Privacy Policy

1. Introduction

Pilgrim, Inc. ("the Company," "we," "us," or "our") operates the website gopilgrim.org and the Pilgrim research assistant platform (collectively, the "Service"). Pilgrim builds AI tools for researchers, policy analysts, investigative journalists, and other knowledge workers: we collect source documents you upload, the annotations you attach to them, and the synthesis outputs our platform generates so you can move from reading to a grounded first draft without losing the thread of your sources. This Privacy Policy explains what information we collect in the course of providing that service, how we use it, and the choices you have. It applies to information we collect through gopilgrim.org and through direct communications with us.

We are based at 3150 18th Street, Suite 300, San Francisco, CA 94110, and can be reached at [email protected].

2. Information We Collect

2.1 Information You Provide

We collect information you submit directly, including:

• Account credentials (email address, chosen password) when you register for the Service;
• Contact details (name, email, phone) when you fill out a contact form or request support;
• Source documents, PDFs, URLs, and other research materials you upload or add to Pilgrim projects;
• Annotations, highlights, notes, and comments you create within those projects;
• Synthesis prompts and the draft outputs the platform returns to you;
• Payment information, processed by our payment processor and not stored on our servers in raw form;
• The content of any messages you send us directly.

2.2 Information Collected Automatically

When you visit gopilgrim.org or use the Service, we automatically collect limited technical information:

• IP address and approximate location (city/region level);
• Browser type, operating system, device class;
• Pages visited, features used, referring URLs, time on page;
• Cookie and similar identifiers (see Section 5 and our Cookie Policy).

2.3 We Do Not Knowingly Collect Children's Data

The Service is not directed to children under 13. We do not knowingly collect personal information from children. If you believe a child has provided us information, contact [email protected] and we will delete it.

3. How We Use Information

Pilgrim's core function is processing the source documents, annotations, and synthesis requests you submit in order to generate meeting summaries, action item lists, and draft outputs within your research workspace. We use information we collect to:

• Operate and deliver the research assistant platform, including source collection, annotation storage, and synthesis generation;
• Maintain, improve, and develop the Service, including training internal quality systems on aggregated, de-identified usage patterns (never on your individual source documents without explicit written consent);
• Respond to support inquiries and provide requested information;
• Send service-related communications (account confirmations, billing notices, feature updates) and, with your consent where required, marketing communications;
• Detect, investigate, and prevent fraud or misuse of the Service;
• Comply with legal obligations.

We do not use the content of your uploaded source documents, annotations, or draft outputs to train Pilgrim's language models without your explicit written consent. Operational processing (running synthesis, storing your workspace state) is not model training and is necessary to provide the Service you subscribed for.

We do not sell personal information for monetary value. Where applicable state law treats certain advertising arrangements as a "sale" or "share," see the California section below.

4. Sharing of Information

We share personal information only with:

• Service providers acting on our behalf (including cloud hosting infrastructure, email delivery, and self-hosted usage analytics) under contractual confidentiality terms that restrict their use to the service they provide us;
• Payment processors, who handle billing data under their own PCI-compliant security programs;
• Authorities, when required by applicable law or to protect rights, safety, or property;
• A successor entity in the event of a merger, acquisition, or asset sale, subject to this Policy and notice to affected users.

We do not sell personal information to third parties. We do not share source documents or research workspace content with any third party other than the infrastructure providers necessary to store and process them on your behalf.

5. Cookies and Tracking

We use cookies and similar technologies to operate the Service, remember workspace preferences, and measure feature usage. We do not use third-party advertising cookies. For details and choices, see our Cookie Policy.

6. Data Retention

We retain your account information and workspace content as long as your account remains active or as needed to provide the Service. If you close your account, we delete your source documents, annotations, and synthesis outputs within 60 days, except where retention is required by applicable law or to resolve a dispute. Inactive marketing-list contacts are purged after 24 months. Server access logs are retained 90 days, then aggregated and anonymized.

