Privacy Policy

Pilos for Chrome · Last updated October 11, 2026

This policy covers the Pilos browser extension. Pilos Agents and Pilos Rooms are separate products with a separate policy, at pilos.net/privacy. The extension’s terms of service are the companion to this page: this one is what leaves your browser, that one is who is responsible for what.

In short

• Pilos sends the shape of the page you are on, and what you typed in the chat. It does not send the page’s content.
• When you ask it to build something out of a site’s own data, it also sends the addresses that site fetches data from and the field names of what comes back. Never the values.
• Your posts, messages, names, photos, links, form values and cookies are never read, so they cannot be sent.
• Notes you write yourself inside one of those views are never sent to our AI, and nothing but you ever deletes them.
• Your saved changes live in your browser. They only reach our server if you deliberately connect the browser to a Pilos account, and then only in the ways set out below.

What Pilos does, and does not do

Pilos changes what you see, in your browser, for you. Nothing changes on the website itself and nobody else sees your version.

Pilos never writes to a site. It does not click, submit a form, follow, post, vote, message or buy. That is not a promise we remember to keep: there is no shape in the format Pilos uses to describe what it builds that could express a write to a site.

It does read. Restyling a page touches nothing outside your browser at all. A view — the feature that renders a site’s own data the way you asked for it — asks that site’s own addresses for data again, from inside the page, signed in as you. That is the only way the data could be fetched: it is yours, and it sits behind your login. What that costs, and how it is limited, is set out below, including the part that is not about us — most sites’ terms do not allow it.

What leaves your browser when you ask for a change

When you type a request into the panel, Pilos sends one request to our AI endpoint. It contains four things:

1. What you asked for — “show my feed in two columns”. It is the request, so it has to go.
2. A page skeleton — the structure of the page with the content taken out. The table below is the complete list of fields.
3. The hostname and path of the page, for example friendfeed.com and /home. Never the full URL: the query string is dropped, because search terms live there.
4. An anonymous install id — a random identifier created when you install Pilos. It is not derived from anything about you or your machine, and it is not tied to a name or an email unless you choose to create an account.

The page skeleton, field by field

The skeleton is capped at 220 elements and 20 levels deep. A page larger than that is sent truncated rather than in full.

The second look

After seeing the skeleton, the model may ask up to two rounds of follow-up questions about the page — “how many elements match this selector?”, “what is inside this one?” Those questions are answered inside your browser and the answers are built by the same redactor, with the same fields as the table above. Widening what the model may ask does not widen what it may see.

What Pilos never reads

Pilos cannot leak what it never reads. The code that builds the skeleton does not access any of these browser properties, and an automated test fails our build if it ever starts to:

textContent · innerText · innerHTML · outerHTML · nodeValue · href · src · srcset · poster · alt · title · placeholder · value · style

So none of the following ever leaves your browser:

• Page text. Posts, messages, comments, article bodies, search results, headings, button labels.
• People. Names, usernames, profile photos.
• Links and images. No URL from the page, in any attribute.
• What you type into the page. Form fields, search boxes, text areas, passwords.
• Cookies, tokens and site storage.
• Your browsing history. Pilos describes the page you have open, and only at the moment you ask it for a change.

This is not a promise we ask you to take on trust. Three realistic test pages are run through the real code on every build, and the build fails if a single word of their text, or any link or image URL, survives into the payload.

The one judgement call

aria-label is the single text-derived field Pilos sends. It is there because without it a model cannot tell a “Sponsored” badge from a post, and getting that wrong means hiding the wrong things. It is therefore the most restricted field: a label is sent only if it is 40 characters or fewer, contains no @, no / and no http, and does not look like a person’s name.

A known limit, stated plainly: the name check looks for two or three capitalised words, because requiring two is what lets real labels like “Sponsored” through. An aria-label consisting of a single first name — “Maya” — would be sent. This is the one place where a first name could reach the AI, and we would rather tell you than let you discover it.

What comes back

A recipe: a list of display changes in a strict, declarative format — selectors and style rules, nothing more. Every recipe is checked against that format before anything is applied, and the format has no field capable of expressing code — so a restyle cannot contain a program even if the AI tried to write one.

That is true of restyling and not of views, which can carry a stylesheet and a small program. Styling and code a view carries says exactly what one can do, which build can run one at all, and what you have to switch on yourself first.

