Privacy policy

Last updated: 9 November 2026

This policy explains what personal data 2earl processes, why, and what rights you have. It covers 2earl.com, the 2earl account at login.2earl.com, the MCP gateway at mcp.2earl.com, Prompt share at promptshare.cc, and any other 2earl service that links to this page.

1. Who is responsible

The controller under the EU General Data Protection Regulation (GDPR) is:

There is no data protection officer; please contact the address above.

2. Visiting our websites

When you open one of our websites, your browser sends technical data with every request: IP address, time, requested address, browser type and similar information. Our hosting provider Cloudflare processes this data to deliver the pages and to protect them against attacks and abuse.

• Legal basis: Art. 6(1)(f) GDPR. We have a legitimate interest in a working and secure service.
• 2earl.com sets no cookies, uses no analytics, no tracking and no third-party scripts.

3. The 2earl account (login.2earl.com)

Sign-in with Google

You sign in with your Google account. When you do, Google tells us your Google account ID, your email address, whether Google has verified it, and your name. We do not receive or store your Google password, your profile picture or access to any Google data.

What we store

• Your account: Google account ID, email address, name, creation and last sign-in time.
• Sign-in sessions: a random session identifier (stored only in hashed form), when the session was created and last used, a shortened IP address and a hash of your browser’s user agent.
• Apps you connect: which apps you have allowed to act for you, with which permissions and since when. Access tokens are stored only in hashed form.
• If you set up a second factor: the public key of your passkey or security key, or an encrypted authenticator-app secret, and hashed recovery codes.

Legal basis: Art. 6(1)(b) GDPR. This data is needed to provide the account you sign up for.

Cookies on login.2earl.com

login.2earl.com uses only cookies that are strictly necessary for the service you request: keeping you signed in, securing the sign-in process, and remembering which apps you have approved. These do not require consent (§ 25(2) No. 2 TDDDG). There are no advertising or analytics cookies.

Security log

We record security-relevant events, such as sign-ins, approvals, revocations and account deletion, with the time, a shortened IP address and the app involved. We never record passwords, tokens or codes.

Legal basis: Art. 6(1)(f) GDPR. We have a legitimate interest in detecting and investigating misuse of accounts.

Invitations

While sign-up is closed, only invited Google accounts can sign in. For each invitation we keep the invited email address; at the first sign-in it is replaced by the Google account ID. Invitations are removed when they are withdrawn or when you delete your account.

Legal basis: Art. 6(1)(f) GDPR. We have a legitimate interest in limiting access to the service while it is not yet open to everyone.

4. The MCP gateway (mcp.2earl.com)

The gateway lets AI assistants (such as Claude) use 2earl services for you, after you sign in with your 2earl account and approve them. It checks each request’s access token and passes the request to the service, telling it only your internal user ID, the app and the permissions you approved. It never passes on your token, email address or name.

• What it stores: a security log of tool use: time, your internal user ID, the app, the service, the tool’s name and whether it succeeded. It stores no tool arguments or results: what you ask and what comes back pass through without being saved.
• Legal basis: Art. 6(1)(b) GDPR for providing the service you connect; Art. 6(1)(f) for the security log (detecting misuse).

5. Prompt share (promptshare.cc)

Prompt share keeps your prompts and shared sessions, so you can use them from any assistant or with people you invite. You use it on the website or through the MCP gateway.

What we store

• Your prompts: title, description, text, tags, the assistants they are for, whether they are private or public, and when they were created and changed. When you change a prompt, what it replaced is kept as an earlier version (the newest 10 per prompt), so you can go back. Only you can see earlier versions.
• Your handle, if you choose one: the name other 2earl users see on your public prompts and in shared sessions.
• Shared sessions: their title, members and roles, the entries you or your assistant save (with their kind, the entry they reply to, for tasks whether they are done and the member they are assigned to, who wrote them, which assistant was used, and when), the session’s brief with its last 20 versions, and when each member last opened the newest entries, to show what’s new for them. Entry and brief text is stored encrypted. Nothing is saved unless you or your assistant save it; Prompt share does not record your conversations on its own.
• Invitation links to your sessions, stored only in hashed form, and who used them.
• Website sessions: a random identifier stored only in hashed form, when you signed in, and when your second factor was last verified (for the operator’s moderation view).
• A security log of actions (for example “prompt created”), never their text.

Legal basis: Art. 6(1)(b) GDPR. This data is the service you use.

Who can see what

• Private prompts: only you, and the people you share them with.
• Prompts shared with you: you, the author, and the others they shared them with. You see the author’s handle, never their email address.
• Public prompts: every signed-in 2earl user, with your handle. Copies they make are theirs and stay when you make yours private or delete it.
• Shared sessions: their members. People you invite can read every entry, and their assistants can load them.

