Helmsay is a Windows desktop app for building VRChat and VTuber avatars from a description, photos, or video you have permission to use.
Contact support@helmsay.com.
Privacy Policy
Version 2026-10-15
TODO: [COMPANY LEGAL NAME] and TODO: [COUNTY] will be filled in before this draft is final.
DRAFT - pending attorney review
This policy describes what [COMPANY LEGAL NAME] ("Helmsay", "we") actually does with information today. It is a draft for attorney review. It covers the Helmsay desktop app, the server, and the website. Contact: [CONTACT EMAIL]. The company expects to be a Washington limited liability company.
Helmsay is a Windows desktop app for building VRChat and VTuber avatars. The public contact address is support@helmsay.com. [COMPANY LEGAL NAME], [COUNTY], and [CONTACT EMAIL] in this draft are TODO placeholders.
1. Accounts
When you create an account we store:
- your email address and username
- a password hash (argon2id for new passwords; an older bcrypt hash is checked and then replaced with argon2id when you sign in)
- whether your email is confirmed, and when
- the age confirmation (16 or older), the threshold you accepted, and the time
- the time you accepted the terms and the privacy policy
- a role (user or admin), whether the account is disabled, failed sign-in counts, and lock times
- created time, last sign-in, and password-change time
We do not store your password itself. Confirmation codes and password-reset codes are 6 digits, kept only as a hash, and they expire after 15 minutes. An account that never confirms its email is deleted after 24 hours. Sessions store only the sha256 of the access token and the refresh token. "Keep me signed in" lasts 30 days of inactivity. A session without that choice lasts 30 minutes. The desktop app keeps the tokens in the operating system's credential store, not in a settings file.
We do not write passwords, tokens, codes, emails, or password hashes to logs. Log lines pass through a redaction step first.
2. Policy acceptance records
For each acceptance we store the policy name, the version, a hash of the policy text, the time you accepted it, and the client type (desktop or web). We keep that history so we can tell which text you agreed to. When a policy version changes, we ask you to accept the new text before you continue.
3. Billing and Paddle
Paid plans are billed by Paddle, the merchant of record. You type card details into Paddle's checkout. Helmsay does not receive your full card number, card expiration, or card security code. Our server stores Paddle customer, subscription, transaction, and price identifiers, subscription status, period end times, and whether a charge was refunded. Webhook processing stores an event id so the same notice is not applied twice. Billing audit rows store an account id, a status, a tier, and a short detail code. They are not a copy of your card.
A free trial does not ask for a card. It stores that the account used its one trial.
4. Logs and redaction
The desktop app writes a rotating log on your computer under the local Helmsay logs folder. Before a line is written, the app redacts API keys and similar tokens, values assigned to secret fields, email addresses, password hashes, Paddle ids, and file paths under a Windows, macOS, or Linux home directory. Basic mode records warnings. Normal mode records info and warnings. Expert mode can raise the detail. On startup the app deletes managed log files older than 14 days, and if the folder is still over 100 MB it deletes the oldest backups until it is within 100 MB.
The server logs account and gallery actions as ids and action names. It does not log emails, passwords, tokens, or copyright-proof text. Server log lines go through the same kind of redaction.
5. Crash reports
Crash reports are optional and off until you opt in. The default is to ask you each time. The report dialog shows the exact text that would be sent, with paths, email addresses, keys, and tokens already removed. You can choose Send, Don't send, Always send, or Never ask. Never ask is the same as never send. A report can include the time, app version, Python and Qt versions, the operating system string, the GPU name and VRAM from your last local hardware scan, the project name and active step, the failure origin, the traceback, and the tail of the local log. The same redaction step runs on the whole report. File contents and the session token are not added. Nothing is sent unless you opt in (or you previously chose always send).
The server accepts a report only if it is at most 64 KB and the client address is under the rate limit (5 an hour). The address is used only for that in-memory counter. It is not stored. The server redacts the report again and refuses it if a secret or a home-directory path remains. Accepted reports are held in memory only, as the redacted text, the time, and the size. Reports that share a stack signature are stored once, with a count of how many times that signature arrived. An admin view lists the most common crashes. That list has the signature, the count, the time, the size, and a short title from the redacted text. It does not add an account id, an email, a client address, or a file path. Reports are not written to the database or to disk. A process restart drops them. At most the newest 200 distinct signatures stay in memory.
6. Cloud sync
Cloud sync is off until you turn it on and pick at least one group (avatar projects, settings, or keyboard shortcuts). The desktop encrypts what it uploads. The server stores the ciphertext and does not decrypt it. The account key is returned to your signed-in app and kept in the credential store. It is not written into the project. These stay on the computer: API keys, passwords, the session token, the refresh token, the device id, your email, and the plan token. Files whose names look like secrets are skipped. You can delete all cloud data for the account from the app. That delete removes the blobs, conflict copies, and the account key. Local projects stay on the computer. Sync is available only on plans that include it, and each plan has a storage cap.
