Helmsay – Privacy Policy
Last updated: 2026-10-02
Effective: 2026-10-02
Helmsay ("the app" and its server) reads out alerts from your Cursor cloud agents and lets you answer them by voice. Please also read the Terms of Service.
Helmsay is an independent app and is not affiliated with, endorsed by, or sponsored by Anysphere, Inc. Cursor is a trademark of Anysphere, Inc.
Who we are
Helmsay is operated by <OWNER FULL NAME - TODO>, an individual developer in <STATE/COUNTRY - TODO>. Privacy contact: benellison1988@gmail.com.
What we collect and why
- Account details. To use the app you create an account with an email address, a username and a password. We store the email and username, and only a salted hash of the password (never the password itself). We also store when you accepted the Terms and Privacy Policy and the minimum age (16) you confirmed, whether your email is verified, your role (user or admin), and when the account was created and last used.
- Emails we send. We email you a one-time 6-digit code to verify your address or reset your password. Emails are sent through our email provider (see below).
- Sign-in sessions. When you sign in, the server issues an access token and a refresh token. Only hashes of these tokens are stored on the server; on your phone they are kept in Android's encrypted storage. You can end one session (log out) or all sessions (log out of all devices).
- Your Cursor API key (optional). If you connect Cursor in Settings, you paste your own Cursor API key. We validate it with a harmless read-only call to Cursor, then store it encrypted on our server and use it only to act on your own agents on your behalf. It is never shown again (only its last 4 characters) and you can replace or remove it at any time.
- Alert content. When one of your automations sends an alert (project name, task/agent id, status, an error message and answer choices), our server stores it under your account and forwards it to your devices so it can be shown and read aloud. Alert text can contain whatever your automation sends. Do not send passwords, API keys or other secrets in alerts. Alert text may appear on your lock screen.
- Your replies and instructions. The command you choose (proceed, retry, hold, or a route) and any instruction you type or dictate are sent to our server and passed to the Cursor Cloud Agents API using your key. Replies to the built-in test alert are not sent to Cursor.
- Usage records. Each instruction you send from the app is recorded under your account with its Cursor run id, the time, the agent and project it went to, how long the text was and the token counts Cursor reports for that run (never the text itself). They power the Usage screen and the "Estimate" shown before you send. We do not record or invent dollar amounts. For billing and plan usage, see your Cursor dashboard.
- Quick unlock. If you set up a PIN or fingerprint/face unlock, the PIN is stored only on your phone as a salted, slow hash in Android's hardware-backed encrypted storage and is never sent to us. Fingerprint and face data stay with Android and are never available to the app.
- Ideas form. If you submit an idea on our website, we store its text and the optional name and email you typed, together with the time and a purge date. Please don't include passwords, API keys or personal data in an idea.
- Device identifier / FCM token and Firebase installation ID. To deliver push notifications the app registers a Firebase Cloud Messaging token (and an optional device label) under your account; Firebase also creates an installation ID on your phone. When you log out or delete your account the token is deleted from our server and the app deletes the token and the Firebase installation ID on the device, so the next person who signs in on that phone does not receive your alerts.
- Microphone and speech. The microphone is used only when you start voice input (to answer an alert or dictate an instruction), after an in-app disclosure you accept. Speech is converted to text by the speech recognizer built into your Android device (provided by Google or your device maker); the app does not record or store audio.
- Captcha. At sign-up and on the ideas form we load Cloudflare Turnstile to tell people from bots. Cloudflare receives technical signals such as your IP address and browser details to do this.
- Technical logs. The server and our hosting provider keep operational logs (time, request path, status, IP address, user agent) for security and debugging. Passwords, tokens, cookies, codes and API keys are never written to our logs.
- Settings on your device (server address, theme, preferences, your safety acknowledgement) stay on your device.
If an older version stored a Cursor sign-in cookie on your phone, the update deletes it.
Who we share data with (processors)
- Google (Firebase Cloud Messaging) – push delivery and the installation ID; alert text passes through it. Privacy policy.
- Resend – email delivery (your address and the one-time code message). Privacy policy.
- Cloudflare – Turnstile bot protection and network services (IP address, user agent). Privacy policy.
- Render – hosting and database, United States. Privacy policy.
- Cursor / Anysphere – only at your direction, with your own API key, and independent of us: your instructions and command choices go to the Cursor Cloud Agents API and agent output is fetched from it. Privacy policy.
- Your device's speech recognizer (Google or your device maker) – processes voice input. Google privacy policy.
We do not sell or share personal information and do not use it for advertising, and the app contains no ads and no analytics or crash-reporting SDKs. One account can never see another account's alerts, projects, devices or agents.
Legal bases (EU/UK)
- Performance of a contract: your account, alerts, replies and key storage.
- Legitimate interests: security logs, rate limiting, Turnstile, abuse prevention and the ideas form.
- Legal obligations: where the law requires us to keep or disclose something.
Your rights
You can ask for access, rectification, erasure, restriction, objection and portability of your personal data, withdraw consent where we rely on it, and complain to a supervisory authority. To exercise a right email benellison1988@gmail.com or use Settings → Account → Delete my account in the app. We respond within one month.
International transfers
Our servers and processors are in the United States. Our processors rely on the EU-US, UK-US and Swiss-US Data Privacy Framework and/or Standard Contractual Clauses for transfers.
California and other US states
We do not sell or share personal information and do not use it for advertising. You may request access to or deletion of your personal information by email to benellison1988@gmail.com.
Retention
| Data | Kept for |
|---|---|
| Server logs (including IP address) | 30 days |
| Alerts and usage records | 90 days (or until you delete them or your account) |
| Ideas | 365 days |
| Unverified accounts | 24 hours |
| Emailed codes | 15 minutes |
| Sign-in sessions | 30 days of inactivity (30 minutes if you turn off "Keep me signed in") |
| Backups | <BACKUP PERIOD - TODO> |
| Firebase installation IDs | Deleted at logout or account deletion |
Your account, projects and devices are kept until you delete them or your account.
Deleting your data
In the app: Settings → Account → Delete my account. This permanently deletes your account and everything stored under it on our server (alerts, projects and their keys, devices, sessions, usage records and your stored Cursor key) and clears the app's local data, including the push token and Firebase installation ID. You can also delete only this device's registration and alert history with Settings → Privacy → Delete my device and data. Without the app, see /delete-data or email us.
Security
All traffic uses HTTPS. Passwords are hashed with a modern password hash; API keys and callback tokens are stored encrypted; session and project tokens are stored only as hashes. Login attempts are rate-limited. No method of transmission or storage is perfectly secure.
Safety notice
Do not use Helmsay while driving unless you are using it fully hands-free and it is legal for you to do so where you are. Never hold, touch or look at your phone while driving. Some places ban even hands-free use for some drivers (for example new or teen drivers). You are responsible for obeying the law and driving safely. Alerts can show on your lock screen.
Age
Helmsay is for people aged 16 or older. We do not knowingly collect data from younger people; if we learn we have, we delete it.
Changes and contact
We will update this page when practices change and revise the dates above. Questions: benellison1988@gmail.com.