# Privacy Policy

> Who runs PilotFox, what personal data it handles about account holders and website visitors, why, for how long, who receives it, and your rights.

This policy explains how we, PilotFox, handle personal data in our analytics service at pilotfox.app and on this website. We have two roles:

- **We are the controller** of the data about you as a PilotFox account holder, as a person invited to an organization, and as a reader of pilotfox.app's own pages.
- **We are a processor** of the analytics data our customers collect about the visitors of their own websites and apps. The customer decides why and how that data is processed, and our [Data Processing Agreement](https://pilotfox.app/dpa) sets what we may do with it. If you visited a website that uses PilotFox, see [Visitors of our customers' websites](#visitors-of-our-customers-websites).

## Who we are

PilotFox runs the analytics service at pilotfox.app. For anything about this policy or your data, including data protection questions and requests, write to [hello@pilotfox.app](mailto:hello@pilotfox.app).

## What we collect about account holders

| Data | When | Why |
| --- | --- | --- |
| Your name, email address and password. The password is stored only as a scrypt hash. | You create an account or accept an invitation. | To give you an account and sign you in. |
| Your name, email address, the address of your profile picture and your account id at Google or GitHub. Their sign-in tokens are stored encrypted. | You sign in with Google or GitHub. | The same. |
| Your two-factor secret and backup codes, stored encrypted. | You turn on two-factor authentication. | To check the codes you enter when you sign in. |
| Your sign-in sessions: when they started and were last renewed, your browser's user agent, and a keyed hash of the IP address you signed in from. The address itself is never stored. | Each time you sign in. | To keep you signed in, to show you your sessions (Account → Sessions) and to protect your account. |
| Your organizations, memberships, roles and teams; invitations you send, with the invited email address; API keys, stored as hashes; AI assistants you connect over MCP, with what you allowed them. | You or your team use these features. | To run your organization's workspace. |
| Your sites and their settings, segments and annotations; the credentials you connect (payment-provider keys, Google Search Console tokens, Slack and Discord webhook addresses), stored encrypted. | You set them up. | To provide the features and integrations you turn on. |
| Your choice of email reports and of new-sale emails. | You choose them, or a site's editor adds you to its new-sale emails. | To send them. |
| What you write to us. | You contact us. | To answer you. |

We do not use your data for advertising: PilotFox shows no ads and sends no data to advertising networks.

## Legal bases

- **Contract** (GDPR Art. 6(1)(b)): your account, signing in, the features you use, and the emails they need (address verification, password reset, sign-in codes, invitations, and the reports and new-sale emails you chose).
- **Legitimate interests** (Art. 6(1)(f)): keeping accounts and the service secure (session records, rate limits, two-factor checks), preventing abuse of sign-up and email, and answering what you write to us. You can object to this processing (see [Your rights](#your-rights)).
- **Legal obligation** (Art. 6(1)(c)): where a law requires us to keep or disclose data.

## How long we keep it

- **Your account** and what belongs to it: until the account is deleted, by you in Account → Delete account or by us. Its sessions, sign-in methods, two-factor settings, memberships, email report and new-sale email choices and connected AI assistants are deleted with it, and so are the organizations you are the only member of, with their sites and data. Annotations, public segments and sites you created in other organizations stay with those organizations, no longer linked to you.
- **Sign-in sessions** expire 7 days after they start or were last renewed (they are renewed at most once a day while you use PilotFox), or end earlier when you sign out or sign them out (Account → Sessions). The record of each session (its times, your browser's user agent and the keyed hash of your IP address) is deleted within a day after the session ends, and with your account if that is deleted first.
- **Links and codes** expire: email verification links after 1 hour, sign-in codes after 5 minutes, invitations after 7 days. Expired sign-in codes and password reset links are deleted within a day.
- **Rate limits** keep a keyed hash of your IP address only for the window of the limit.
- **Organizations and sites** are kept until they are deleted; then their data is erased (see the [Data Processing Agreement](https://pilotfox.app/dpa#deletion-or-return)).
- **Backups** of the databases are deleted after 30 days.
- **What you write to us** is kept for as long as we need it to deal with your message.

