1
Protection Built Around Each User
Your data. Your encryption keys.
ModePilot uses unique per-user keys to encrypt retained calendar content and private content in new or updated activity, automation, and workday records. Protected content is tied to the user it belongs to, rather than relying on one shared data key for everyone.
Authenticated encryption helps protect both confidentiality and integrity: encrypted content is checked before it is used, and protected records are bound to their user and record context.
Encryption keys are protected separately from encrypted records. ModePilot's application services decrypt content when needed to run your enabled features—even while you are offline. This is server-side encryption, not end-to-end encryption.
Credentials protected before storage
OAuth access and refresh tokens, integration API keys, and Telegram bot credentials are encrypted before database storage. Browser connections use HTTPS, and supported provider connections use encrypted transport.
2
Less Data. Less Exposure.
A focused calendar mirror—not a complete copy
ModePilot retains a limited rolling range of calendar data and only the event fields needed for its calendar automation, calendar views, and time-tracking features.
The synchronized calendar mirror does not retain descriptions, locations, conference links, attachments, organizer or creator records, or other attendees' identities. Opaque identifiers replace raw Google calendar and event identifiers in the mirror.
Your calendar is not an advertising dataset
ModePilot does not sell or rent your personal data. Google calendar data is not used for advertising, sold to data brokers, or used to train general-purpose AI models. Calendar titles and connected-service content are not intentionally sent to website analytics.
3
Connected on Your Terms
You choose the connections and actions
You choose which accounts to connect and which automation features to enable. ModePilot uses official provider APIs to carry out those features, including Google Calendar scheduling and Slack status, presence, and Do Not Disturb updates.
Your existing events stay yours. ModePilot's scheduling features update, reschedule, or delete only events created by ModePilot—not events created by you or other applications. ModePilot checks its event-management markers before applying scheduling changes.
Authenticated access and user-scoped records work alongside encryption to separate users' information. Google calendar change notifications are validated before they can trigger synchronization, and processing is designed to handle retries safely.
Human access to connected Google data is restricted to support you request and permit, necessary security or abuse investigations, or legal requirements.
Control stays with you
You can disconnect integrations, revoke access with the original provider, manage desktop access tokens, or delete your ModePilot account through Profile Settings. You can also request access to, correction of, or an export of your personal data by contacting us.
The Privacy Policy explains deletion, retention, and how records already created in connected services remain under your control in those services.
4
Layered Infrastructure Safeguards
An independently certified hosting foundation
Our hosting provider maintains an ISO/IEC 27001:2022-certified information security management system covering its hosting services and data centres.
ModePilot adds application-level safeguards: per-user encryption, protected credentials, authenticated access, webhook validation, and content-minimized calendar synchronization diagnostics.
These layers are designed to reduce exposure and support dependable automation. No online service can guarantee complete security; protecting your connected accounts and devices remains important too.
5
Report a Security Concern
Help us keep ModePilot safe
Send security concerns to [email protected] with the subject 'Security report'. Include the affected page or feature, a description, and safe steps to reproduce the issue. Do not include passwords, access tokens, or another person's private data.
Please report issues privately. Do not access other users' accounts, extract their data, disrupt the service, or perform destructive testing. We will review reports and follow up as appropriate.