Filters such as “hide posts from people I don’t know” are decided inside your browser, from structural signals — an attribute, the presence of a child element, a count. There is deliberately no way to express “hide items whose text says X”, because matching on text would require text we do not have.

Where your changes are stored

• Your saved changes are stored in the extension’s synced storage, inside your own Chrome profile. If you have Chrome Sync switched on, Chrome copies them between your signed-in Chrome installations through your Google account — that transfer is Google’s, governed by Google’s privacy policy, and we are not party to it. Your anonymous install id is stored the same way.
• Your chat history with Pilos is stored on that machine only, in local extension storage. It is never synced and never uploaded. Only the most recent messages for a site are kept.
• Breakage counts — how often a saved change stopped matching, which is how Pilos notices a site has been redesigned — are counted and kept on that machine only, and are never sent anywhere.

Removing the extension removes all of it. You can also clear a single site from the panel.

Building something out of a site’s own data

A view is a small application Pilos renders on top of a site, out of that site’s own data — your orders as a sortable table, your spending as a chart. None of this happens on a site until you have pressed Watch this site for that exact hostname, and switching it off stops all of it. The panel says the three things below before that button, because all three would be unfair to discover afterwards.

Watching a site

While a site is watched, Pilos wraps the page’s own data requests and records what the site asked for, so a view can ask for the same thing later. This is the one place Pilos looks at a response body, and it happens inside your browser and nowhere else. What it keeps, on that machine:

• The address, as a template — /api/orders?page={n} rather than the exact URL, with ids and tokens replaced by placeholders
• The method, whether it looked like a read, and whether it was the site’s own origin
• The names of the request headers it used — never their values
• The shape of what came back: field names, their types, and whether a field was a list
• How often it was seen, and when it was first and last seen

What it does not keep: the response body, any value from it, the exact URL, or anything you typed into the page. The list holds sixty addresses per site and forgets the least recently seen. One screen in the panel shows you everything it holds for a site, with a button that forgets the lot.

What is sent when you ask for a view

The address templates, their parameters, and the field names and types of what each one returns — plus the hostname, the path of the page you are on, what you asked for, and the anonymous install id. Not one value from the site goes with it, and that is enforced by the shape of what is sent rather than by filtering it: there is no field in the record of an address that could hold a value, and a test fails the build if one appears.

Asking the site again

When a view needs data it asks the site’s own address again, from inside the page, signed in as you. Nothing on our servers has or wants your cookies. It is limited: reads only, addresses catalogued from that same site only, no faster than one request a second, answers cached for a minute, and a cap on how many pages of a list a view may walk. Every request is counted, per address, and the count is shown to you. The tally stays in your browser.

And the part that is not about us: automated access to a site’s API is against most sites’ terms of service. If a site objects, it objects to your account, not to ours, and we cannot appeal it for you. The panel says that before watching starts, and the honest advice is to leave it switched off for any account you cannot afford to lose.

Styling and code a view carries

A view is mostly assembled from components — tables, charts, filters — but two parts of it are written by the AI. A stylesheet, which applies inside the view and cannot reach the page around it. And, for what components cannot do, a small program in JavaScript.

The program is shown to you in full before you keep the view — the code itself, not a description of it. It runs in a space of its own with no access to the extension and no way to become more code, and it is handed only the rows the view already fetched. It runs only if you switch it on yourself, in Chrome’s own settings, on the Pilos entry in chrome://extensions. We cannot turn that on for you, and everything else about a view works without it.

Be precise about the limit, because the opposite would be a comfortable lie: a program runs beside the page, and the rules that say it may not reach the network or the site’s own markup are enforced by reading the code before it runs. That catches a mistake and an obvious evasion. It is a tripwire, not a sandbox, and what stands behind it is that Pilos wrote the program, from your request, and showed it to you. A program is never accepted from anybody else.

There are two builds of Pilos. The one in the Chrome Web Store cannot run a program at all — it does not ask for the permission and does not contain the code that would use it, because Chrome’s rules forbid an extension running code it did not ship with. A build that can run one is installed another way, and says so.

Notes you write yourself

A view can give you somewhere to put what only you know — a note against an order, a tag, a column the site does not have. Those rows are the one thing in Pilos that you wrote rather than Pilos derived, and they are treated accordingly:

• They are stored on that machine, per site.
• Nothing in Pilos deletes one of them. Not removing the view that created the table, not switching the feature off, not forgetting the site. Only you, from the screen that lists them.
• They are never sent to our AI. When you ask a question about them, what is sent is your table and column names and the question — and what comes back is a query, which runs in your browser over rows that never left it. There is no field in either direction that could carry one of your rows.
• They leave your browser only if you switch syncing on, and then only as ciphertext we cannot read.

