Extension Privacy Policy

OutreachPilot connects your social media accounts (LinkedIn, Reddit, and Twitter/X) to your OutreachPilot workspace. It enables the platform to detect buying signals, send outreach messages, execute approved actions (connection requests, replies, DMs), and display an in-page widget for quick actions while browsing social platforms. All actions are initiated by you or explicitly approved before execution.

• Session cookies— When you click "Connect," the extension reads your platform session cookie (e.g., LinkedIn's li_at, Twitter's ct0). This cookie is transmitted once to our server and is never stored in the extension.
• Link token — A temporary, cryptographically random token (256-bit) that identifies your workspace. It expires automatically after 24 hours.
• Workspace info — Your organization name and platform configuration, used solely to personalize the extension popup.
• Page context — On social platform pages, the extension reads limited page context (e.g., profile names, post content) to power signal detection and the in-page action widget. This data is processed in real-time and not stored or transmitted unless you initiate an action.

• We do not collect your passwords.
• We do not track your general browsing history or activity outside supported platforms.
• We do not collect analytics, telemetry, or usage metrics from the extension.
• We do not sell, share, or transfer any data to third parties.
• We do not run any background data collection — the extension only activates on supported platform pages.

Session cookies are used exclusively to authenticate API requests to LinkedIn, Reddit, and Twitter/X on your behalf — for example, sending connection requests, posting replies to buying signals, reading message threads, or scanning posts for signal detection. All actions are either directly initiated by you or explicitly approved before execution.

• Session credentials are encrypted at rest in our database with row-level security.
• Link tokens are cryptographically generated (256-bit) and expire after 24 hours.
• All data transmission uses HTTPS/TLS encryption.
• The extension stores only non-sensitive identifiers locally (workspace name, connection status).

Generated from the extension's own manifest (version 2.6.5) so this list cannot drift from what is actually shipped.

• cookies — Reads your session cookies for LinkedIn, X (Twitter), and Reddit (e.g. li_at, ct0/auth_token, reddit_session) to detect that you're logged in and to authenticate the actions you take through OutreachPilot.
• storage — Stores your connection status, link token, and extension settings locally in your browser.
• tabs — Reads basic information about your LinkedIn, X, and Reddit tabs (URL, load state) and opens platform pages such as login and setup when needed.
• alarms — Schedules periodic background checks — for example, refreshing proxy health and connection status, and polling for queued actions — while your browser is open.
• scripting — Injects OutreachPilot's widget and request interceptor into LinkedIn, X and Reddit pages you visit.
• webRequest — Observes network requests on those sites to capture actions you take — for example, confirming that a connection request or reply was actually sent.
• webNavigation — Detects page navigation on LinkedIn, X, and Reddit (including in-page/SPA navigation) so the widget and OutreachPilot stay in sync with the page you are viewing.
• proxy — Routes some LinkedIn/X/Reddit requests through OutreachPilot's proxy — a residential IP assigned by our servers to your account — using a PAC script. Everything else you browse goes direct and is unaffected.
• declarativeNetRequest — Applies request rules to LinkedIn/X/Reddit traffic — for example, a consistent per-account browser identifier (User-Agent) — as directed by OutreachPilot's servers.
• host_permissions — Scoped only to https://*.linkedin.com/*, https://*.reddit.com/*, https://*.twitter.com/*, https://*.x.com/*, https://useoutreachpilot.com/*, https://*.useoutreachpilot.com/*, http://localhost/*, http://127.0.0.1/*. No access to any other websites.

The following optional permissions are not requested at install — Chrome only prompts for them, by name, if you turn on a specific feature that needs them:

• privacy — Optional, off by default. If you grant it, blocks WebRTC from leaking your real IP address while OutreachPilot's proxy is active.
• browsingData — Optional, off by default. If you grant it, clears cached site data (local storage, IndexedDB, cache) for a platform when switching between accounts on a proxied connection, so data does not bleed between accounts.
• webRequestAuthProvider — Optional, off by default. If you grant it, lets the extension silently supply your assigned proxy credentials when the browser asks for authentication, so you do not see a login prompt.

• content-dashboard.js runs on https://useoutreachpilot.com/*, https://*.useoutreachpilot.com/*, http://localhost/*, http://127.0.0.1/*.
• content-widget.js runs on https://*.linkedin.com/*, https://*.twitter.com/*, https://*.x.com/*, https://*.reddit.com/*, https://old.reddit.com/*, https://chat.reddit.com/* (never on login/logout/authentication URLs on those sites).
• route-interceptor.js runs on https://*.linkedin.com/*, https://*.twitter.com/*, https://*.x.com/*, https://*.reddit.com/*, https://old.reddit.com/* (never on login/logout/authentication URLs on those sites) — runs in the page's own JavaScript context at document_start, before the page's own scripts, so it can observe the page's network and navigation calls.

• Disconnect anytime— Click "Disconnect" in the extension or remove the account in your OutreachPilot settings.
• Delete your data — Contact us at support@useoutreachpilot.com to request full data deletion.
• Uninstall — Removing the extension immediately stops all data collection and widget injection. Existing server-side connections remain active until manually disconnected in your dashboard.

Questions about this policy or the extension? Reach us at support@useoutreachpilot.com