## Who receives it

- **Our service providers** (hosting, file storage and email delivery), which process data for us under contract: see [Subprocessors](https://pilotfox.app/subprocessors).
- **Your organizations**: their members can see your name, email address and role.
- **Our system administrators** can see accounts, organizations and sites in PilotFox's admin area. To help you, one of them can sign in as you: such a session lasts at most 1 hour and is recorded as started by that administrator.
- **Services you choose to connect**: Google or GitHub when you sign in with them; your payment provider, Google Search Console, Slack and Discord when you connect them to a site (new-sale messages to Slack or Discord carry the amount, currency, source and country of each sale, never the buyer); and the AI assistants you connect over MCP, which receive the reports they ask for. Their own terms and policies apply to what they receive.
- **Maps**: the dashboard's map views load the base map from a map tile provider, which receives your IP address and browser details as any web server does. PilotFox sends it no data about you or your visitors.
- **Authorities**, when a law requires us to disclose data.

## International transfers

Where a service provider of ours processes personal data outside the European Economic Area or the UK, we rely on an adequacy decision or on standard contractual clauses. Ask us at [hello@pilotfox.app](mailto:hello@pilotfox.app) for details.

## Your rights

Under the GDPR you can ask us for access to your personal data and a copy of it, to correct it, to erase it, to restrict its processing, to receive it in a portable form, and you can object to processing based on legitimate interests. You can do much of this yourself in PilotFox:

- **Account**: change your name, email address and password; turn two-factor authentication on or off; see your sessions and sign them out; delete your account (Account → Delete account), which first shows what goes with it. If you are the only owner of an organization that has other members, make another member an owner first.
- **Organizations**: an owner or admin can delete a site, and an owner an organization, with all its data.

For anything else, write to [hello@pilotfox.app](mailto:hello@pilotfox.app). We answer within one month, as the GDPR requires (Art. 12(3)), and may ask you to confirm it is you.

## Complaints

You can complain to a data protection supervisory authority, in particular in the country where you live, where you work or where you think your rights were infringed (GDPR Art. 77). We would like the chance to sort it out first, so please write to [hello@pilotfox.app](mailto:hello@pilotfox.app).

## This website

The pages of pilotfox.app (the home page, the documentation and these legal pages) run no analytics script, PilotFox's included, and load nothing from other websites: their fonts, images and styles come from pilotfox.app. They set no cookies. If you pick a theme with the switch at the bottom of the home page, your choice stays in your browser's `localStorage` (see the [Cookie Policy](https://pilotfox.app/cookies)).

Our web server writes no access log, and its error log leaves out IP addresses, page addresses and request headers. The application's own logs name the kind of request (its route), not the page address or the IP address, and redact email addresses, passwords and tokens. Our hosting provider carries the network connection (see [Subprocessors](https://pilotfox.app/subprocessors)).

## Visitors of our customers' websites

A website that uses PilotFox sends us the pages you view there and the events it records. That website's operator decides what is collected and why: they are the controller, and we process the data for them. By design:

- **No cookies**: the PilotFox script sets none and PilotFox reads none. It writes to your browser's storage only in the cases listed in the [Cookie Policy](https://pilotfox.app/cookies#on-websites-that-use-pilotfox).
- **Your IP address is never stored.** It is used while your request is processed (to compute a visitor id, look up your approximate location and filter bots) and then dropped.
- **The visitor id differs on every website**, so you cannot be followed from one PilotFox customer to another. A website can also make it change every day.
- **Your location** is stored as country, region and city, with coordinates rounded to about 1 km, and the network you use (its ASN).
- **Global Privacy Control**: if your browser sends it, PilotFox does not track you, unless the website turned that off.
- **Session replay**, if the website turned it on, masks what you type in forms by default, and passwords always.

Ask the website's operator about your data: they decide what happens to it, and they can see, export or erase it. More detail: [GDPR-friendly by design](https://pilotfox.app/gdpr) and [Privacy and data](https://pilotfox.app/docs/privacy).

## Security

Passwords are hashed, API keys and link tokens are stored as hashes, connected credentials are encrypted, IP addresses are kept only as keyed hashes, and access to data follows each member's role. The [Data Processing Agreement](https://pilotfox.app/dpa#security) lists the measures.

## Changes

We will publish any change to this policy on this page and update its date. If a change affects how we use your data, we will tell account holders by email before it applies.

## Contact

PilotFox, [hello@pilotfox.app](mailto:hello@pilotfox.app).