Access Pilot exists to shrink your data footprint, so the product is built around a simple rule: we handle as little of your data as possible, keep it only where it serves you, and let you erase all of it in one action. This page describes exactly what we collect, why, and what never leaves your control.
What we collect
Account details. When you create an account we store your email address, your name if you provide one, and your authentication credentials (handled by our authentication provider, Supabase — we never see your password).
Mailbox metadata. When you connect an inbox and run a scan, Secura reads message headers and — only for messages that look like account evidence — sanitized message content. From this it derives your account inventory: which services hold an account for you, when each was created, and how active it is.
What stays on your device
- Scans run against your mailbox and are processed locally. The full text of your email is never uploaded to Access Pilot.
- Before any message excerpt is sent for AI classification, it is sanitized: your own address, one-time codes, and URL query strings are redacted first. In heuristic mode, nothing is sent at all.
- Every scan produces a privacy report — visible in Settings — showing precisely how many message bodies were transmitted, to which model, and what was redacted. Zero is a common and correct answer.
How your data is stored
Email-derived records are encrypted at rest with AES-256-GCM. Your approval settings and action history are stored so the product can show you what it did and why. We do not sell your data, share it with advertisers, or use it to train models. Ever.
Deleting your data
Settings → Delete analyzed data irreversibly removes the scan, every derived account and sender record, and the full action history. It is a genuine delete, not a soft flag. Deleting your Access Pilot account removes your profile and credentials as well.
Third parties we rely on
- Supabase — authentication and application database.
- Vercel — application hosting.
- OpenRouter — optional AI classification, only when a model is configured, and only ever sanitized excerpts.
Contact
Questions about this policy or a data request: privacy@accesspilot.com. Security disclosures belong on the security page.
Access Pilot is in private beta. As the product evolves this policy will be versioned here, and material changes will be announced in the app before they take effect.