Pilotfish Privacy Notice
Last updated: 31 October 2026
This notice explains what personal data Pilotfish handles, why, and your rights. It covers people who sign in, maintainers whose repositories use Pilotfish, and people whose issues or comments Pilotfish reads (for example, bug reporters), even if they never signed up.
Who we are. Jose Silva, sole trader (empresário em nome individual), Braga, Portugal, NIF 254875394. Contact for privacy: hello@pilotfish.run.
1. Short version
- We only get what GitHub gives the Pilotfish app, plus what you do in our dashboard. We never see card numbers.
- To reproduce a bug, we send the issue and parts of the repository to an AI model (Anthropic's Claude) and run code in disposable machines (Boat). Neither uses it to train models.
- Comments Pilotfish posts on public repositories are public, and so are run pages for public repositories.
- We use no analytics, no ads, no tracking cookies.
2. What we collect and why
| Data | Where it comes from | Why | Legal basis (GDPR Art. 6) |
|---|---|---|---|
| GitHub account: user id, login, avatar URL; GitHub sign-in tokens (stored encrypted) | GitHub, when you sign in | Sign you in, show the repositories you can manage | Contract |
| Installation data: installation id, account (user or org) id and login, who installed the app (GitHub id and login) and whether they have used a trial, repositories, repository settings and who changed them | GitHub, when the app is installed; the dashboard | Run the Service as you set it up | Contract |
| Run records: repository, issue or PR number and title, excerpts of issue text and comments, the reporter's login, reproduction scripts, command output, the AI agent's transcript, verdicts, cost, and the comment posted | GitHub, and what the Service produces | Do the run, post the result, show it in the dashboard, rerun saved repros on pull requests | Contract (with the account that installed Pilotfish); for reporters: legitimate interests of the maintainers and us in handling bug reports they chose to file publicly or in the repo |
| Repository code | Cloned from GitHub into a virtual machine | Build and run the project to reproduce the bug | Same as above |
| Credits and billing: credit ledger, Stripe customer and subscription ids, plan status, who bought or manages billing (GitHub login) | You and Stripe | Grant and spend credits, handle refunds and disputes, prevent abuse of trials | Contract; legal obligation (accounting) |
| Session cookie (see §7) | Your browser | Keep you signed in | Contract / strictly necessary |
| Error reports: error type, a shortened message, stack trace, time, environment | Our servers | Find and fix bugs | Legitimate interests |
| Server logs: requests and job steps, which can include issue titles and commands | Our servers | Run, secure and debug the Service | Legitimate interests |
| Support emails | You | Answer you | Contract / legitimate interests |
We don't ask for your email in the app. Stripe collects what it needs for payment (see §4).
3. AI processing
- For each run, the AI agent (Anthropic's Claude, used through Anthropic's commercial API) receives the issue and its comments, the repository files it reads, and the output of commands it runs. It writes the reproduction script, the verdict and the comment.
- Anthropic doesn't train on this data, and by default deletes API inputs and outputs within 30 days.
- Pilotfish doesn't make decisions about people. Its output is about software and is reviewed by maintainers, so there is no automated decision-making in the sense of GDPR Art. 22.
- Comments written by the AI agent are labelled as AI-generated.
4. Who we share data with
Subprocessors (they process data for us, under contracts that protect it):
| Company | What for | Data | Location |
|---|---|---|---|
| Anthropic, PBC | AI model | Issue text, code excerpts, command output, agent transcripts | USA |
| Boat (boat.dev) | Disposable virtual machines; a stored copy of each set-up repository | Repository code, issue text in scripts, command output | EU |
| Railway Corporation | Hosting and database | Everything in §2 | USA |
| Functional Software, Inc. (Sentry) | Error tracking | Error reports (no user data, request data or AI content) | EU (Germany) |
| Google LLC (Gmail) | Support email | Your emails | USA / global |
| Cloudflare, Inc. | DNS and forwarding of email to our inbox | Your emails while forwarded | Global |
We announce changes to this list here at least 14 days before they take effect.