Sharing a prompt with someone

You can share a private prompt with someone by typing their email address. Prompt share asks login.2earl.com which 2earl account uses that address; login answers with that account’s internal ID only. We store the address you typed, shown only to you, and the account it belongs to. If no account uses the address, we tell you so, which means sharing shows whether an address has a 2earl account. To limit this, after several addresses without an account sharing is paused for a while; we keep a note of those tries for a day. Prompt share does not email the person; they find the prompt under “Shared with you”.

Legal basis: Art. 6(1)(b) GDPR for sharing, which you ask for; Art. 6(1)(f) for looking up the address and for the pause (our legitimate interest in letting people share with each other while preventing people from checking many addresses).

Please don’t put health information, other people’s personal data or passwords and keys into prompts or sessions others can see. Prompt share refuses entries that look like keys or passwords in sessions with other members.

Health and other sensitive information

Your own prompts and sessions may contain health information or other special categories of personal data (Art. 9 GDPR), if you choose to save them. After your first sign-in on promptshare.cc we ask once whether you explicitly consent to us storing such information. Saying no changes nothing about the service, but then please don’t save it. We record your answer, the version of the wording, and when you gave it. You can withdraw your consent at any time on your Prompt share account page; withdrawal does not affect what was stored before, so delete content you no longer want us to keep.

Legal basis: Art. 9(2)(a) GDPR (explicit consent) for such information; Art. 6(1)(c) together with Art. 7(1) for keeping a record of your answer, so we can show that you consented.

Contact messages, reports and moderation

When you use the contact form or report content, we store what you write, the link you report, and the name and email address you give. We forward a copy to the operator’s mailbox, and remind the operator if a message is still unanswered after 30 minutes. If you report content and give an email address, we use it to tell you our decision, and may also confirm that we received your report. These emails come from the operator’s mailbox, or from noreply@promptshare.cc (sent through Cloudflare) with replies going to legal@2earl.com. If content is reported, the operator reads it, including entries of a private shared session that a member reported. Decisions about your content are recorded with their reasons and shown to you in your Prompt share account.

Legal basis: Art. 6(1)(c) GDPR together with the EU Digital Services Act (we must take and handle reports of illegal content and explain our decisions); Art. 6(1)(f) for enforcing our terms of service and answering messages.

Cookies on promptshare.cc

promptshare.cc uses only strictly necessary cookies: keeping you signed in and securing the sign-in. These do not require consent (§ 25(2) No. 2 TDDDG). There are no scripts, analytics or tracking.

6. Apps and assistants you connect

When you approve an app, it receives an access token for the permissions you approved and an internal user ID. It does not receive your email address or name from us. The one exception within 2earl: Prompt share can ask which account uses an address someone typed to share a prompt with you, and gets only the account’s ID. You can disconnect an app at any time in your account.

When an AI assistant uses Prompt share for you, the prompts and session entries it reads are sent to that assistant, and so to its provider (for example Anthropic for Claude). The provider is responsible for that processing under its own privacy policy.

7. Service providers and transfers

• Cloudflare, Inc. (USA) hosts our services as a processor under a data processing agreement. Account data is stored in Cloudflare’s EU jurisdiction. Requests are handled at the Cloudflare location closest to you, which may be outside the EU. Transfers to the USA are covered by the EU–US Data Privacy Framework and the EU Standard Contractual Clauses.
• Google provides the sign-in. Google processes your Google account data under its own privacy policy as an independent controller. Google also hosts the operator’s mailbox, where contact messages and reports are forwarded.

We do not sell personal data and do not share it for advertising.

8. How long we keep data

9. Your rights

You have the right to:

• access the data we hold about you (Art. 15 GDPR);
• have incorrect data corrected (Art. 16);
• have your data deleted (Art. 17);
• restrict processing (Art. 18);
• receive your data in a machine-readable format (Art. 20);
• withdraw a consent you gave, at any time, for the future (Art. 7(3));
• object to processing based on legitimate interests, on grounds relating to your particular situation (Art. 21).

In your account at login.2earl.com you can see your data, download it (including what the MCP gateway and Prompt share hold about you), disconnect apps and delete the account yourself. For anything else, write to the address in section 1.

You also have the right to lodge a complaint with a supervisory authority. The authority responsible for us is the Berlin Commissioner for Data Protection and Freedom of Information.

10. Other information

• We do not use automated decision-making or profiling. Moderation decisions are made by a person.
• Providing data is voluntary, but without signing in you cannot use the 2earl account.
• We will update this policy when our services change. The date at the top shows the current version.