Privacy Policy

1. Who We Are

HELM is a market-analysis research platform for cryptocurrency perpetual futures. References to “HELM”, “we”, “us”, or “our” in this policy refer to the operators of this platform. If you have questions about this policy, contact us at the address listed in Section 7.

2. What We Collect

We collect only what is necessary to provide and improve the service:

• Account data: your email address and a bcrypt hash of your password. We never store your password in plaintext.
• Usage analytics: anonymised event names (e.g. page views, feature interactions) to understand how the platform is used. No personal identifiers are attached to these events.
• Server logs: IP-address hashes (not plaintext IPs), request timestamps, and HTTP status codes for rate-limiting, fraud prevention, and debugging purposes. Hashed IPs cannot be reversed to identify you.
• Session data: a signed JWT stored as an HTTP-only, Secure, SameSite=Strict cookie named helm_session. This cookie is used solely to authenticate your requests and expires after 30 days.

We do not collect payment information during the private beta. We do not collect trading account credentials, positions, or portfolio data from any exchange.

3. Cookies and Session Tokens

HELM sets one cookie: helm_session. It is an HTTP-only cookie, meaning it is inaccessible to JavaScript, and is marked Secure so it is only transmitted over HTTPS. It contains a signed JWT that identifies your account session. No third-party advertising or tracking cookies are set by HELM.

If you enable browser push notifications, your browser's Notification API stores permission state locally. We record your preference in localStorage on your device only; this is not transmitted to our servers.

4. How We Use Your Data

We use your data only for:

• Authenticating your account and maintaining your session.
• Sending transactional communications (e.g. password-reset requests) if you request them.
• Aggregated, anonymised product analytics to improve HELM features.
• Rate-limiting and abuse prevention using hashed IP identifiers.

We do not use your data for targeted advertising, and we do not build individual profiles for sale.

5. Data Sharing

We do not sell your personal data. We do not share your email address or any personally identifiable information with third parties for marketing purposes.

We may share data with service providers who assist in operating HELM (such as hosting infrastructure), under strict data-processing agreements that prohibit independent use of your data. We may also disclose information if required by applicable law or to protect the security and integrity of the platform.

6. Data Retention

Account data is retained for the duration of your account. Server logs are rotated after 30 days. If you request deletion of your account, we will remove your email and password hash within 14 days. Anonymised analytics events, which contain no personal identifiers, may be retained indefinitely.

7. Your Rights and Deletion Requests

You have the right to request access to, correction of, or deletion of the personal data we hold about you. To exercise these rights, contact us at support@helm.trade. We will respond within 30 days.

To delete your account and associated data, email us with the subject line “Delete my account” from the address linked to your HELM account. We will confirm deletion within 14 days.

8. Security

Passwords are hashed using bcrypt before storage. Sessions are signed with a server-held secret and transmitted only over HTTPS. We perform periodic reviews of access controls and dependency security. No system is fully immune to attack; we encourage you to use a strong, unique password.

9. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the “Last updated” date at the top of this page. Continued use of HELM after a change constitutes acceptance of the revised policy.