Privacy Policy

Popilot operates the Service. For privacy questions or requests, contact us at hi@popilot.net.

Depending on how you use Popilot, we may collect:

• Account information — email address, display name, and a hashed password when you register.
• Product content — backlog names, epics, user stories, acceptance criteria, uploaded images, Figma file URLs you provide, and related metadata you create in the Service.
• Integration data — when you connect third-party tools, we store OAuth tokens and limited account metadata (for example, your Jira site URL, default project, or Figma account identifier) so the Service can read designs and sync issues on your behalf.
• Usage and technical data — session identifiers, browser type, IP address, and server logs needed to operate, secure, and debug the Service.
• Communications — messages you send through our contact form or support email.
• Billing information — if you subscribe to a paid plan, payment processing is handled by our payment provider; we receive subscription status and limited billing identifiers, not full card numbers.

We use your information to:

• Provide, maintain, and improve the Service;
• Authenticate you and keep your account secure;
• Generate and store backlogs from your inputs, including optional AI-assisted generation;
• Connect to Jira and Figma when you authorize those integrations, and sync data you request;
• Send transactional emails (for example, password reset);
• Respond to support requests and comply with legal obligations.

We do not sell your personal information. We do not use your connected Jira or Figma data for advertising.

If you choose to connect Jira Cloud or Figma, you will be redirected to those providers to grant access. Popilot only uses the scopes needed to read design information you link and to create or update issues you explicitly sync. You can disconnect integrations at any time from the Integrations page, which removes stored tokens from our database.

Your use of Atlassian and Figma is also subject to their respective privacy policies and terms.

We use trusted subprocessors to run the Service, including:

• Cloudflare — hosting, database (D1), and file storage (R2);
• Resend — transactional and contact email (when enabled);
• Anthropic (Claude Platform) — optional AI generation when configured;
• Razorpay — payment processing (when enabled).

These providers process data on our instructions and under agreements appropriate to their role.

We retain account and backlog data while your account is active. If you delete content or disconnect an integration, we remove or update the corresponding records in our systems within a reasonable period. We may retain limited logs and backups for security, fraud prevention, and legal compliance.

We use industry-standard measures such as HTTPS, hashed passwords, HttpOnly session cookies, and access controls scoped to your user account. No method of transmission or storage is completely secure; please use a strong, unique password and protect your device.

You can:

• Update your profile in Settings;
• Disconnect Jira or Figma under Integrations;
• Request account deletion or a copy of your data by emailing hi@popilot.net.

Depending on where you live, you may have additional rights (access, correction, deletion, objection, portability). We will respond to verified requests as required by applicable law.

Popilot is operated using infrastructure that may process data in countries other than yours. Where required, we rely on appropriate safeguards for cross-border transfers.

The Service is not directed to children under 16, and we do not knowingly collect their personal information.

We may update this policy from time to time. We will post the revised version on this page and update the “Last updated” date. Continued use of the Service after changes become effective constitutes acceptance of the updated policy.

Questions about this Privacy Policy or our data practices: hi@popilot.net or our contact form.