7. Usage statistics
Anonymous usage statistics are off unless you opt in. After onboarding, a direct download asks once. You can change the choice later in Settings. Steam builds leave this off and do not ask; you can still opt in from Settings. Turning it off stops further sends.
If you opt in, the desktop app keeps coarse feature-usage counters on the computer (how many times a feature such as new project, pause, or help was used) and sends them as one batch, together with the app version and a random install id. The install id is not your email, username, account id, or device id. You can reset it. Resetting starts a new install id, and we cannot link the new one to the old one. You can view the exact text that would be sent before it goes out.
We do not send project content, file paths, emails, usernames, account ids, device ids, or anything else that identifies you. Legal documents stay in English; this policy is one of them.
The server accepts a batch only under a rate limit (10 an hour from one client address). The address is used only for that in-memory counter. It is not stored. The install id is checked and then dropped. Accepted batches are held in memory only as the counters, the app version, and the time. They are not written to the database or to disk, and they are not tied to an account. A process restart drops them.
8. Gallery
If you publish a gallery post we store the title, description, tool names and license notes you included, and one to four preview images. We do not store local paths or job ids. Images are checked from their bytes. We strip EXIF, XMP, IPTC, and comment metadata. A public post shows your username, not your email.
A copyright report stores the claimant's name, email, address, optional phone, a description of the work, the good-faith and accuracy statements, and any proof text the claimant sends. Those contact details are shown to admins, not on the public post, and they are not written to the log. The audit trail stores ids, actions, and a short detail code.
9. Diagnostics on your computer
Help > Diagnostics builds a health summary (Blender, Unity, GPU, server reachability, plan, app version, log detail). It does not include your email or username. Exporting a diagnostics zip writes a file you choose. That zip is not uploaded. Help > Report a bug can copy a sanitized summary onto your clipboard and open the bug forum in the browser. The forum is a separate site.
10. How long we keep information
- Unconfirmed accounts: deleted after 24 hours, along with their sessions, email codes, and acceptance rows.
- Email codes: until they are used or they expire (15 minutes).
- Sessions: until they expire or you sign out.
- Acceptance history: kept with the account so we can show what you accepted.
- Billing rows: kept while the account exists so we can tell whether a plan is active.
- Server crash reports: memory only, dropped on restart.
- Usage statistics: memory only on the server, dropped on restart. Nothing is sent unless you opt in.
- Local logs: about 14 days, and a 100 MB cap.
- Gallery posts: until you delete them, or longer if a report, the law, or a backup requires it.
- Cloud sync blobs: until you delete them or delete the account's cloud data.
11. Deletion and export
You can delete your own gallery posts in the app or on the website. You can delete cloud sync data from the app. You can delete local projects and logs on your computer without asking us.
You can ask us to delete your account or to export the account data we hold (profile, acceptance history, and billing identifiers we store). Email [CONTACT EMAIL] from the address on the account. We will not ask you to send your password. We may refuse a request we cannot verify, and we may keep information the law requires us to keep, such as records of a payment dispute. There is not a self-serve "delete my account" button yet. Counsel should confirm whether one is required before launch. Closing the account does not by itself delete files that remain on your computer.
12. Washington My Health My Data Act
Helmsay is an avatar tool. It is not a health-care service and it does not ask you for diagnoses, medications, reproductive or sexual-health information, or other consumer health data. Photos and videos you import are processed on your computer to build an avatar. We do not label them as health information and we do not use them to identify a health condition. Crash reports and sync payloads are not health records. This draft's position is that the Washington My Health My Data Act does not apply to the data Helmsay collects today. An attorney must confirm that, including whether any photo processing could be treated as biometric data. If a future feature collects consumer health data as that Act defines it, we will update this policy, ask for the consent the Act requires, and require you to accept the new version.
13. California privacy rights
If you are a California resident, the California Consumer Privacy Act, as amended by the CPRA, may give you the right to know, delete, and correct personal information, and to appeal a refusal. Email [CONTACT EMAIL]. We will verify the request. Helmsay does not sell personal information and does not share it for cross-context behavioral advertising. We do not use sensitive personal information to infer characteristics about you. We do not offer a financial incentive for your data. Categories we collect, when you use the service, are identifiers (email, username, account id), commercial information (Paddle plan status and ids, not the card number), internet activity limited to security logs, rate-limit counters, and, only if you opt in, anonymous feature-usage counters that are not tied to your account, and the content you choose to upload. We do not collect precise geolocation. The client address used for rate limits is not written into the account record.
14. Children
Helmsay is for people 16 and older. We do not knowingly collect personal information from anyone under 16. If you believe we have, email [CONTACT EMAIL] and we will delete the account.
15. Changes
If this policy's version changes, you must accept the new version before you continue, the same way as the terms. The acceptance record stores the new version, the content hash, the time, and whether you accepted it in the desktop app or on the website.
16. Contact
[COMPANY LEGAL NAME]
[COUNTY], Washington
[CONTACT EMAIL]