Privacy Policy

Last updated: 5 October 2026

PrizePilot ("we", "our", or "us") is a Chrome browser extension and an iPhone companion app that help users discover, save, and enter online competitions. This Privacy Policy explains what user data the extension and the app collect, how that data is handled and used, where it is stored, when it is shared, how long it is retained, and the choices available to you. Where a section applies to only one of them, it says so.

1. Who We Are

PrizePilot is operated as an independent product. You can contact us at prizepilot@prizepilot.app with any privacy-related questions.

2. User Data We Collect

Depending on the features you use, PrizePilot collects or processes the following categories of data:

• Account and authentication data: email address, Supabase user ID, authentication and refresh tokens, account status, and password-reset requests. Passwords are handled by Supabase Auth and are not visible to PrizePilot.
• Chrome profile data (extension): where available, the ID and email address associated with the signed-in Chrome profile, provided by Chrome through the identity and identity.email permissions. The extension sends them when it sets up a guest account. PrizePilot no longer stores or uses them; IDs that earlier versions stored to reconnect guest accounts are no longer used, and you can ask us to delete them.
• Entry profile and settings: information you choose to enter, including title, name, email address, telephone number, postal address, country, date of birth, gender, friend names used for tagging, custom scan URLs, and extension preferences.
• Competition and browsing-related data: URLs and titles of competition pages you ask PrizePilot to scan or enter; visible page, form, and social-post text; form labels, options, and questions; detected entry requirements; scan results; recurring competition settings; and action outcomes.
• Saved competitions (iPhone app): links you share to PrizePilot from other apps, any text shared with them (for example a post caption), notes you add, the page title, the time you saved it, whether you have entered it, images you attach, and a preview image fetched from the link.
• Participation history: competition URL and title, entry timestamp, detected or completed actions, autofill counts, entry strategy, and related competition identifiers.
• AI data: content sent for an AI feature, such as competition or social-post text, page text, form labels and options, detected questions, competition URL/title, limited relevant profile context such as title or gender, configured tagging names, and AI-generated analyses, answers, checklists, or comments.
• Subscription and transaction data: plan, subscription status, trial and billing-period dates, credit balance and usage, Stripe customer/subscription identifiers, and transaction status. Complete payment-card details are collected and retained by Stripe, not PrizePilot.
• Optional OpenAI API key: Pro users may choose to provide their own key. The key is transmitted to our backend and stored encrypted; only its last four characters are used for display.
• Giveaway entries: if you enter a PrizePilot giveaway, the name and email address you give, your giveaway code, when you entered and confirmed, which PrizePilot account confirmed the entry, and a one-way hash of your IP address used only to limit repeated entries. They are used only to run that giveaway, as set out in its terms, and the names and email addresses of entrants who didn't win are deleted once the prize has been claimed.
• Technical and service data: timestamps, feature usage counters, error information, request status, and security or operational logs generated while providing and protecting the service.

3. How We Collect and Use User Data

Data is collected when you enter it in PrizePilot, sign in or subscribe, select a competition, start a scan or entry, use an AI feature, share a link or image to the PrizePilot iPhone app, or allow the extension to read your Chrome profile identity. PrizePilot uses this data only to provide and improve its single purpose of helping you find and enter competitions, including:

• creating and authenticating your account, reconnecting a guest account, and securing sessions;
• saving and synchronising your profile, settings, scans, recurring tasks, and participation history;
• saving competitions you share from your iPhone and showing them, with a preview, in the app and the extension;
• finding, filtering, and analysing competitions and their entry requirements;
• filling third-party competition forms with the profile values you have supplied;
• preparing requested social actions and suggested comments for your review;
• providing AI-assisted analysis, form interpretation, and answer suggestions;
• processing subscriptions, trials, credit purchases, and plan limits;
• providing support, diagnosing errors, preventing abuse, and maintaining service security; and
• complying with legal obligations and enforcing our Terms.

PrizePilot does not collect browsing history unrelated to the competition pages you ask it to process. It does not use user data for advertising, creditworthiness, or sale to data brokers.

