Privacy

Privacy Policy

AFK Pilot passes messages between your VS Code agent and your browser. The design goal is that the content of those messages never touches our storage.

Effective 2026-08-31

What we store

We keep the minimum needed to run your account and your device links:

• Your account — your email and authentication identity, held by Clerk, our sign-in provider.
• Device records — a device name you choose, a key identifier, and an HMAC used to verify a device on connect. We never store the device token secret itself.
• Cloud machine records — if you use a hosted cloud machine: its identifier and provider name, lifecycle timestamps, and the next wake time your host asks us to schedule (the time only — never the routine or its prompt). Your workspace, your files and your agent sign-ins live on that machine, not in our database. We can run commands on it because we operate it — that is how it is built, claimed and woken — so treat it as a machine we host for you rather than a private vault. Resetting, reclaiming or removing it destroys the disk.
• Billing state — your plan and subscription status live with Clerk and Stripe. We do not see or store your card details.
• A usage counter — on the free plan, one number per account: how many messages you have sent in the current weekly window. Not the messages, not their times, not their sizes — a single count, replaced each week.

What we do not store

We do not persist the content you send or receive. Prompts, code, files, and images are relayed in memory between your host — the VS Code or Cursor extension, Grok Build Desktop, or a cloud machine — and your browser, then dropped. There is no chat history on our servers, because there is no chat log on our servers. Videos are never transferred at all — images only.

Your host is a different matter, and the distinction matters most on a cloud machine: conversations, code and agent credentials live on that machine's own disk, the same way they live on your laptop. What this section promises is that none of it reaches our database.

One thing worth being precise about, since it happens on your own device rather than ours: if you send a message while the connection is down, your browser holds that unsent message in its own tab storage until it can be delivered, so a dropped signal or a reload doesn't lose what you typed. It never leaves your device until it is sent, it is cleared once delivered, and it is gone when you close the tab. Attachments and voice audio are never held this way. Nothing about this queue reaches our servers.

Transport and encryption

All traffic runs over TLS. AFK Pilot does not use end-to-end encryption: the relay is a trusted component that reads message envelopes to route them, so a message is briefly in plaintext in the relay's memory as it passes through. We state this plainly rather than imply a guarantee we do not provide. The relay is deliberately policy-free — it cannot drive host-local actions in your editor; capability gating stays on your machine.

A cloud machine is the exception, and it belongs here as much as in the FAQ: there the host runs on hardware we operate, so that separation is a policy we keep rather than a boundary you own.

Subprocessors

We rely on a small set of providers to operate the service:

• Clerk — authentication and billing management.
• Stripe — payment processing.
• Supabase — the device registry (device names and key identifiers).
• Railway — runs the relay itself. It carries your traffic in transit and never receives persisted message content.
• Fly.io (Sprites) — runs cloud machines, if you use one. The machine’s disk holds whatever you and your agents put on it: your workspace, your files, and the agent credentials you sign in with.

Data deletion

You can unlink a device at any time, which revokes it server-side. To delete your account, email [email protected]: we remove your account, its device records and its cloud-machine records, and destroy any cloud machine along with its disk. Because we never store message content, there is nothing further for us to purge.

Signing in sets a session cookie through Clerk, our sign-in provider. It keeps you signed in and is not used for advertising.

Who we are

AFK Pilot is operated by, and the data controller for the account data described above is:

HURYN Sp. z o.o.
Hoża 29, 00-521 Warsaw, Poland
Tax ID (NIP): PL7011027727
National Court Register (KRS): 0000893173

Contact

Questions about privacy? Reach us at [email protected].

The Product Compass · HURYN Sp. z o.o.