7. Security

We use administrative, technical, and physical safeguards designed to protect your information, including TLS encryption in transit for all data moving between your browser and our servers, at-rest encryption for stored source documents and workspace content, restricted-access databases, and least-privilege access controls for internal staff. No system is perfectly secure; we cannot guarantee absolute security and encourage you to use a strong, unique password for your Pilgrim account.

8. Your General Rights

Depending on your jurisdiction, you may have rights including access, correction, deletion, and the ability to limit certain processing of your personal information. To make a request, email [email protected] with the subject line "Privacy Request." We will respond within the timeframe required by applicable law.

9. California Residents (CCPA / CPRA)

Under the California Consumer Privacy Act ("CCPA") and the California Privacy Rights Act ("CPRA"), California residents have specific rights regarding personal information collected about them. This section supplements the rest of the Policy.

9.1 Categories We Collect

In the past 12 months, we have collected the following categories of personal information defined under Cal. Civ. Code §1798.140: identifiers (name, email address, IP address); account credentials; commercial information (subscription tier, billing records, service inquiries); internet and network activity (feature usage within the Pilgrim workspace, pages visited on gopilgrim.org); the content of source documents, annotations, and synthesis drafts you submit (treated as research workspace content you control); and inferences drawn from usage patterns for service-improvement purposes. Because Pilgrim's workspace may contain documents you upload on sensitive research topics, we treat the substance of uploaded source materials as confidential workspace content and do not use it for advertising or secondary commercial purposes.

9.2 Sources, Purposes, Disclosure

We obtain this information directly from you and through automatic instrumentation of the Service. We use it to operate the research platform, process your source documents and generate synthesis outputs, communicate with you about your account, and meet legal obligations. We disclose it only to service providers under written contracts that restrict their use, and to legal authorities where required.

9.3 Your CCPA / CPRA Rights

• Right to Know: request the categories and specific pieces of personal information we have collected about you in the past 12 months.
• Right to Delete: request deletion of personal information we collected from you, subject to legal exceptions.
• Right to Correct: request correction of inaccurate personal information.
• Right to Opt Out of Sale or Sharing: we do not sell personal information; we do not "share" it for cross-context behavioral advertising as defined under CPRA.
• Right to Limit Use of Sensitive PI: we do not use sensitive personal information for purposes beyond those permitted without authorization under CPRA.
• Right to Non-Discrimination: we will not deny services, charge different prices, or provide a different level of service because you exercised a right.

9.4 How to Exercise

Submit a verifiable request by emailing [email protected] with the subject line "California Privacy Request." Include enough detail for us to verify you are the person whose information is the subject of the request. We respond within 45 days, with a possible 45-day extension for which we will notify you.

9.5 Authorized Agents

You may designate an authorized agent to make a request on your behalf. The agent must provide proof of authorization; we may also require you to verify your identity directly.

9.6 "Shine the Light"

California Civil Code §1798.83 entitles California residents to request information regarding our disclosure of personal information to third parties for direct marketing. We do not disclose personal information for third-party direct marketing.

9.7 Do Not Track and Global Privacy Control

Under the California Online Privacy Protection Act (Cal. Bus. & Prof. Code §22575), we disclose how we respond to "Do Not Track" (DNT) browser signals. Because there is no common industry standard for interpreting DNT signals, we do not currently respond differently to them. We do not authorize third parties to collect personally identifiable information about your activity across different websites when you use the Service. We honor an opt-out preference signal sent by a platform or browser that complies with the CPRA, such as the Global Privacy Control (GPC); when we detect a GPC signal, we treat it as a valid request to opt out of the sale or sharing of personal information for that browser or device.

10. Changes to This Policy

We may update this Policy from time to time. Material changes will be reflected by a new "Last updated" date and, where appropriate, a notice within the Service or by email to your registered address.

11. Contact

Questions, requests, or complaints can be sent to: