Privacy & connections

The authentication website

This website serves app information, Apple's app association file and a sign-in return page. It does not accept passwords, store API keys or exchange authorization codes. Its pages include no analytics scripts or third-party embedded resources.

Cloudflare hosts this website and operates the Cloudflare sign-in and authorization service. A sign-in return page removes its query parameters from browser history if the browser reaches that page. HTTPS callback handling and token exchange happen in the initiating native app.

Your device and workspace

SitePilot stores connected-account credentials in the device's Keychain. Its local workspace stores website files, revisions, connection metadata and usage records. API keys and OAuth tokens are not included in the workspace JSON or website exports.

Cloudflare and AI providers

Cloudflare authorization lets you select the accounts SitePilot may access. Publishing uploads the selected website files to Cloudflare. DNS operations use the permissions granted to your connection.

When you request AI changes, SitePilot sends your brief and selected content to the provider you connect. That provider processes the request under its own policies. Provider usage figures may be stored in your local workspace to display consumption.

Manage your connections

Use Connections in the app to disconnect a provider. You can also review and revoke SitePilot's Cloudflare authorization in your Cloudflare profile under Manage OAuth authorizations.