Privacy Policy

Effective 3 October 2026 · Last updated 20 October 2026

This policy explains what VersePilot collects, why, who else sees it, and what you can do about it. It is written to be read. If any part of it is unclear, tell us and we will rewrite it.

The short version

This section is a summary for convenience. The sections below it are the policy itself.

We store your email, your conversations, and any scripts you save or pin, so that VersePilot works and your history is there when you come back.
Your prompts and the code you paste are sent to Anthropic, the company whose AI model answers you. That is the core of the service and it cannot be switched off while still using VersePilot.
We do not sell your data, we do not use your conversations to train any AI model, and we do not show advertising.
Analytics are optional. We ask before loading them, and we do not record your screen or your prompts.
You can delete your account yourself, at any time, from the Account page. Everything of yours goes with it.

Who we are

VersePilot is operated by Paolo Douglas Escobar Guardado ("VersePilot", "we", "us"). We are the data controller for the personal data described in this policy.

You can reach us about anything in this policy, including access and deletion requests, at support@versepilot.dev.

VersePilot is an independent tool for Fortnite Creative and UEFN developers. We are not affiliated with, endorsed by, or connected to Epic Games, Inc.

What we collect

We collect only what the service needs to function. In practice that is five things.

Account details: Your email address, and a display name if you set one. If you sign in with Google, we receive your email address and basic profile information from Google, never your Google password.
Usage and billing records: How many tokens each message used and what it cost us to answer, your plan, and the identifier of your subscription at our payment provider. We never receive or store your card details.
Technical and security data: A one way hash of your IP address, kept briefly so we can enforce rate limits and stop abuse. We do not keep the IP address itself in that record. If the application crashes, our error monitoring receives a diagnostic report.
Reports you choose to send: If you report an answer as wrong, we store a separate copy of that answer and the prompt behind it, so we can investigate what went wrong. Because it is a copy, it survives you deleting the conversation, though not deleting your account.
The content you create: Your conversations and the messages in them, meaning both your prompts and VersePilot's answers, plus any script you save or pin to a project. These are saved automatically as you chat, because that is what lets your history still be there when you come back tomorrow. Images you attach are a deliberate exception: they are passed straight through to the AI model to answer that one message and are never stored on our servers, so only a short note saying an image was attached remains in your history.

We do not collect location data, contacts, browsing history on other sites, or any special category data such as health, biometrics, or political and religious views. Please do not put such information into a chat message. VersePilot is a code assistant and has no reason to receive it.

Why we use it, and our legal basis

If you are in the UK or the European Economic Area, the UK GDPR and EU GDPR require us to name a legal basis for each use. Ours are:

To provide the service (performance of a contract): Creating your account, answering your messages, keeping your conversation history, tracking your token allowance, and handling your subscription.
To keep the service secure and available (legitimate interests): Rate limiting, abuse prevention, spending limits, and error monitoring. Our interest is in running a service that is not degraded or bankrupted by misuse, and the impact on you is minimal because the data involved is technical and short lived.
To improve VersePilot (legitimate interests): Looking at aggregate usage, and at answers you have explicitly reported as wrong, so the tool gets better at UEFN and Verse. We do not read your conversations for any other reason.
Analytics (consent): Product analytics only load if you agree. You can change your mind at any time, and withdrawing is as easy as giving it.
To meet legal obligations: Tax and accounting records relating to payments, which are held primarily by our payment provider as merchant of record.

How your prompts reach an AI model

This is the part of the policy worth reading closely, because it is the part people most often assume rather than check.

To answer you, VersePilot sends the following to Anthropic, PBC, the provider of the Claude model that generates answers: your message, the recent messages in that conversation, any script you have pasted or pinned, any image you attached, and reference material we retrieve from our own UEFN knowledge base. This happens on every message. It is not optional, because it is the service.

Anthropic processes that content to generate the answer and return it to us. Anthropic does not use data submitted through its business API to train its models. Their handling of that data is governed by their own terms and privacy policy.

Practical advice: treat a VersePilot chat the way you would treat any cloud tool. It is a good place for your Verse scripts and your game logic. It is not a place to paste passwords, API keys, or anything you are contractually forbidden from sharing with a third party.

We do not use your conversations to train any AI model of our own, and we do not sell or share them with anyone beyond the processors named below.

Who else processes your data

We use a small number of service providers, each for one clearly defined job. They act on our instructions and may not use your data for their own purposes. All are located in, or transfer data to, the United States.

