Our promise
BreachPilot exists to help operators assess systems they are allowed to test. The marketing site follows the same minimalism as the tool itself: it reads like a document because it is one. There is nothing to sign into, nothing to submit, and nothing watching you read.
If privacy-preserving measurement is ever added here, it will be documented on this page first: what it records, why, and how to opt out. Until then, assume the answer is nothing.
Stays in your browser
The only thing this site remembers is your theme choice, stored under a single browser key so the page does not flash the wrong color scheme on reload. It never leaves your device, it is never sent to a server, and clearing site data removes it completely.
- No cross-site cookies and no advertising identifiers of any kind.
- No forms, so nothing you type is transmitted anywhere.
- No local accounts or stored preferences beyond the theme toggle.
Network requests
Pages themselves are pre-rendered static files served from https://breachpilot.dev. Two kinds of follow-on requests can happen, both narrowly scoped and both optional to the reading experience.
Repository statistics
The homepage loads public repository statistics client-side. The request sets nothing, sends no identifier, and the page renders identically when it fails.
Installer downloads
Installers are plain static files with no telemetry and no phone-home. Downloading one tells us nothing about where it runs.
What we never do
- We never sell, share, or broker browsing data. There is none to share.
- We never fingerprint your browser or join your visit to another session.
- We never load third-party fonts, tag managers, or social widgets.
- We never see your assessment targets, findings, or reports. The tool itself runs locally, and this site could not observe it if it tried.
Questions
Anything here unclear or out of date? Open an issue in the repository, or see how to report a security concern. For the rules that govern the tool itself, start with the safety model.