Privacy

What we collect, why, who else touches it, and how to get it back or get it gone.

Updated

This policy covers the helmsman.sh website, the waitlist, your Helmsman account, and the Helmsman macOS app. It is written in plain language. Helmsman is an independent project, and its operator is the data controller for the personal data described here. Questions go to hello@helmsman.sh.

The short version

  • We collect only what we need to run the waitlist, your account, and billing.
  • Helmsman is local-first: your code, prompts, and terminal output run on your Mac and do not pass through a Helmsman server.
  • In the bring-your-own-key lane, your prompts go to Anthropic under your own key to answer each request. See Bring your own key below.
  • We do not sell or share your personal data, and we run no ad tracking.
  • This site uses strictly-necessary cookies only, so there is no cookie banner.

What we collect

The data we hold depends on how you use Helmsman.

  • Waitlist. The email address you submit, plus a timestamp. Stored lowercased in a deduplicated set.
  • Account. Your name, email address, and password. The password is stored only as a salted hash, never in readable form. You may optionally add a short bio.
  • Bring your own key (BYOK). If you choose the BYOK lane, your Anthropic API key. We keep it encrypted and use it only to make requests to Anthropic on your behalf. The key is a credential - it is not your code or your prompts, which stay local as described below - and you can remove it at any time.
  • Billing. If you subscribe to Pro, our payment provider collects and processes your payment details. We do not see or store full card numbers. We keep a record that you are a paying customer and your subscription status.
  • Technical and security data. Minimal server logs and short-lived per-IP rate-limit counters used to keep the site and forms working and to block abuse. The site uses cookieless, aggregate web analytics (Vercel Web Analytics): page views and referrers with a visitor hash that resets every day. It also collects anonymous page-speed measurements (Vercel Speed Insights) so we can see where the site loads slowly. No advertising trackers, no cross-site tracking, no analytics cookies.
  • Anonymous launch analytics. On by default in the desktop app - two small anonymous pings so we can tell whether the launch works. See anonymous launch analytics below.
  • Optional usage telemetry. Only if you switch it on in the app - see usage telemetry below. Off by default.

Optional usage telemetry (off by default)

The desktop app has a telemetry toggle in Settings. It is off by default, and with it off the app makes zero telemetry network calls - every feature keeps working. If you opt in, the app sends us one small summary per day, tied to your account, containing exactly six signals:

  • how many agent sessions you spawned that day;
  • your peak number of concurrent sessions;
  • total session hours;
  • usage counters for four app features (caffeinate, the Source Control panel, Fleet MCP, and the prompt enhancer);
  • your Claude spend for the day, in total and split per model;
  • the app version and platform.

Never included: your prompts, agent output, file paths, project names, or any machine identifier. The server rejects any submission that carries more than these six signals. Legal basis: your consent, which you withdraw by turning the toggle off - sending stops immediately. Snapshots are kept for 180 days and then deleted, and they are erased together with your account if you delete it.

Anonymous launch analytics (on by default)

The desktop app sends us two small pings so we can tell whether the launch works: one when the app starts, and one the first time you spawn a session. Each ping carries exactly four fields:

  • event, which of the two pings this is;
  • install_id, a random token generated on your Mac at first launch. It is tied to no account, and it is never derived from your hardware;
  • app_version, for example 0.9.0;
  • os_major, your macOS major version only, for example macOS 15. The patch number never leaves your Mac.

That is the whole payload. It never carries prompts, agent output, file paths, project names, or any content, and our server rejects any submission with more than these four fields. The install id is not joinable to a user account in our data model. We never store your IP address with these pings. Rows older than 400 days are deleted.

Turn it off in the app under Settings, "Send anonymous launch analytics"; with it off the app sends nothing. To erase what has been sent, use "Delete my analytics" next to it, or email the id shown there to hello@helmsman.sh.

Check us: start Helmsman from a terminal with HELMSMAN_TELEMETRY_DEBUG=1 and the app prints every ping it would send, and sends none of them.

The app shows this notice once, on first launch.

Under the GDPR we need a lawful basis for each use. Ours are straightforward:

  • To run your account and provide the app - basis: performance of our contract with you.
  • To take payment and manage your subscription - basis: performance of our contract, and compliance with tax and accounting law.
  • To email you about beta access after you join the waitlist - basis: your consent, which you can withdraw at any time.
  • To secure the service and prevent abuse - basis: our legitimate interest in keeping Helmsman safe and available.
  • To measure whether the public launch works - basis: our legitimate interest in understanding adoption of the app we ship; object by turning the toggle off.

Bring your own key, and Anthropic as your own provider

Helmsman drives your own Claude Code and your own model access. How your prompts travel depends on the lane you pick:

  • Local Claude Code. When Helmsman spawns your local claude binary, your prompts and code context go straight from your Mac to Anthropic through that session, exactly as they would if you ran claude in your own terminal. They do not pass through a Helmsman server.
  • BYOK. When you use your own Anthropic API key, your prompts and the surrounding code context, together with that key, are sent to Anthropic to fulfil each request. Anthropic processes that data as an independent provider under its own terms.

In both lanes Anthropic acts as your own model provider for the content you send to its models, under your own key or session - not as a Helmsman sub-processor, and that content does not pass through a Helmsman server. Anthropic states that, by default, it does not use commercial API inputs or outputs to train its models. Your use of Anthropic is governed by Anthropic's own agreements:

Who else processes your data

We keep the list of third parties short, and we use each only to run the service. The providers that may handle your data are:

  • Vercel - hosts this site and runs the signup and account endpoints.
  • Upstash - stores the waitlist (a managed Redis store).
  • Neon - the managed Postgres database for your account.
  • Resend - sends our transactional email (verification, sign-in codes, password reset, and beta invites).
  • Cloudflare - serves the gated app download (R2 storage) and, where enabled, bot protection (Turnstile); it processes the requesting IP address for these.
  • A Merchant-of-Record payment provider (for example, Paddle) - takes payment, handles tax, and acts as the seller of record for Pro.
  • Anthropic - receives the model content you send under your own key or session; it is your own provider, not a Helmsman sub-processor (see above).

We do not sell or share your personal data with anyone for their own marketing, and we do not build advertising profiles. If our list of providers changes, we will update this page.

How long we keep it

  • Waitlist email - until you receive your beta invite, or until you ask us to remove it.
  • Account data - for as long as your account is open. When you delete your account, we delete it, except where law requires us to keep records.
  • BYOK key - until you remove it or close your account.
  • Billing records - kept as long as tax and accounting law require.
  • Security logs and rate-limit counters - short-lived: rate-limit counters within minutes to hours, and minimal server logs within days.

International data transfers

Some of our providers process data outside your country, including in the United States. Where personal data leaves the European Economic Area or the UK, we rely on the approved transfer mechanism for your region, such as the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum for UK data, and, where a provider is certified, the EU-US Data Privacy Framework (and its UK extension). You can request a copy of the relevant safeguards by emailing hello@helmsman.sh. Wherever you live, we remain responsible for the personal data we pass to these providers. Anthropic's transfer terms are covered by its DPA.

Your rights

Depending on where you live, you have rights over your personal data, including under the GDPR and the CCPA. These include the right to:

  • Access a copy of the data we hold about you.
  • Correct data that is wrong or out of date.
  • Delete your data (sometimes called the right to be forgotten).
  • Export your data in a portable form.
  • Object to processing we base on legitimate interest, including security and anti-abuse.
  • Restrict how we process your data while a question about it is being resolved.
  • Opt out of any sale or sharing of personal data - note that we do neither.
  • Withdraw consent at any time, where we rely on consent.

To exercise any of these, email hello@helmsman.sh. We will not charge you or treat you differently for asking. You also have the right to complain to the privacy regulator where you live. In the EEA that is your local Data Protection Authority (in the Netherlands, the Autoriteit Persoonsgegevens); in the UK, the Information Commissioner's Office (ICO).

If there is a data breach

If a breach affects your personal data, we will act quickly to contain it. Where the law requires, we will notify the relevant supervisory authority without undue delay, and we will tell affected users without undue delay when the breach is likely to put your rights at risk.

Children

Helmsman is not directed to children. We do not knowingly collect personal data from anyone under 18, and if we learn that we have, we will delete it.

Cookies

This site sets strictly-necessary cookies only - the kind needed to keep you signed in and to keep the forms secure. We set no analytics, advertising, or cross-site tracking cookies, so there is no cookie banner to click through.

Changes

If our practices change, we will update this page and move the "last updated" date above. Significant changes that affect you will be flagged clearly.

Contact

Questions, requests, or concerns about your data? Email hello@helmsman.sh and a person will reply.