Ask for every field it saves about a person, where it goes, and how long it stays. Builders add fields generously and silently, so most generated apps store more than their owner knows — which becomes your problem the moment a real user asks.
The prompt
List every piece of information this app stores about a person: the field, where it is stored, how it got there, and whether anything deletes it. Include anything logged or sent to a third party.
| When to use it | Before launch, and again whenever you add a form, an integration or analytics. |
|---|---|
| Why it is worded that way | You are responsible for data you did not know you were keeping. Builders attach analytics, log request bodies and add fields to user records as a side effect of other features. The phrase 'whether anything deletes it' is the one that finds the real surprises, because the answer is almost always no. |
Logs are the forgotten copy
An app can be careful with its database and still write email addresses into logs on every request. Logs are usually retained by the host, searchable, and invisible in any diagram of your data.
Third parties count
Anything you send to an analytics or support service is data you are responsible for. Ask specifically what leaves the app, because that is rarely visible in the code you read.
Why this is not only a legal question
Storing less is also less to lose. The fastest way to reduce what a breach costs you is to have collected less of it in the first place, and that decision is cheap before launch and expensive afterwards.
The Build Prompt Pack
This is one of 57 prompts, from the phase "Data, and what it is really storing". The pack has the rest, each with the same reasoning underneath, plus the research they are built on and a house-rules file you paste in once.
Tools this applies to
| Tool | What it does | Price |
|---|---|---|
| Supabase | Database, accounts and file storage in one, with no backend work. | Free tier |
| Vercel | Hosting. Puts a project live on a real address with one command. | Free tier |
| Plausible | Simple, privacy-friendly visitor stats with no cookie banner. | ~€9/mo |
| Umami | Same idea, free if you host it yourself. | Free self-hosted |
Every tool has its own page with what it costs and who should skip it. Some links are affiliate links.
More prompts like this
The prompt to run before any app with a database goes live
How do you check whether your database is exposed before launching an app?
The prompt that finds keys your visitors can read
How do you check whether your API keys are visible to visitors in an AI-built app?
The prompt that tells you when your app fails
How do you find out that your app is broken before a customer tells you?