Privacy Policy

At a glance

helmora is a control surface for AI coding agents. The cloud services need account, device, routing, and operational metadata. Agent content is processed by your app, bridge, local agent runtime, and the model or service you invoke; the managed relay receives an endpoint-encrypted payload rather than protocol plaintext.

Voice dictation uses a separate path. Cloud transcription sends readable audio through helmora's voice service over TLS to an external transcription provider. Automatic fallback can send the same recording to more than one configured provider. This audio is not inside the encrypted agent-message envelope.

• The managed relay does not maintain repository or transcript history. Agent history and repository content are primarily held by your bridge, local runtime, and any provider you invoke.
• helmora does not train a model on your code, prompts, or outputs. Third-party model providers apply their own terms and data controls.
• We don't sell personal information. No advertising, no data brokers.
• Account controls depend on the release configuration. Contact support@helmora.io for export or deletion assistance during the private pre-alpha.

Scope & controller

This policy describes how helmora ("we," "us") intends to handle personal information when you visit the helmora marketing sandbox, use the web or iOS app, pair a bridge, or otherwise use the Service. The data controller is [Legal entity name and registered address — to be filled in by counsel].

Multi-user organization accounts are not part of the current pre-alpha offer. If organization features are introduced, the final policy and agreement must define controller and processor roles rather than inferring them from this draft.

Information we collect

Information you provide

Information collected automatically

Information from third parties

If you sign in through Google, GitHub, or Apple, the account service receives the profile and account-link data allowed by that sign-in scope. Model-provider and GitHub CLI credentials used by an agent remain on the bridge host; helmora's current PR-check surface asks the bridge's existing gh session for repository and check metadata, then returns that result to the paired app.

How we use it

We use personal information to:

• Provide, operate, and maintain the Service.
• Authenticate you and protect your account.
• Maintain subscription state and, only if a paid plan is later enabled, process billing under published terms.
• Communicate with you about changes, security issues, and your support requests.
• Diagnose problems, improve performance, and develop new features.
• Detect and prevent fraud, abuse, and security incidents.
• Comply with legal obligations.

We do not use your information for advertising, profiling for sale, or any purpose unrelated to operating the Service.

Legal basis (EEA/UK)

The controller, jurisdiction, approved terms, and data inventory are not final, so this placeholder does not establish helmora's legal bases under the GDPR. Counsel must map each verified purpose to an applicable basis before launch. Candidate categories may include:

• Contract — where processing is necessary to provide an agreed service.
• Legitimate interests — where verified security, abuse-prevention, or product purposes pass the required balancing test.
• Consent — for optional processing where valid consent is collected.
• Legal obligation — where an identified law requires processing.

Sharing & subprocessors

We share personal information only in these circumstances:

• Subprocessors — vendors that help us run the Service, under data-processing agreements.
• Model providers — when you invoke a third-party model, your prompt and necessary context are sent to that provider, governed by their terms.
• Code hosts & identity providers — only as needed to perform operations you initiate.
• Legal requests — when required by law, subpoena, or court order, after notifying you where legally permitted.
• Business transfers — in a merger, acquisition, or asset sale, with notice to you.

Draft vendor and data-flow inventory — not verified

This is a working inventory, not a final disclosure. Vendor usage, legal entity names, regions, transfer mechanisms, and data-processing terms must be verified before a canonical subprocessor list is published.

Optional voice transcription

You choose whether to use cloud voice. Before recording, the app asks you to agree to external transcription. You can choose Not now and keep typing. This choice is separate from your device's microphone permission and applies to chat and support-report dictation, including transcription through your own key or paired computer.

What is sent and why

Your recording is sent to produce text. In cloud modes, helmora's voice service receives readable audio over TLS and sends it to Groq or OpenAI, or through OpenRouter to Google. In paired-computer mode, audio travels to your computer through the paired connection, and the computer sends it to these configured providers. Voice audio is not encrypted from helmora's cloud transcription service. If fallback is enabled, the same recording may reach more than one of the named providers.

Provider processing and retention

• Groq: its published API policy does not use your data for training by default. Inputs and outputs may be retained for reliability or abuse investigations for up to 30 days, subject to legal exceptions, unless zero data retention is enabled. Usage metadata is retained. We have not verified a blanket zero-retention configuration for helmora's Groq account. Groq data controls.
• OpenAI: its API data policy excludes API data from training by default. Its audio-transcription endpoint lists no abuse-monitoring or application-state retention. Other endpoints and legal requirements may have different rules. OpenAI API data controls.
• OpenRouter and Google: the voice route allows only Google's Vertex endpoints, disables downstream fallback and requests zero data retention with data collection denied. If no compliant route is available, that attempt fails. OpenRouter can retain operational metadata and may process data for security or legal obligations. Routing controls and OpenRouter privacy policy.

Processing may occur in the United States or other countries, where different privacy laws and government-access rules apply. Your own provider account can have additional terms or settings. Avoid recording sensitive information you do not want these services to receive. helmora remains responsible for its handling of personal information and its choice of processors.

