Privacy Policy

1 · The short version

Helmry runs on your computer. Your source code, your prompts, the agents' replies, your transcripts, your diffs and your commands never reach us. There is no server of ours that your work passes through, and we could not read your projects if we wanted to.

What does reach us is your account and your subscription: the email address you sign up with, the fact that an installation of yours is activated, and what the payment provider tells us about your plan. Sections 3 to 5 describe exactly that, and nothing else is collected — not by the app, and not by this website.

2 · The desktop app

The app stores everything it needs locally: configuration and its own state in your data directory (~/.helmry by default), agent conversations in Claude Code's own transcript files, and any credential you connect in a file readable only by your user account. None of it is transmitted to us. Its HTTP server listens on loopback only.

3 · Your account

Helmry requires a Helmry account, held by our service at auth.helmry.com. When you register we receive the email address you give and a password, which we store only as a one-way hash. We send a six-digit confirmation code to that address and keep only a digest of the code, for ten minutes. Signing in creates a session; we store a digest of the session token, never the token itself. Changing your address or resetting your password works the same way, by code.

The email address is the account. A code sent to it is how a forgotten password is reset. If you lose the mailbox and forget the password, the account cannot be recovered — the app says so before you create it.

4 · Activation and renewal

Signing in inside the app activates that installation. It sends us its install id — a random identifier the app generated on first run, derived from nothing about your hardware, your network or you — and the app version. What comes back is a signed statement of what your subscription entitles the installation to; the app verifies it locally and asks us nothing else.

• Renewal is automatic and runs about hourly while the app is open. Each renewal sends the install id, the app version, and a per-installation secret that identifies that installation and nothing else.
• An installation that cannot reach us keeps working for up to seven days, then asks you to connect once.
• We record which of your installations are activated and when each last renewed. That is the only per-machine fact we hold.

Who can see it on our side. Our support staff can view your email address, its verification state, your subscription state and your activation records — never a conversation, a file or a repository name, none of which we hold — through an internal console reachable only from our own addresses. Every support action is recorded against your account's internal identifier, not your address, and kept for two years.

5 · If you buy a subscription

Purchases are made through Creem (creem.io), acting as merchant of record: Creem is the seller of record for your purchase, issues your invoice, collects and remits applicable VAT or sales tax, and processes your card under its own privacy policy. We never see your card.

What reaches us is a notification: your email address, your plan, its status and paid-through date, and Creem's identifiers for your customer record and subscription. That is the entire record.

Confirmation and reset codes are delivered through Postmark (United States), acting as our processor. It receives the recipient address and the message; we send nothing you did not ask for.

6 · This website

No cookies are set, no consent banner is needed, and no third-party script runs on any page here — fonts and assets are served from the same origin. The web server keeps no access log at all — not even aggregate visit counts; only errors reach the system journal, and they carry no visitor identity.

Release notes are published on the changelog page and its RSS feed. Following a feed sends us nothing — there is no e-mail list to join.

7 · Anthropic and your model use

When an agent works, your machine talks to Anthropic through the Claude Code CLI, authenticated as you. What you send — prompts, file contents, command output — is governed by Anthropic's privacy policy and your agreement with them, not by this one. We are not a party to it and receive no copy.

8 · How long we keep things

• Account data: for as long as the account exists, then 30 days.
• Activation records (install id, last renewal, app version): 12 months after the installation last renewed, then deleted.
• Confirmation and reset codes: ten minutes, or until used.
• Server logs of our account service (IP address and time of a request; never a message or a code): 30 days.
• Payment notifications from Creem: 90 days, so a purchase that did not activate can be traced.
• The support action log: two years, by internal identifier only.
• Subscription and invoice records: held by Creem as the seller of record, for as long as tax law requires.
• Website visits: nothing is recorded, so there is nothing to retain. Support email: 12 months after the conversation ends.

9 · Your rights

You can ask for a copy of what we hold, correct it, or have it deleted. Deleting your account — from within your account, or by writing to us — deletes its sessions, codes, activation records and subscription record with it; your installations then stop renewing when their current entitlement expires. Write to support@helmry.com and we answer within 30 days.

Legal bases where the GDPR applies: performing our contract with you (the account, activation records and payment data) and our legitimate interest in a secure service (server logs). We do not sell or share personal information and do not process it for advertising. Data controller: the individual entrepreneur (фізична особа-підприємець) registered in Ukraine who operates Helmry, reachable at the address above. You may also complain to the supervisory authority of your country of residence.

10 · Where data lives, and how it is protected

Your account and activation records are held on a server in Helsinki, Finland (European Union), operated for us by Hetzner Online GmbH. Transactional email is processed by Postmark in the United States under Standard Contractual Clauses or the EU-US Data Privacy Framework, as applicable to its operator. Payment data is held by Creem as an independent controller. Your work never leaves your machine.

Connections to the account service are TLS only; passwords are stored as scrypt hashes; session and renewal secrets are stored as digests, so a copy of our database cannot be used to sign in or to renew an installation; entitlements are signed with a key that never leaves the server that holds it. The service contains no code that can reach a customer's machine. If a breach affecting your personal data ever occurs, we will notify the competent authority within 72 hours where the law requires it, and inform you without undue delay whenever it is likely to put you at high risk.

11 · Changes and contact

If this policy changes materially — in particular if the app ever starts sending something new — we will say so by email to your account address and in the app before the change ships, not after. Questions: support@helmry.com.