Privacy Notice

Last updated: October 1, 2026. This notice applies to the DRUGPilot website.

Sign-in and account information

When you sign in with Google, we receive your Google account identifier, email address, and basic profile information through Supabase. We use this information to create and identify your account, maintain your session, manage access, and provide the service. We do not receive your Google password or request access to Gmail, Google Drive, or your contacts.

Usage records

Cloudflare Turnstile checks email registration and password sign-in forms for automated abuse. Cloudflare processes browser and connection signals for this security check; Supabase validates the resulting verification token. Our API request limits use temporary pseudonymous counters in server memory. These counters are not included in visitor analytics.

We count entries to the home page and workspace, including signed-out and repeat visits, and clicks on the three run actions. We record the event type, time, a random identifier for that event, and an estimated connection country. Country lookup runs on our server using a local database; analytics does not store full IP addresses, use tracking cookies, or create persistent visitor identifiers. A temporary request-rate counter is kept in server memory. Aggregate traffic statistics are available only to administrators.

We store your account role, enabled status, usage limits, recent activity, and model token usage to provide the service and enforce usage limits. Token usage records do not contain the full text of analysis requests or responses. Records from the retired question-and-answer feature may remain in storage; its conversation interface and APIs are no longer available.

Data processing and access

Supabase provides authentication and FDA document storage. Railway hosts the website and stores account and usage data. When you use AI analysis or comparison, the necessary drug or FDA document content is sent to OpenAI for processing. Infrastructure providers may retain connection and error logs needed to operate their services.

Members can access only their own usage. Administrators can view member accounts, online status, usage, and settings changes across the service. Operators with host or database administration privileges may be able to access stored historical data.

Your choices and contact information

You can sign out and revoke access to this service in your Google account settings. Revoking Google access does not automatically delete your DRUGPilot account or existing records. To request access to, correction of, or deletion of your account or other data, contact jht12020304@gmail.com. We will need to verify your identity before processing your request.

Please avoid including information that identifies patients or other individuals in your searches or analysis requests.