Your choice and withdrawal

Review or withdraw your choice in Settings → Voice & input. Withdrawal blocks new provider attempts and discards pending recordings in the app. It cannot recall audio already sent to a provider or remove text you already saved in a chat or report. Re-enabling voice starts a new consent revision; previously queued recordings remain invalid.

We record your account, decision, policy version, provider scope, revision and time so the same choice works across your devices. These receipts contain no audio or transcript, are included in account exports and are removed with account deletion. Voice operating records contain request and provider metadata rather than recording content. A material processing change or a new recipient requires a renewed choice.

Voice disclosure version: 2026-10-05.1. This section describes the consent implementation being verified for staging; production activation and the final legal policy remain closed.

Code & model training

helmora does not use your code, prompts, or outputs to train a helmora model. The agent runtime on your bridge sends the context required for a request to the provider you selected. helmora does not make a blanket promise about that provider's retention or training practices.

Your subscription, enterprise agreement, API key, local model, and provider settings determine the upstream terms and data controls. Review them before sending sensitive content.

Cookies & analytics

We use a small number of cookies and similar technologies:

• Strictly necessary — for authentication and security. These cannot be disabled.
• Device-local storage — to remember preferences and hold encrypted caches or transport state on your device.
• Error reporting — a shipped app build may send technical crash or error information to the configured error-reporting service. The final event inventory and opt-out requirements remain a launch gate.
• Marketing pageview counts — the marketing pages send a first-party, cookie-less beacon that increments an aggregate counter per day, page path, and referrer domain. No IP address, user agent, cookie, or per-visitor record is stored with it, and internal navigation is not attributed to a referrer.
• Product analytics — beyond the aggregate pageview counters above, no broader marketing or product-analytics program should be inferred from this draft. Any future vendor, event inventory, consent requirement, and opt-out control must be documented before launch.

We do not use advertising cookies and do not embed third-party trackers on our marketing pages.

Security

We protect personal information with technical and organizational measures appropriate to its sensitivity:

• TLS on public network paths; local bridge secrets and relay ratchet state are sealed at rest. Production database at-rest controls still require deployment evidence.
• Token-based authentication with rotation; secrets stored in a managed vault.
• Account- and device-scoped authorization at cloud boundaries.
• Automated test, dependency, and secret-scanning checks in the development workflow.
• Pre-release security reporting through the contact below. Independent penetration testing and a reviewed incident-response policy remain launch gates.

No system is perfectly secure. To report a vulnerability, please email security@helmora.io.

Retention & deletion

The final retention schedule has not been approved. Current implementation boundaries that counsel and operations must turn into a documented schedule are:

• Account data — retained while the account is active. Closure and deletion are manual in pre-alpha; no 30-day deletion commitment has been operationally validated.
• Session content — agent history and repository content are primarily held by the user's bridge and agent provider. The managed relay forwards encrypted payloads in memory rather than maintaining a message-history store.
• Cloud metadata and logs — account/device/agent metadata, notification records, subscription state, and operational logs may be retained. Exact periods and deletion jobs must be documented before launch.
• Legal records — billing, fraud, security, and compliance records may need longer retention where applicable law requires it; the controlling jurisdiction is still unset.

Account settings currently do not provide export or account deletion. During the approved pre-alpha, contact support@helmora.io for a manual request. Do not advertise automated fulfillment or a fixed response schedule until the workflow is implemented and reviewed.

Your rights

Depending on where you live, you may have the right to:

• Access the personal information we hold about you.
• Correct inaccurate or incomplete information.
• Delete your information ("right to erasure").
• Restrict or object to certain processing.
• Receive your information in a portable format.
• Withdraw consent where processing is based on consent.
• Lodge a complaint with your local data protection authority.

To exercise a right that applies to you, contact support@helmora.io. The final policy must state the verified controller, jurisdiction-specific process, identity-verification steps, and legally applicable response periods.

California residents (CCPA/CPRA)

California law may grant rights to know, delete, correct, and opt out of certain "sale" or "sharing" depending on helmora's final entity and applicability analysis. The current product does not sell personal information or use it for cross-context behavioral advertising; the final policy must state the verified scope and request process.

International transfers

The controller country and complete vendor-region inventory are not yet set. The current pre-alpha uses providers that may process data in other countries. Before launch, helmora must verify those locations and document any required transfer mechanism; this draft does not claim that Standard Contractual Clauses or another safeguard has already been executed.

Children

The Service is not directed to children under 16. If you believe a child has provided personal information, contact support@helmora.io; we will investigate and take the action required by applicable law and the verified deletion process.

Changes to this policy

This non-operative placeholder may change at any time. The final policy must define how material changes are communicated and when an updated policy takes effect. The "Last updated" date above reflects revisions to this draft only.

Contact

Questions, requests, or concerns about your privacy? Reach us at support@helmora.io. For security reports, please use security@helmora.io.

helmora — Privacy Office

[Legal entity name and registered address — to be filled in by counsel]
support@helmora.io