Privacy Policy

Last updated: November 2, 2026

1. What HelmistAI is

HelmistAI is a desktop application (macOS today, Windows in development) that transcribes your meetings and interviews locally, and generates AI answers using a language model. This policy explains what data is created, where it lives, and what reaches us.

2. Data that stays on your device (never sent to us)

• Meeting audio. Speech-to-text runs locally using Whisper. Audio is processed on your computer and is never uploaded to HelmistAI.
• Your knowledge packs. The context you write (profile, projects, STAR stories) is stored encrypted on your computer and is never uploaded.
• Your session history. Past Assist sessions, transcripts, and answers are stored encrypted on your computer.
• Your API keys. If you bring your own model key (Pro), it is encrypted with your operating system's keychain and used only from your device to call your chosen provider directly.

3. Data that is processed to generate answers

To produce an answer, the transcribed text of the conversation, your on-screen content (when you use screen-aware features), and relevant knowledge-pack content must be sent to an AI model:

• Built-in model (default): transcribed text is sent through HelmistAI's infrastructure to our model provider, used solely to generate your answer, and not retained by HelmistAI beyond what is needed to operate and secure the service.
• Bring your own key (Pro): requests go directly from your device to your chosen provider (OpenAI, Anthropic, OpenRouter, a local Ollama endpoint, etc.). HelmistAI servers are not in that path. That provider's own privacy policy then applies to the request.

Screen content is captured only when you use a screen-aware feature, and only the captured image/text needed for that request is processed.

4. Account data we store

If you create an account (Google sign-in), we store:

• Your Google account email and a unique account identifier (no Google password, no access to your Google account content).
• Your plan, license, and entitlement status.
• Aggregate usage counters (e.g., sessions this month) needed to enforce plan limits.
• Basic service logs (timestamps, request metadata) for security and troubleshooting.

5. Payments

Payments are processed by Lemon Squeezy (our merchant of record). We never see or store your card details. Lemon Squeezy processes your payment information under its own privacy policy and shares your name, email, and purchase status with us to activate your license.

6. What we never do

• We never sell your personal data.
• We never use your meeting transcripts, knowledge packs, or session content for training AI models — ours or anyone else's.
• We never read the contents of your encrypted local files; we can't — the encryption keys are derived on your device.
• We never show third-party ads.

7. Cookies and tracking

The HelmistAI website uses no advertising or cross-site tracking cookies. The web app may use a single login-session cookie which is required for authentication and is deleted when you sign out. The desktop app communicates with our API using tokens stored in your OS keychain, not cookies.

8. Data sharing

We share data only with the processors required to run the service:

• Model providers (e.g., our LLM provider) — receive answer requests as described in §3.
• Lemon Squeezy — payment processing (§5).
• Cloud infrastructure (e.g., Cloudflare) — hosting, DNS, and DDoS protection for the API and website.
• Google — only for sign-in, receiving your email and basic profile.

We may disclose data if legally required, and will notify you when legally permitted.

9. Your rights

Depending on your jurisdiction (including GDPR in the EU and CCPA/CPRA in California), you can:

• Access the account data we hold about you.
• Export your data (session history can be exported from the app at any time).
• Delete your account and associated data from Settings → Account → Delete account, or by emailing us. Local data is deleted by uninstalling the app (we'll tell you where the files live).
• Object or restrict processing — since the sensitive content stays local, deleting your account removes everything associated with it on our side.

10. Security

• Tokens are stored in your operating system keychain and encrypted at rest.
• Knowledge packs and session history are encrypted on your device with keys derived on your device.
• All traffic between the app and our API uses TLS.
• Access tokens are short-lived and refresh tokens are rotated and stored only as hashes server-side.

11. Children

HelmistAI is not directed at children under 16, and we do not knowingly collect their data.

12. Changes to this policy

If we make material changes, we'll notify you in the app and update the date above. Continued use after that constitutes acceptance.

13. Contact