4. How We Handle and Protect User Data

• Network requests to PrizePilot's backend and service providers use HTTPS encryption in transit.
• Cloud records are associated with an authenticated or guest user ID. Supabase row-level access controls are used to restrict user-scoped records.
• Authentication tokens are stored in local extension storage and used to authorise requests to PrizePilot's backend. On iPhone, the sign-in token is kept in the iOS Keychain and is not transferred to other devices through backups.
• Images uploaded from the iPhone app are stored in a storage location where each image can be opened by anyone who has its link. Links contain long random identifiers and are not published, but you should not attach images you would not want seen by someone who has the link.
• Link previews: the preview image shown for a saved link is fetched from that web page. A preview fetched from a link may be reused for other users who save the same link. Images you attach yourself are only ever shown with your own saved item.
• Optional user-provided OpenAI API keys are encrypted before database storage and are not placed in browser-synchronised settings.
• PrizePilot processes only the page content and profile fields needed for the feature you initiate. AI requests are routed through PrizePilot's backend so the platform API key is not exposed to the extension.
• Autofill places your chosen profile values into fields on the third-party competition page. Those values become available to that website and are subject to its privacy policy. You should review the form before submitting it.

No internet service can guarantee absolute security. If you believe your account or data may be at risk, contact us promptly.

5. Where User Data Is Stored

• On your device: settings, profile information, authentication session, cached scan results, local participation history, and operational state may be stored using chrome.storage.local or chrome.storage.sync.
• On your iPhone: saved competitions, attached images, link previews, and app settings are stored in the app's private storage, shared only with PrizePilot's own share extension. The sign-in token is stored in the iOS Keychain.
• Google Chrome Sync: data placed in chrome.storage.sync, including profile and settings data, may be synchronised by Google across browsers signed in to your Chrome account, subject to your Chrome Sync settings and Google's privacy terms.
• PrizePilot cloud storage: Supabase stores account/guest identity, profile and settings data, scan sources and results, recurring tasks, participation history, competitions saved from the iPhone app and their images, plan and AI-credit status, billing identifiers, and encrypted optional API keys.
• Service-provider systems: data sent to Stripe or OpenAI is processed on their systems as described below and under their respective privacy policies.

Data may be processed in countries other than your own. Where required, transfers are handled under the safeguards offered by the relevant service provider and applicable law.

6. When and With Whom We Share User Data

We do not sell or rent user data. We disclose data only as needed to provide a feature you request, operate the service, comply with law, or protect users and the service:

• Supabase: provides authentication, database, storage, and serverless backend services. It processes the account, profile/settings, competition, participation, usage, and subscription records described above. See the Supabase Privacy Policy.
• OpenAI: processes the AI request content described in Section 2 to return analyses, answers, and suggested comments. If you supply a personal OpenAI key, requests are still routed by PrizePilot but use that key. See the OpenAI Privacy Policy.
• Stripe: processes checkout and payment information and provides customer, subscription, invoice, and transaction status to PrizePilot. PrizePilot does not receive complete card details. See the Stripe Privacy Policy.
• Google: provides Chrome profile identity and may synchronise extension settings through Chrome Sync. See the Google Privacy Policy.
• Websites you save (iPhone app): to show a preview, your iPhone requests the page you saved, much as a browser would when opening it. That website receives an ordinary request from your device; PrizePilot sends it no other information about you.
• Competition websites and social networks: when you choose to fill a form or complete an entry action, the relevant profile values, form answers, comments, and actions are disclosed to that third party as necessary to carry out your request. Their own privacy policies apply.
• Legal and safety disclosures: we may disclose information if reasonably necessary to comply with law, legal process, or a valid governmental request, or to detect, prevent, or address fraud, security, or technical issues.
• Business transfers: if PrizePilot is involved in a merger, acquisition, financing, reorganisation, or sale of assets, user data may be transferred subject to this Policy and applicable law.

