Legal

Privacy Policy

Exactly what we collect, who we share it with, and how to turn any of it off.

Effective July 2026·v4.0

01Overview

This policy covers the Google Apps Script Copilot Chrome extension, the gscopilot.com / home.gscopilot.com website, and our backend services. We do not sell your data. We never read the contents of your Apps Script code or your AI chat messages for any purpose other than generating the response you asked for.

02Account information we collect

When you create an account we collect your name, email address, and authentication identifiers. Accounts are stored and authenticated through PocketBase, our backend user-management system, hosted on infrastructure we control. If you sign in with Google, we receive your Google account's name, email, and profile picture from Google's OAuth flow — we do not receive your Google password.

03Billing information

Payments and subscriptions are processed by LemonSqueezy, our merchant of record. When you subscribe or make a purchase, LemonSqueezy collects your payment details (card number, billing address) directly — we never see or store your full card number. We receive your subscription status, plan tier, and order history from LemonSqueezy so we can grant access to paid features. See LemonSqueezy's privacy policy at lemonsqueezy.com/privacy.

04Your prompts and code — how they're handled

This depends on which mode you use. On the default Cloud/Free plan, when you send a prompt or select code for the AI to work on, that content is sent from your browser to our own backend (a Cloudflare Worker at ai.gscopilot.com), which forwards it to the underlying AI model provider to generate a response, then returns the result to you. Your prompts and code do pass through our infrastructure in this mode — we do not permanently store the body of your prompts or generated code, and we do not use them to train any model. On the Lifetime + BYOK plan, when you connect your own API key, your prompt and code are relayed from our Worker directly to the AI provider you configured, using your key — we do not retain the content beyond what's needed to complete that single request.

05Which AI providers may process your content

Depending on your plan and model selection, your prompts/code may be processed by one or more of: OpenAI, Anthropic, Google (Gemini), OpenRouter, Fireworks AI, DeepSeek, Mistral (Codestral), Together AI, or DeepInfra — or, for BYOK users, any OpenAI-compatible provider you configure, including local runtimes like Ollama or LM Studio that never leave your machine. For AI-powered search features, we may also send limited query data to search providers such as Jina AI. Each provider processes this data under its own terms.

06Product analytics — PostHog

We use PostHog, a third-party analytics provider, to understand how the extension is used and to fix bugs — for example, which features you open, onboarding progress, and plan/credit status. This data is sent from your browser through PostHog's reverse proxy at t.gscopilot.com. We do not send the contents of your prompts, your code, your files, or your billing details to PostHog — the authentication, billing, and chat/prompt areas of the product are explicitly excluded from analytics capture.

07Session replay

Our codebase includes a session-replay capability (built on PostHog) that can record a visual, masked reconstruction of on-screen activity, intended to help us diagnose UI bugs that are hard to reproduce from a bug report alone. This capability is currently disabled — it is not active in any released version of the extension. If we ever enable it in the future, it will only ever apply to Google Apps Script Copilot's own extension windows (never the Google Apps Script editor page itself), will mask all text and form input before anything is recorded, will fully exclude sensitive areas such as billing, authentication, and chat/prompt content, and we will update this policy and the extension's in-product settings before it goes live.

08Error tracking — Sentry

We use Sentry to automatically capture crash reports and error diagnostics — stack traces, the extension version, and the general error message — so we can fix bugs. This is limited to technical diagnostic data; Sentry does not receive your prompts, code, or account credentials.

09Editor account detection

If you connect Google services (Sheets, Docs, Gmail, Drive, Calendar, etc.) through Google Apps Script Copilot's MCP integrations, the extension detects which Google account is currently signed in on the script.google.com tab you have open, by reading the account indicator already shown in Google's own editor UI — we do not read your document content or any other page data to do this. That detected email address is sent to our backend as a request header so we can warn you, via an in-product banner, if the Google account open in your editor doesn't match the account your MCP connections are using. This detection only runs on script.google.com and is used solely for this account-mismatch check.

10Inline code suggestions

As you type in the Apps Script editor, Google Apps Script Copilot's inline-suggestion feature sends the surrounding code context to our backend to generate ghost-text completions and predicted next edits. This is core to the product's function — the code you're actively editing is processed to generate the suggestion and is not retained beyond serving that request.

11Tool and diagnostic logs

When the AI agent uses tools — for example, to read a file or run a lint check — we log coarse, truncated diagnostic information (which tool ran, whether it succeeded, and timing) to help us improve reliability. These logs are truncated and do not contain full file contents or prompt text.

12Cloud infrastructure

Google Apps Script Copilot's backend runs on Cloudflare Workers, with Cloudflare D1 (database), Cloudflare KV (caching), and Cloudflare Vectorize (semantic search) used to operate the service. Cloudflare processes this data solely as our infrastructure provider.

13MCP / tool connectors — Composio

When you connect third-party tools or Google services through Google Apps Script Copilot's MCP integrations, the connection is brokered through Composio, a third-party MCP infrastructure provider. Composio facilitates the OAuth connection and tool calls between Google Apps Script Copilot and the services you connect; it does not receive your Apps Script code or chat content beyond what a specific tool call requires to execute.

14Cookies & local storage

We use local storage (in your browser and in the extension) to remember your theme, your last-active tab, and your authentication session. We do not use third-party advertising cookies and we do not share data with ad networks.

15BYOK & your keys

On the Lifetime + BYOK plan, your third-party API key is stored encrypted in your browser's local storage. We never receive it, log it, or forward it anywhere except the AI provider you connected it to, for the sole purpose of fulfilling your request.

16Data retention

Account and billing records are retained while your account is active, and for up to 30 days after deletion in case you change your mind. After 30 days, account data is permanently purged. We do not retain prompt or code content beyond the time needed to generate a response.

17How to opt out

Product analytics can be disabled for your account at any time by emailing support@gscopilot.com. Session replay is currently disabled entirely across the product, as described above. If we introduce in-product analytics controls, we'll update this section to point to them directly.

18Your rights

You can export, modify, or delete your account data at any time from the dashboard. EU and California residents have additional rights under GDPR/CCPA — email support@gscopilot.com to exercise them.

19Children's privacy

Google Apps Script Copilot is not directed at children under 13, and we do not knowingly collect data from anyone under 13.

20Changes to this policy

If we change how we handle data in a material way, we'll notify registered users by email at least 14 days before the change takes effect, and update the "Effective" date above.

21Contact us about privacy

Questions or concerns? Email support@gscopilot.com — a real human reads each one.