If you connect a browser to a Pilos account

Connecting is optional and off until you do it: you ask the panel for a short code and type it into the dashboard while signed in. An extension that has never been connected sends nothing described in this section.

Once connected, that browser pushes the following to our server so your dashboard has something to show:

• The hostnames of the sites you have customised — hostnames only, never full URLs, never pages you have not customised
• The recipes themselves — the selectors, style rules and the short labels Pilos wrote for each change
• Whether each site is switched on, and which individual changes you have turned off
• Two counts: how many changes a site has, and how many have stopped matching

Be clear about what that is: a list of hostnames is a slice of your browsing. It is the one thing Pilos keeps on a server that you might not expect, which is why it happens only when you deliberately connect a browser. It is pushed at most once every 30 seconds, never more often. Disconnecting the browser stops it; deleting your account deletes the rows.

Account data

An account is optional. Pilos works without one. If you create one, we store:

• Your email address
• A salted hash of your password — never the password itself
• When the account was created and when you last signed in
• Which browsers you have connected, a name for each, and when

The token that lets a connected browser talk to your account is shown to the extension once and never stored by us — we keep only a hash of it, so a database leak cannot be replayed. Pairing codes are handled the same way: hashed, single use, and dead after ten minutes.

The dashboard keeps your sign-in token in your browser’s local storage. It sets no tracking cookie. Signing out removes the token.

If you join the waitlist, we store the email address you gave us and nothing else.

Syncing your views and your notes between computers

Off until you turn it on, and separate from connecting an account: an account alone syncs nothing. Turning it on generates a key in your browser — twenty-five characters, shown to you, never sent anywhere. Your views and your own notes are then kept against your account as ciphertext sealed with that key, per site. Even the label each item is filed under is derived from the key, so the stored rows do not say which sites you use or what your tables are called.

We cannot read any of it, and we cannot help you read it either: lose every browser that holds the key and the stored copy can never be opened again, by you or by us. There is no recovery and no escrow, deliberately — an escrow we could open would be a server that can read your notes.

What remains visible to us is the shape rather than the contents: how many items there are, how big they are and when they were written, tied to the account’s email address. A count of items is roughly a count of the sites you have built something for.

Never synced: the list of addresses Pilos has learned, the request tally, your chat history, and the token that identifies the browser. Stop syncing forgets the key on that browser and leaves every view and note where it is. Remove the stored copy deletes the sealed items for the whole account. Deleting your account deletes them too.

Giving a view to somebody else

Nothing is shared unless you press the button, and when you do, be clear about what it is: sharing is publishing. A shared view has to be readable by a browser that holds none of your keys, which means it is readable by us. It is the one thing in Pilos that is.

A shared view holds the site’s hostname, the addresses of that site’s API that the view reads, the layout, and its stylesheet. It cannot hold a program — removed before it is sent, refused when one is installed, and refused by the server as well — and it cannot hold any of your own rows, because there is no field in a table definition that can carry a value. Installing a shared view creates empty tables and nothing else.

The code is twelve random characters. Nothing lists them and there is no directory. Stop sharing takes the code down; anybody who already installed the view keeps their copy. Deleting your account deletes your shares.

Paying

Your first site is free permanently, whatever happens to a subscription. When you subscribe, payment is handled entirely by Stripe. Stripe collects your card details and billing email directly — Pilos never sees a card number, and the extension never asks for your email. We send Stripe your anonymous install id as the checkout reference, so the extension can unlock itself afterwards without you copying a licence key out of an email. We store the subscription’s status and identifiers so we know what you are entitled to.

The permissions the extension asks for

What we log

Our AI endpoint records one line per request: which route, the status, how long it took, the anonymous install id, token counts, and how many changes came back. It does not record skeletons, recipes, prompts, or anything derived from a page. That is enforced by shape rather than by discipline — the logger accepts a fixed list of simple values, so there is no parameter through which page data could reach a log line even by accident.

To stop abuse, the endpoint counts requests per install id over a short window. Those counters expire within minutes and hold no IP address.

