diff --git a/CHANGELOG.md b/CHANGELOG.md index 0a0d928..548738b 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -7,6 +7,12 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0 ## [Unreleased] +### Documentation + +- The public privacy policy now covers the iOS gateway, just-in-time media and + speech permissions, optional encrypted APNs relay, optional feedback, + third-party processors, retention, deletion, and user choices. + ## [0.0.16] - 2026-07-26 ### Added diff --git a/site/privacy.html b/site/privacy.html index fced99f..73ad937 100644 --- a/site/privacy.html +++ b/site/privacy.html @@ -3,18 +3,18 @@ - + - + - + 1Helm — Privacy Policy @@ -36,11 +36,11 @@

Privacy Policy

-

Effective date: July 24, 2026 · Contact: build@1helm.com

+

Effective date: July 26, 2026 · Contact: build@1helm.com

The short version

-

1Helm is self-hosted. Your workspace — messages, files, memory, threads, credentials, agents, and everything they produce — lives on your machine. We don't operate your installation, we can't see into it, and we don't receive its contents.

+

1Helm is self-hosted. Your workspace — messages, files, memory, threads, credentials, agents, and everything they produce — lives on your machine, under the control of you or your workspace operator. 1Helm does not centrally host or inspect that workspace. Limited information leaves it only when you use an external service described below, such as an AI provider, optional mobile notifications, or optional feedback.

This website

@@ -56,7 +56,30 @@

Email

Your self-hosted workspace

-

When your installation talks to AI model providers, the content you route to them is sent to those providers using your accounts, under their terms and privacy policies. You choose which providers to connect and what to send. Provider credentials are stored on your machine, in host-owned storage — they never pass through us.

+

Your workspace operator controls its accounts, storage, logs, retention, and network. When your installation talks to AI model providers or other services you connect, the content you route to them is sent using your accounts, under their terms and privacy policies. You choose which providers to connect and what to send. Provider credentials are stored on your workspace host, in host-owned storage — they do not pass through the 1Helm website or notification relay.

+
+
+

The mobile app

+

The mobile app is a client for an existing HTTPS 1Helm installation. The server address is stored on your device. Your username and password are sent directly to the server you choose over HTTPS to sign in; the app does not retain the password after that request. The resulting session is stored in the device-only iOS Keychain. Ordinary workspace content travels directly between the app and that server, subject to the workspace operator's practices.

+

Camera, photo-library, microphone, and speech-recognition access is requested only when you choose a feature that needs it, such as taking or attaching media or dictating a message. Selected media and dictated text may be sent to your chosen workspace. iOS and its speech-recognition services may also process those requests under Apple's privacy terms. 1Helm does not use these permissions for advertising or tracking.

+
+
+

Optional notifications

+

If you turn on mobile notifications, your installation registers an opaque recipient identifier and an Apple Push Notification service (APNs) device token with the 1Helm notification relay hosted on Cloudflare. Device tokens are encrypted at rest. The relay does not receive your username, password, or provider credentials.

+

To deliver an alert, the notification title and body — which can include a channel name, sender name, and message text — pass through the Cloudflare relay and Apple APNs. The relay forwards that content for delivery rather than storing the title or body in its notification database. It retains pseudonymous installation, recipient, token, and delivery-deduplication records needed to operate and secure the service. Turning notifications off inside 1Helm requests deletion of that device token; invalid APNs tokens are also removed. Apple processes notifications under its own privacy policy.

+
+
+

Optional feedback

+

If you deliberately send feedback from 1Helm, we receive the comment and any files you attach, together with a pseudonymous installation identifier and workspace name. Privacy-bounded diagnostics are included only if you check the diagnostics option; they contain app and runtime health information and exclude chats, prompts, terminal output, account content, credentials, keys, tokens, and OAuth data. We retain submitted feedback to respond, diagnose problems, and improve 1Helm. Email build@1helm.com to request deletion.

+
+
+

Use, sharing, and retention

+

We use the limited data described above only to provide, secure, support, and improve 1Helm. We do not sell it, use it for advertising, or track you across other companies' apps or websites. We share it only with service providers needed for the requested function — currently Cloudflare for website and notification-relay infrastructure, Apple for APNs and relevant iOS services, and GitHub for downloads — or when legally required.

+

Notification device records remain only while needed to keep the opt-in service working and are removed when disabled through 1Helm or when APNs reports the token invalid. Pseudonymous delivery records are kept as needed for reliable delivery, deduplication, abuse prevention, and security. Feedback is kept until it is no longer needed for support or product improvement, or until a valid deletion request can be fulfilled.

+
+
+

Your choices

+

You can use the mobile app without notifications, turn notifications off in 1Helm and iOS Settings, deny or revoke camera, photo, microphone, and speech permissions in iOS Settings, and choose not to send feedback or diagnostics. For questions, access, or deletion requests concerning data handled by the 1Helm website, notification relay, or feedback service, email build@1helm.com. For data held by a self-hosted workspace, contact that workspace's operator.

Changes & contact

diff --git a/test/site.mjs b/test/site.mjs index e80550d..3a31850 100644 --- a/test/site.mjs +++ b/test/site.mjs @@ -29,6 +29,11 @@ test("standalone 1helm.com website serves independent product and documentation assert.match(manual, /Do I really need a dedicated computer/); const privacy = await (await fetch(`${base}/privacy`)).text(); assert.match(privacy, /build@1helm\.com/); + assert.match(privacy, /device tokens are encrypted at rest/i); + assert.match(privacy, /notification title and body[\s\S]*Cloudflare relay and Apple APNs/i); + assert.match(privacy, /does not retain the password/i); + assert.match(privacy, /privacy-bounded diagnostics[\s\S]*exclude chats, prompts, terminal output/i); + assert.match(privacy, /do not sell it[\s\S]*track you across/i); assert.match(home, /build@1helm\.com/); assert.match(home, /og:image/); assert.match(home, /assets\/story\/og-card\.png/);