Anthropic, PBC (AI model provider, United States): Receives your prompts, conversation context, pasted or pinned scripts, attached images, and retrieved reference material, in order to generate answers. This is the sub-processor that sees the most of your content.
Supabase (database, authentication and backend hosting, United States): Stores your account, conversations, messages, saved scripts and usage records, and runs the server side functions that talk to Anthropic.
Cloudflare (website hosting and content delivery, United States): Serves the VersePilot web application. Receives standard request metadata such as your IP address and browser type.
Polar (payments, as merchant of record, United States): Handles checkout, subscriptions and invoicing, and is the seller of record for your purchase. You provide your payment details directly to Polar, and we never see or store them. Polar retains payment records as tax law requires.
Resend (transactional email, United States): Sends account emails such as email verification.
PostHog (product analytics, United States, only with your consent): Receives events describing which pages you visited and which actions you took, such as sending a message or starting a checkout, labelled with your account identifier. It never receives your name or your email address. Session replay is disabled, so it never receives your prompts, your code, or a recording of your screen.
Sentry (error monitoring, United States): Receives a diagnostic report when something breaks: the error, the page, technical context, and your account identifier so we can find and fix the problem on your account. It is not used to track you.

If we add or replace a sub-processor we will update this list before the change takes effect.

International transfers

Every provider above is based in the United States, so if you are in the UK or the EEA your data is transferred outside your country. Those transfers rely on the safeguards each provider offers, typically the European Commission's Standard Contractual Clauses and, where applicable, the EU to US and UK to US Data Privacy Framework.

How long we keep it

The guiding rule is that your content is yours. It stays until you remove it, and it goes when you go.

Conversations, messages, saved scripts and pinned scripts: Kept until you delete them individually, or until you delete your account. We do not expire them on a timer, because a script you wrote eight months ago is often exactly what you came back for.
Account details, usage records and subscription records: Kept for as long as your account exists.
Rate limit records (hashed IP): Deleted automatically every day.
Reported answers: Kept until your account is deleted. As explained above, a report is a copy, so deleting the original conversation does not remove it.
After you delete your account: Everything listed above is removed from our live systems immediately. Encrypted backups are cycled out within 30 days. Payment and invoice records held by Polar as merchant of record are kept by them for as long as tax law requires, and are outside our control.

Your rights, and how to use them

Depending on where you live, you have some or all of the following rights: to access a copy of your data, to correct it, to delete it, to receive it in a portable format, to object to or restrict certain processing, and to withdraw consent you previously gave.

Two of these you can exercise yourself, immediately, without asking us:

Deletion. The Account page has a Delete account button. It removes your account and everything attached to it. It is immediate and cannot be undone.
Analytics consent. You can change your choice at any time from the same page, or by declining the banner.

For anything else, such as a copy of your data, a correction, or an objection, email support@versepilot.dev from the address on your account and we will respond within 30 days.

We will never charge you for exercising a right, and we will never make the service worse for you because you did.

If you are in the UK or EEA and you think we have handled your data badly, you may complain to your national data protection authority. We would rather you told us first, at support@versepilot.dev, so we can fix it.

Cookies and analytics

We use two kinds of browser storage, and they are treated differently.

Strictly necessary, always on: Keeping you signed in, and remembering interface preferences such as your chosen response style. These cannot be turned off without breaking the product, and they do not track you across other websites.
Analytics, off until you say yes: We ask every visitor, not only those in Europe, before any analytics load. Decline and no analytics cookies are set and no events are sent. Session replay is disabled outright, so even with analytics enabled we never record your screen or your prompts.

Error monitoring runs regardless, because a crash report is how we find out the product is broken. It collects technical diagnostics, not behaviour.

Age

VersePilot is a professional development tool and is not directed at children. You must be at least 13 years old to create an account. If you are under 18, you may only use VersePilot with the involvement of a parent or guardian, and only they may make a purchase.

If we learn that we hold the data of a child under 13, we will delete it. If you believe a child has created an account, contact us at support@versepilot.dev.

Security

All traffic is encrypted in transit. Your data is isolated at the database level so that one account cannot read another's, and the keys that reach the AI provider live only on the server and are never exposed to your browser.

No service can promise perfect security. If a breach ever affects your personal data, we will tell you and the relevant regulator as the law requires.

Changes to this policy

If we change this policy in a way that materially affects you, we will tell you by email or in the application before it takes effect. Minor clarifications will simply be published here with an updated date at the top.

Home · Pricing