7. Chrome Web Store Limited Use Disclosure

PrizePilot's use and transfer of information received from Chrome APIs complies with the Chrome Web Store User Data Policy, including its Limited Use requirements. In particular:

• Chrome API data is used only to provide or improve PrizePilot's disclosed competition-assistance features.
• Chrome API data is transferred only when necessary to provide those features, for security, to comply with law, or as part of a permitted business transfer.
• Chrome API data is not used or transferred for personalised, retargeted, or interest-based advertising.
• Humans do not read Chrome API user data except with the user's specific consent for support, when necessary for security or legal compliance, or after the data has been aggregated and anonymised for internal operations.

8. Chrome Permissions We Use

• storage — to save your profile, history, and preferences locally on your device.
• tabs / scripting / webNavigation — to detect competition entry forms on pages you visit and auto-fill them on your request.
• notifications — to alert you when a scan finds new competitions (optional, browser-level permission).
• identity / identity.email — to read the Chrome profile's account ID and email when setting up a guest account (see Section 2).
• alarms — to schedule background scans at set intervals.
• contextMenus — to provide right-click actions on competition pages.
• host permissions (https://*/* and http://*/*) — required because competition forms are hosted on many unrelated domains and to inject the autofill script on competition websites you choose to enter.

PrizePilot uses these permissions only for the functionality described in this Policy. Facebook and supported competition-site content scripts may load on matching pages so that a user-initiated PrizePilot action has the required page context; they do not transmit unrelated browsing activity.

9. iPhone App

• The app does not track you across apps or websites, does not use advertising identifiers, and contains no advertising or analytics SDKs.
• The app does not access your contacts, location, camera, or photo library. Its share extension receives only the link, text, or image you choose to share to PrizePilot.
• The app signs in only to existing PrizePilot accounts; it does not create accounts.
• The app may refresh in the background, as allowed by iOS, to upload items you have saved.

10. Data Retention and Deletion

• Local extension data remains until you clear it, remove it through PrizePilot where that option is available, or uninstall the extension. Data managed by Chrome Sync may remain in your Google account according to your Chrome Sync settings.
• Cloud account, profile/settings, scan, recurring-task, participation, saved-competition, and AI-usage data is generally retained while your account remains active so the service and cross-device features continue to work.
• Removing a saved competition in the iPhone app removes it from that iPhone only; it stays in your account, and visible in the extension, until you delete your account. Saved items stored on your iPhone are removed when you delete the app, and signing in with a different account removes the previous account's saved items from the device. Signing out removes the sign-in token.
• An optional OpenAI API key is retained until you remove it, lose eligibility to use a personal key, or delete your account.
• Subscription and transaction records may be retained as needed for accounting, tax, fraud prevention, dispute resolution, and other legal obligations.
• Service and security logs are retained only as reasonably necessary for operation, diagnosis, abuse prevention, and legal compliance.

You may request deletion of your PrizePilot account and associated cloud data by emailing prizepilot@prizepilot.app. We will complete verified deletion requests within 30 days unless retention is required by law. Deleting PrizePilot data does not delete information you already submitted to a competition website, social network, Stripe, Google, or another third party; contact that provider directly.

11. Your Choices and Rights

You may edit your profile and preferences, clear local history, remove an optional API key, cancel a subscription, disable Chrome Sync, remove saved items from the iPhone app or sign out of it, or stop using and uninstall the extension or the app. Depending on where you live, you may also have the right to:

• Access the personal data we hold about you.
• Request correction or deletion of your data.
• Withdraw consent or object to processing at any time.
• Lodge a complaint with your local data protection authority.

To exercise any of these rights, email us at prizepilot@prizepilot.app.

12. Children

PrizePilot is not directed at children under 16. We do not knowingly collect data from children.

13. Changes to This Policy

We may update this policy from time to time. Material changes will be communicated via the extension, the app, or our website. The "Last updated" date at the top reflects the most recent revision.

14. Contact

For any privacy questions or data requests, contact us at prizepilot@prizepilot.app.