Privacy Policy

Last updated: November 5, 2026

1. What HelmistAI is

HelmistAI is a desktop application (macOS) that transcribes your meetings locally, and generates AI answers using a language model. This policy explains what data is created, where it lives, and what reaches us.

2. Data that stays on your device (never sent to us)

• Meeting audio. Speech-to-text runs locally using Whisper. Audio is processed on your computer and is never uploaded to HelmistAI.
• Your skills. The context you write (profile, projects, STAR stories) is stored encrypted on your computer and is not uploaded to HelmistAI for storage. Relevant excerpts are included in the question sent to the AI model when you ask for an answer.
• Your session history. Past Assist sessions, transcripts, and answers are stored encrypted on your computer.

3. Data that is processed to generate answers

To produce an answer, the transcribed text of the recent conversation, your question, relevant excerpts from your active skills and, when a feature needs it, a capture of your screen are sent to an AI model through HelmistAI's servers:

• Transcript and skill excerpts: sent to our model provider to generate the answer. HelmistAI's servers pass the request through and do not store its content. We keep only usage counts (see section 4). The model provider processes the request under its own terms and privacy policy.
• Screen captures: taken only when you use a screen-aware feature, including auto-answer, which can look at your screen when a heard question refers to it. You can stop auto-answer from using your screen, or turn off screen reading, in Settings. Only the capture needed for that request is sent, and it is not saved by HelmistAI.

4. Account and service data we store

If you create an account (Google sign-in), we store:

• Your Google account email and a unique account identifier (no Google password, no access to your Google account content).
• Your plan and subscription status, matched to your account by the email you paid with.
• Usage counters needed to enforce plan limits: sessions per month, session length and the number of AI tokens used per session and per day. These contain no conversation content.
• Basic device details sent with requests: a random device identifier, operating system and app version, language and time zone.
• Your IP address, used by our hosting provider to work out your country for regional pricing and to detect VPNs and proxies, and kept in short-lived rate-limit and security logs.

5. Payments

Payments are processed by Polar (our merchant of record). We never see or store your card details. Polar processes your payment information under its own privacy policy and shares your name, email, and purchase status with us to activate your license.

6. What we never do

• We never sell your personal data.
• We do not use your meeting transcripts, skills, or session content to train AI models. Content sent to an AI provider to generate an answer is processed under that provider's own terms.
• We do not have access to your local files. They are stored on your device, encrypted with your operating system's secure storage where it is available; if it is not available, they are protected by file permissions only (Settings, Security shows which applies).
• We never show third-party ads.

7. Cookies and tracking

The HelmistAI website uses no advertising or cross-site tracking cookies. The website stores your light or dark theme choice in your browser. The desktop app has no analytics or telemetry and communicates with our API using tokens stored in your operating system's secure storage, not cookies.

8. Data sharing

We share data only with the processors required to run the service:

• Model providers (e.g., our LLM provider) — receive answer requests as described in §3.
• Polar — payment processing (§5).
• Cloud infrastructure (e.g., Cloudflare) — hosting, DNS, and DDoS protection for the API and website.
• Google — only for sign-in, receiving your email and basic profile.

We may disclose data if legally required, and will notify you when legally permitted.

9. Your rights

Depending on your jurisdiction (including GDPR in the EU and CCPA/CPRA in California), you can:

• Access the account data we hold about you.
• Export your data (session history can be exported from the app at any time).
• Delete your account and associated data in the app (Settings, Security, Delete account) or by emailing privacy@helmistai.com. If you have a paid plan, cancel it first, because deleting your account does not stop billing. Local data can be removed any time with Clear all local data in Settings.
• Object or restrict processing — since the sensitive content stays local, deleting your account removes everything associated with it on our side.

10. Security

• Tokens are stored in your operating system keychain and encrypted at rest.
• Skills and session history are stored encrypted on your device using your operating system's secure storage (Keychain on macOS) where available.
• All traffic between the app and our API uses TLS.
• Access tokens are short-lived and refresh tokens are rotated and stored only as hashes server-side.

11. Children

HelmistAI is not directed at children under 16, and we do not knowingly collect their data.

12. Changes to this policy

If we make material changes, we'll notify you in the app and update the date above. Continued use after that constitutes acceptance.

13. Contact