Privacy Policy

This policy applies to the TaskPilot browser extension, website, and dashboard (together, the "Service"), operated by TaskPilot. If you have questions, contact us at privacy@taskpilot.cc.

We keep collection to the minimum needed to run the Service:

• Account data (optional). If you create an account, we store your email address and authentication details through our provider, Supabase.
• Anonymous session data. If you use the Service without signing in, we generate an anonymous session identifier to enforce free-tier usage limits. It is not linked to your identity.
• Content you submit. Text or page content you ask TaskPilot to process (for example, to autofill a form or summarize a page). This is processed to fulfill your request; see "How content is handled" below.
• Usage and billing data. Counts of actions taken, feature usage, and — for paid plans — billing details handled by our payment processor, Stripe. We never receive or store your full card number.
• Product analytics. Aggregate, privacy-respecting analytics (via PostHog) to understand which features are used. You can opt out in settings.

When you invoke an AI action, the relevant content is sent through our secure server-side proxy to our AI provider to generate a result, then returned to you. We do not retain that page content after your request completes, and we do not use it to train models. Local parsing (regex and heuristics) runs entirely in your browser and never leaves your device.

We use the information above to: provide and maintain the Service; enforce plan limits and prevent abuse; process payments; respond to support requests; and improve features through aggregate analytics. We do not sell your personal information, and we do not share it with third parties for their own marketing.

We rely on a small set of processors, each bound by contractual data-protection obligations: Supabase (authentication and database), Stripe (payments), our AI provider (request processing), PostHog (analytics), and Vercel (hosting). These providers process data only to perform services on our behalf.

Account and usage records are kept for as long as your account is active. Submitted page content is not retained after a request completes. When you delete your account, we remove your personal data within 30 days, except where we must retain limited records to meet legal or accounting obligations.

Depending on where you live, you may have rights to access, correct, export, or delete your personal data, and to object to or restrict certain processing. To exercise any of these, email privacy@taskpilot.cc. We respond within the timeframes required by applicable law. EU/EEA users may also lodge a complaint with their local data-protection authority.

AI requests are routed through a server-side proxy so provider API keys are never exposed to your browser. We enforce row-level security on our database, encrypt data in transit, rate-limit requests, and request only the browser permissions the extension actually needs. See our Security page for details.

The Service is not directed to children under 13 (or the minimum age in your jurisdiction), and we do not knowingly collect their data.

We may update this policy as the Service evolves. Material changes will be announced on this page with an updated effective date, and where appropriate, by email.