Privacy policy

• Account data: email address and a hashed password when you sign up.
• Business profile: the answers you give during onboarding — what you sell, who buys it, your story and goals — and the conversation transcript that produced them.
• Post history: if you connect an X (Twitter) account, we pull your own public posts and their metrics and store them to compute your performance baselines.
• OAuth tokens: the X access and refresh tokens needed to read your account, encrypted at rest.
• Usage analytics: page views and error reports via PostHog, used to debug and improve the product.

• Compute your personal performance baselines and show you what works for your account.
• Provide and improve the product, fix bugs, and prevent abuse.
• Send transactional email (sign-in confirmations, password resets).
• Comply with legal obligations and enforce our terms of service.

We do not sell your data. We do not use your data to train third-party AI models.

We share data only with the vendors we need to run the service:

• Supabase — database and authentication.
• Vercel — application hosting.
• Anthropic— the AI model behind the onboarding conversation. Your answers pass through Anthropic’s API.
• Resend — transactional email delivery.
• PostHog — product analytics and error tracking.
• X (Twitter) — we read your own posts and metrics via the X API after you connect your account.

We use first-party cookies to keep you signed in and run analytics. We do not use cookies for cross-site advertising. You can clear or block cookies in your browser settings — doing so may sign you out.

We keep your account data for as long as your account is active. If you delete your account, we remove your personal data within 30 days, except where we are required to retain records for tax or fraud-prevention reasons.

Depending on where you live (EU, UK, California, and similar jurisdictions), you have the right to access, correct, export, or delete your personal data, and to opt out of analytics. To exercise any of these rights, email alerts@onpilot.app.

We use TLS in transit and AES encryption at rest for sensitive fields (e.g. OAuth tokens). Database access is row-level secured per user. Please report any security concern to alerts@onpilot.app.

OnPilot is not intended for users under 16. We do not knowingly collect data from children.

We may update this policy as the product evolves. Material changes will be announced by email or in-app notice at least 7 days before they take effect.

Questions? Email alerts@onpilot.app.