Privacy

Who this covers

This page explains how Cockpit ("we") handles personal data in the Cockpit web app at cockpitai.io and in its desktop and phone apps. It also covers the access-request form and the waitlist.

Cockpit is for professional developers. It is not for anyone under 18, and we do not knowingly collect data from children. If you think a child has given us data, write to us and we will delete it.

What we store

• Account. You sign in with Google or Apple through Clerk. Cockpit needs your name and email to open an account. Your data is filed under your Clerk user id.
• Access requests. The email, name, company and purpose you type on the request form, the time, and whether the request was approved or declined.
• Waitlist. What you give when you join the waitlist: your name, work email, the time you joined and which form you used, and, if you choose, your company, what you would connect first and a note. We also keep a scrambled code made from your network address, used only to spot abuse. We read the list ourselves to decide who to invite, and we email you to confirm you are on it and when your invitation is ready. The email goes through our mail provider (Resend), and we are notified of each signup at support@cockpitai.io. You can ask us to remove your details at any time by writing to support@cockpitai.io.
• Connections. For each tool you connect (Salesforce, MuleSoft, Slack, GitHub, Postman), the access token or key, and details such as the address of your Salesforce instance, the scopes granted and a label. Tokens, keys and any app secret you save are stored encrypted. The keys that unlock them are held in AWS KMS.
• Chats. Each chat thread and its messages: what you write, the Copilot's answers, and the tool requests and results kept with them. For long chats we also keep a short summary of the older messages. If you attach a connection to a chat, we keep which one, and a short description of it.
• Code the Copilot writes for you, when you ask for code.
• Runs, approvals and audit. Each message starts a run; we keep its steps. We keep every approval card, what it asked for, and whether you approved or denied it, plus an audit record of those decisions and of each change of Sandbox or Production mode.
• Usage. How many tokens each request used and what it cost, your monthly AI spend counters, and, if you use a Workstation, how long it ran.
• Phone. If you use the iPhone app, the push-notification token of your phone, its app version and bundle id, so we can tell you an approval is waiting.
• Workstation and runner. If you use them (they are not offered to every account), the machine record (name, size, state, region), runner tokens, one-time enrollment codes and task records.
• Consent. That you agreed to the AI provider, which version of the list you agreed to, when, and from which app.
• Team accounts. If your organisation uses a team account, the team and your role in it, which tools you may use, and a log of team administration (who was invited, joined, had access changed, or was removed). The Captain sees who did what, when, and on which tool. The Captain does not see your chat text.
• Short-lived operating data. A scrambled code made from the network address of a public form submission (request access or waitlist), kept one hour, to limit abuse. Server logs, kept 90 days in production.

We take no payments today, so we hold no card or bank details.

Error reports. When something breaks, the web app and the server can send an error report to Sentry. They are set up to leave out request bodies (which hold chat text), cookies, query strings, user details and local variables, and to scrub token-like text before anything is sent.

Where your data lives and who handles it

• Cockpit's server (the brain) runs on Amazon Web Services in the us-west-2 (Oregon) region.
• The production database is a Neon Postgres database in AWS us-west-2. A nightly encrypted backup goes to Cockpit's own AWS storage and is deleted after 30 days.
• Encryption keys for stored connections are held in AWS KMS in us-west-2.
• The web app is hosted on Vercel.
• Sign-in is handled by Clerk (with Google or Apple as the sign-in method). An invitation to join Cockpit is sent by Clerk or by our mail provider.
• Emails about the waitlist (the confirmation to you and the notice to us) are sent through Resend.
• Chat answers are written by Anthropic. See the next section.
• Error reports go to Sentry, as described above.
• The public pages (home, privacy, terms, support) load their fonts from Google Fonts, so Google sees the request for the font files.

Each tool you connect (Salesforce, MuleSoft, Slack, GitHub, Postman) also has its own terms and privacy policy. What Cockpit reads from and writes to them is governed by those too.

We do not sell your personal data.

The AI provider

Cockpit uses one AI provider: Anthropic, which makes Claude. There is no other.

To answer you, Cockpit sends Anthropic your messages, the conversation so far, and the results of the tools the Copilot reads for you. That can include the data a chat reads from your Salesforce, MuleSoft, Slack, GitHub or Postman. When you ask for code, the request and the context it needs are sent too.

Before results from Slack, GitHub and Postman go to the model, we replace token-like secrets in them (keys, tokens, passwords assigned to a secret-looking name) with a [REDACTED] marker. This is a pattern check and can miss a secret. It is not applied to what you type, or to results from Salesforce or MuleSoft.

You agree to this before your first chat. You can withdraw on the Account page at any time. Chat stops until you agree again, and your threads stay. If the provider list ever changes, we ask you to agree again.

What Anthropic does with data after it receives it is set by Anthropic's own terms and privacy policy, not by this page.

Cookies and trackers

We use the cookies Clerk sets to keep you signed in. We use no advertising or analytics trackers on the web app or on these pages.

The chat screen remembers in your own browser whether the side panels are open or closed. That stays on your device.

How long we keep it

• Chat history. Kept until you delete it or delete your account. We have no timer that removes old chats.
• A chat you delete is hidden at once. Its messages, plans, approvals, runs and stored code are removed for good after 30 days. Audit records of decisions stay until you delete your account.
• Account, connections, access request, waitlist entry and the rest of the list above: kept until you delete your account or ask us to remove them.
• Backups: deleted on a 30-day cycle, so removed data can sit in a backup for up to 30 days.
• Server logs: 90 days in production.

Delete your account

On the Account page, choose Delete account and type DELETE. It takes effect straight away and cannot be undone.

First, Cockpit asks each connected provider to revoke its access, where the provider allows it (Salesforce, Slack, GitHub, Google, and Apple if you signed in with Apple). MuleSoft and Postman keys cannot be revoked by us, so we delete our copy and you can rotate them in Anypoint and Postman.

Then we delete, in one step: your threads and messages, approvals and runs, stored code, connections and encrypted tokens, saved app secrets, usage and budget records, phone devices, Workstations and runners, Sandbox and Production mode settings and their log, AI consent, your trial record, your access request and waitlist entry, and audit records about you. Last, we delete your Clerk sign-in account.

We keep one record that an account was deleted. It carries no name, email or user id, only counts of rows and the result of each revocation. Backups expire on their normal 30-day cycle.

If the last step fails, your data is already gone and your sign-in remains. Try again; it is safe to repeat. If you are a member of a team, the Captain can also remove you; your data is then deleted after 30 days, or at once if the Captain chooses.

Your choices and requests

You can delete chats and your account in the app, and withdraw AI consent on the Account page. There is no download button for your data yet. To get a copy of what we hold about you, to correct it, or to have your waitlist or access-request entry removed, write to support@cockpitai.io from the address on your account. We send a copy of what we hold within 30 days of a request.

Changes to this page

When we change this page we change the date at the top. For a change that matters, such as a new AI provider, we tell you in the app and ask you to agree again before you chat.

Contact

Write to support@cockpitai.io. More help is on the support page. The rules for using Cockpit are in the terms.