Independent controllers (they decide how they use data, under their own privacy policies):
- Stripe and Link (Stripe Managed Payments; the merchant of record is Stripe's affiliate Lemon Squeezy LLC). They collect your name, email, payment details and billing address at checkout, charge you, handle tax, receipts and refunds. We receive ids, plan status, amounts and dispute outcomes, not card numbers. See stripe.com/privacy and link.com/privacy.
- GitHub. Pilotfish works through GitHub; GitHub's own privacy statement applies to your GitHub account and to what is posted there.
- Authorities, if the law requires it.
We don't sell personal data and don't share it for advertising.
5. Public content
- Pilotfish posts its results as comments under its bot account. On a public repository anyone can read them.
- For runs on public repositories, pilotfish.run shows a run page with the evidence (not the raw script or AI transcript). Pages are not indexed by search engines. We may feature some as examples. Pilotfish checks with GitHub that a repository is public before showing its page; pages for private repositories are never shown.
- A maintainer can hide a run from its public page and from the examples in the dashboard. Anyone else can ask us to remove one (§9).
6. International transfers
Anthropic, Railway, Google and Cloudflare are US companies, and Sentry's parent is too. Where data leaves the EEA we rely on the EU–US Data Privacy Framework where the provider is certified, or on the EU Standard Contractual Clauses in their data processing agreements.
7. Cookies
We set only two cookies, both needed for sign-in, so we don't show a cookie banner:
| Cookie | Purpose | Lasts |
|---|---|---|
pf_session |
Keeps you signed in. Holds a random id; we store only its hash. | 30 days, or until you sign out |
pf_oauth |
Protects the GitHub sign-in against forgery and remembers where to return. | 10 minutes |
No analytics or advertising cookies, no local storage. Fonts are served from our own site. The dashboard shows GitHub avatars, so your browser loads those images from GitHub. Stripe's checkout and billing pages are on Stripe's own site and use Stripe's cookies.
8. How long we keep data
| Data | Kept |
|---|---|
| Sessions | Until sign-out or 30 days; expired ones deleted within a day |
| AI transcripts and raw command logs | 90 days after the run |
| Run records (verdict, comment, reproduction script, issue title) and repository settings | While Pilotfish is installed on the repository; deleted within 30 days of uninstalling |
| Stored repository copy at Boat | Until uninstall; deleted within 30 days |
| Dashboard jobs | 30 days after they finish |
| Credit ledger and billing records | While the account exists, then as long as tax and accounting law requires (10 years in Portugal) |
| Error reports | Up to 90 days |
| Server logs | Up to 30 days |
| Support emails | 2 years after the conversation ends |
9. Your rights
You can ask us to access, correct, delete, restrict or export your personal data, and you can object to processing based on legitimate interests (for example, a reporter asking us to remove a public run page). Email hello@pilotfish.run; we reply within one month. We may need to confirm you control the GitHub account concerned.
- Delete everything: use Delete my data on your account page in the dashboard (it signs you out everywhere and removes your sessions, stored GitHub tokens and billing-admin roles), uninstall the Pilotfish app on GitHub (Settings → Applications; we then delete that repository data within 30 days), and cancel Pro. Billing records we must keep stay. You can also email us.
- If Pilotfish runs on a repository you don't control, some requests (for example, about content in that repository) are best made to its maintainers, who decide how Pilotfish is used there. We'll help them.
- You can complain to a data protection authority, in Portugal the CNPD (cnpd.pt), or the one where you live.
10. Security
Each run happens in a fresh, disposable virtual machine. GitHub tokens are encrypted at rest; only a hash of the session cookie is stored; data is encrypted in transit; error reports exclude request data, user data and AI content. No system is perfectly secure: if a breach puts your data at risk, we'll tell you and the authorities as the law requires.
11. Children
Pilotfish is a developer tool and isn't meant for children. You must be old enough to have a GitHub account.
12. Changes
We'll post changes here and update the date. For material changes we'll give notice in the dashboard before they apply.