Privacy Policy

How ExecPilot handles your data — which, by design, is mostly by never touching it.

Last updated: December 2025

The short version

1. Who we are

ExecPilot is a browser extension (and companion Windows application) that provides recipe-driven AI workflows using AI model providers and tool servers that you configure with your own credentials. This policy covers the ExecPilot Chrome extension, the ExecPilot Windows application, and this website.

2. What we collect: nothing

The ExecPilot extension contains no analytics libraries, no tracking pixels, no crash reporters, and no telemetry of any kind. We do not collect, receive, store, or process:

  • Your prompts, queries, or AI responses
  • Your uploaded files or their contents
  • Your API keys or MCP server credentials
  • Your browsing history or page contents
  • Your identity, email, or any account information (there are no accounts)
There is no ExecPilot server involved in processing your requests. Architecturally, we could not read your data even if we wanted to.

3. Where your data actually goes

ExecPilot sends data only to endpoints you explicitly configure, directly from your browser:

3.1 AI model providers

When you run a recipe, your prompt (and any content you attach) is sent directly to the provider you selected — Anthropic, OpenAI, OpenRouter, ZenMux, or your local Ollama instance. Each provider's own privacy policy and data-use terms govern that traffic. You authenticate with your own API keys.

3.2 MCP tool servers

If you connect Model Context Protocol servers (e.g., an internal company reporting service), tool-call requests and their arguments are sent directly to those servers. These are typically servers operated by you or your employer; their handling of that data is governed by their operators, not by us.

3.3 Local Ollama

When you select Ollama as your provider, all AI processing happens on your own machine. No prompt or file content leaves your device. For spreadsheet code-execution mode, only column headers and a small sample of rows are sent to whichever model you selected — the full dataset is processed locally in a sandbox.

4. What is stored on your device

The following is stored locally using Chrome's extension storage (and, in the Windows app, encrypted with Windows DPAPI):

  • API keys and MCP server configurations (including auth tokens you enter)
  • Your custom recipes and skills
  • Provider preferences and settings
  • Temporarily, text you send via "Send selection to ExecPilot" (held in session storage until consumed)

This data never syncs to any ExecPilot service. Uninstalling the extension removes it. You can also clear it anytime via Chrome's extension data controls.

5. Browser permissions we request, and why

  • storage — to save your settings, recipes, and skills locally
  • sidePanel — to display the ExecPilot interface
  • contextMenus — to provide the right-click "Send selection to ExecPilot" action
  • activeTab / scripting — to capture text you explicitly select and send
  • Pre-declared host access to the five supported AI provider APIs and localhost:11434 (Ollama)
  • Optional host permissions — access to an MCP server's origin is requested only when you add that server, via an explicit Chrome permission prompt. You can revoke it at any time from within ExecPilot or from Chrome's extension settings.

ExecPilot does not read or modify web pages you visit. Page content is only accessed when you explicitly select text and choose to send it.

6. Code execution sandbox

The spreadsheet code-execution feature runs AI-generated transformation code inside a sandboxed iframe with no network access, no Chrome API access, and no access to your files or the page. It can only receive the spreadsheet rows you provide, compute, and return a result. Generated code is shown to you in full before and after execution.

7. This website

This website is a static page. It does not set cookies, run analytics, or collect personal information. Fonts are loaded from Google Fonts, which may log standard web request data (IP address, user agent) per Google's privacy policy.

8. Third-party services reference

Depending on which providers you configure, your data may be processed by: Anthropic, OpenAI, OpenRouter, ZenMux, or your local Ollama installation, and any MCP servers you connect. We encourage you to review the data-use and retention policies of any provider you connect. ExecPilot has no business relationship with these providers and receives nothing from your use of them.

9. Children

ExecPilot is a professional productivity tool intended for business users and is not directed at children under 16.

10. Changes to this policy

If future versions of ExecPilot introduce features that change these practices (for example, optional accounts or licensing), this policy will be updated before those features ship, with the "Last updated" date revised. Material changes will be highlighted in the extension's release notes.

11. Contact

Questions about this policy or ExecPilot's data practices: help@getexecpilot.com or hello@krri.sh