Our account server keeps a security log. It records your IP address and browser user-agent against actions that change something, or that would matter if they were not you: signing in and failing to sign in, registering, verifying an email, changing or resetting a password, connecting or disconnecting a browser, pausing or resetting a site, sharing or unsharing a view, forgetting your stored items, starting a checkout, cancelling, and deleting your account. Two of those — pausing and resetting a site — record the hostname it was done to, next to your email address. It does not record them for ordinary licence checks, for site syncs, or for reading and writing your sealed items — the things that happen on their own, without you asking. Entries are deleted automatically after 180 days, and deleting your account removes yours at once.

This website uses no analytics and sets no tracking cookies. Our hosting provider keeps standard access logs, as every web host does.

Services we use

• Anthropic — writes the changes, the views, and the stylesheet and program a view carries. It receives your request and, depending on what you asked for, the page skeleton, the address templates and field names described above, or your table and column names. Never a value from a site, and never one of your own rows. See Anthropic’s privacy policy.
• Cloudflare — hosts the AI endpoint, and screens sign-ins for automated abuse. As the host it necessarily handles your IP address to route and protect the request; we do not log it. See Cloudflare’s privacy policy.
• Stripe — processes payments. See Stripe’s privacy policy.
• Amazon Web Services — hosts this website, the account server, the sealed items you have synced and any view you have shared, and sends our email (sign-in verification, password resets, subscription receipts). See AWS’s privacy notice.
• Google — distributes the extension through the Chrome Web Store, and, if you have Chrome Sync on, copies your saved changes between your own Chrome installations. See Google’s privacy policy.

We do not sell your data, and we do not share it with anyone outside this list.

Where data is processed

The AI endpoint runs on Cloudflare’s network, which means your request is handled at whichever of their locations is nearest you; the model call itself goes to Anthropic in the United States. Our account server, its database, this website and our email are in the United States, and so are your sealed items and any view you have shared. Whatever is sent to answer a request — the page skeleton, the address templates, your table names — is used for that request and not stored by us afterwards.

How long things are kept

• Page skeletons and prompts: not stored. They are used to answer the request and discarded.
• Your changes, your views, your notes, chat history and breakage counts: in your browser, for as long as you keep them. Removing the extension removes them. The notes you wrote yourself are the one thing Pilos never deletes on its own.
• What Pilos has learned about a site’s addresses, and the request tally: in your browser, sixty addresses per site, until you forget the site or remove the extension. Never sent anywhere.
• Synced site lists, for connected browsers: until you disconnect the browser, delete the site, or delete your account.
• Sealed views and notes, if you switched syncing on: until a browser of yours removes them, you remove the stored copy, or you delete your account. We cannot read them at any point.
• A view you shared: until you stop sharing it or delete your account. Anybody who installed it keeps their own copy, which is theirs.
• Account data: until you ask us to delete it, or 24 months after your last sign-in.
• Request logs: not stored by us. They pass through our hosting provider’s log stream and we neither export nor keep them.
• Security log entries — the IP address and user-agent described above: 180 days, after which they are deleted automatically. Deleting your account removes yours immediately, including the ones that name a hostname, without waiting for the window to pass. What survives is a single line recording that an account was deleted, filed under a one-way digest of the address rather than the address itself — enough for us to confirm we did it if you ask, and not enough to identify you if you do not.
• Payment records: as long as tax and accounting law requires.

Your rights

You may ask us for a copy of any personal data we hold about you, ask us to correct it, ask us to delete it, or ask for it in a portable format. Email privacy@pilos.net and we will respond within 30 days.

Most of it you can do yourself and immediately: disconnect a browser from the panel, delete a site from the dashboard, or remove the extension.

If you are in the European Economic Area or the UK

Under the GDPR you have the rights of access, rectification, erasure, restriction, portability and objection, and you may withdraw consent at any time. We process personal data on two bases: contractual necessity — running your account, your subscription and the features you asked for — and legitimate interest, namely keeping the service available and preventing abuse. If you think we have not dealt with your concern properly, you may complain to your local data protection authority.

If you are in California

Under the CCPA you have the right to know what we have collected, the right to have it deleted, and the right not to be discriminated against for asking. We do not sell personal information, so there is nothing to opt out of.

Children

Pilos is not intended for anyone under 16, and we do not knowingly collect data from children. If you believe we have, email privacy@pilos.net and we will delete it.

Changes to this policy

If we change what Pilos collects, we will update this page and change the date at the top before the change ships — not after. Material changes will also be announced on the website.

Contact

Questions about any of this: privacy@pilos.net.