Yip