Privacy Policy

Last updated October 7, 2026

This policy explains how helg, inc. (“helg,” “we,” “us”) handles personal information when you use our website, web app, and related services (the “Service”). By using the Service you agree to this policy.

The short version

• We collect what we need to run the Service — your account details and the things you capture.
• We do not sell your personal information.
• We never use your content to train AI models, ours or anyone else’s.
• We send transactional email, plus optional reminders you control — no marketing blasts. Reminders, nudges, digests, and household notifications each have their own switch in You → Notifications. Some start on (date reminders, the weekly nudge, the weekly digest); others start off (a morning buy-list summary, a ping each time family sends you something). Security alerts and billing notices are the only ones without a switch.
• You can export or delete your data at any time, from You → Data & privacy.

Information we collect

Information you give us

• Account: your email address, your name, and an optional phone number you add during onboarding.
• Your content: the tasks, subtasks, notes, deadlines, buy-list items, file attachments, and household/family details you create in the Service.
• Family & sharing: if you invite household members or are invited, we store the invitation email and membership relationship.

Information we collect automatically

• Sign-in & security: when you sign in we record the approximate time, IP address, and device/browser (user-agent) so we can show you a “new sign-in” alert and let you review active sessions.
• Approximate location: we derive a coarse city/region from your sign-in IP address solely to describe a login in the security-alert email.
• Operational logs: standard server logs needed to operate, secure, and debug the Service.

Payment information

Billing is handled by Stripe. When you subscribe, your card details go directly to Stripe — we never see or store your full card number. We keep only your subscription status and invoice records.

How we use information

• To provide the Service: store and sync your tasks, run the weekly pass, and power features like the calendar feed and reminders.
• To send transactional email (sign-in links, family invites, payment receipts, sign-in and calendar-connection alerts) and the optional reminders, nudges, and digests your notification settings allow — no marketing.
• To secure your account and detect abuse.
• To process payments and manage your subscription.
• To comply with legal obligations.

Cookies & local storage

We use a small number of strictly-necessary cookies — an httpOnly session cookie to keep you signed in, and a cookie that remembers which household you’re viewing. We do not use advertising or cross-site tracking cookies. Your browser’s local storage holds small preferences (for example, which sign-in method you used last, and which app view you prefer). Clearing your browser storage signs you out and resets those preferences.

Who we share information with

We don’t sell your data. We share it only with service providers (“subprocessors”) that help us run helg, under contracts that limit their use to providing services to us:

• Amazon Web Services — email delivery (SES), and file/attachment storage and database backups (S3).
• Stripe — payment processing and subscription billing.
• Google — only if you choose “Continue with Google” to sign in.
• Apple — only if you choose “Continue with Apple” to sign in. Apple may provide a private relay address instead of your personal email.
• An IP-geolocation provider — to turn a sign-in IP into an approximate location for the security alert.
• OpenStreetMap / Nominatim — when you add a location to a task, your search text (and, if you allow it, your approximate coordinates) is sent to OpenStreetMap’s Nominatim service to look up addresses, and map tiles are loaded from OpenStreetMap.
• Our hosting and database providers — to run the application.

We may also disclose information if required by law, to enforce our terms, or to protect the rights and safety of our users — and as part of a merger or acquisition, in which case we’ll notify you.

Family & shared inboxes

helg is permeable, not a shared list. When someone sends you a task, they see only what they’ve sent — not your board. Household members and delegates can see the tasks and details shared with them within that household. Only invite people you trust with that information.

Data retention

We keep your information for as long as your account is active. When you delete content it’s removed from the active Service; backups age out on a rolling basis. When you delete your account, we immediately revoke access — sign-in is disabled, every session ends, and your passkeys, linked sign-in methods, calendar feeds, and public share links stop working at once — and we anonymize your personal profile. Any household you solely run is closed. We then delete or anonymize remaining personal data within a reasonable period, except records we must retain (for example, invoices) to meet legal and accounting obligations.

How we protect information

Traffic is encrypted in transit with TLS. Uploaded files and database backups are encrypted at rest by our storage provider. Sign-in is passwordless; session tokens are stored only as hashes, so they can’t be reused if our database were exposed. Access to production data is limited to staff who need it. No system is perfectly secure, but we work to keep yours safe — see our Security page for detail.

Your choices & rights

• Access & export: view your data in the app, or download a JSON copy from You → Data & privacy.
• Correction: update your profile in You → Profile, and your content directly in the app.
• Deletion: delete content in the app, or your whole account from You → Data & privacy, at any time.
• Sessions: review and revoke active sign-ins in You → Security & devices.

Depending on where you live (for example, the EEA/UK or California), you may have additional rights to access, correct, delete, or port your data, and to object to certain processing. To exercise any of these, email [email protected].

International transfers

We operate from the United States, and our providers may process data there and in other countries. Where required, we rely on appropriate safeguards for international transfers.

Children

helg isn’t directed to children under 13 (or the minimum age in your country), and we don’t knowingly collect their information.

Changes to this policy

We’ll update this page when our practices change and revise the date above. For material changes we’ll give notice in the app or by email.

Contact

Questions about privacy? Email [email protected] or visit our contact page.