Privacy Policy.

Helm ("we," "our," "the app") is a premium iOS application that lets your iPhone control a Mac on your local network over SSH. We are committed to protecting your privacy and being transparent about the data we handle. This Privacy Policy explains what information we collect, how we use it, and your rights regarding your data.

Information we collect.

1.1 — Connection credentials

To open an SSH session with your Mac, Helm needs a few details that you provide directly:

• Host address. The IP address or Bonjour name of your Mac (for example, 192.168.1.42 or altan-macbook.local).
• SSH username. The account name you use on the Mac.
• SSH password. Stored only in iOS Keychain on your device. We never see it. We never transmit it to our servers — because we do not run any servers that handle your credentials.
• Pinned host fingerprint. The SHA-256 fingerprint of your Mac's SSH public key, recorded on first connection so a different machine on the network cannot pose as yours.

1.2 — On-device preferences

The following settings are stored only on your device using Apple's UserDefaults and are never transmitted to us:

• Trackpad sensitivity
• Theme (System, Light, Dark)
• Language preference (English, Türkçe, Français, Italiano, Deutsch, Español)
• Saved Mac list (host names, addresses, usernames — not passwords)
• Dashboard tab order & haptic feedback preferences
• Whether you have switched anonymous analytics off

1.3 — Helm Pro purchase status

Whether you have unlocked Helm Pro through the App Store. This is verified through Apple StoreKit 2 and stored locally; the receipt is validated against Apple's servers, not ours.

1.4 — Anonymous usage events

Helm sends a small set of anonymous events to Firebase Analytics so we can understand which instruments are used most and where the experience needs work — connection_success, keyboard_shortcut, power_action, screenshot_action, and the like. They are not linked to a name, an email address, or an Apple ID, and you can switch them off at any time from Settings → Privacy → Anonymous analytics.

So that the picture is complete, here is exactly what travels with those events:

• The display name of the Mac you connect to. Sent with connection_success and auto_connect_attempt. This is the name shown in Helm — usually the Bonjour name macOS advertises, such as altan-macbook. Your Mac's IP address is never sent.
• The names of Mac apps you act on. Sent when you activate, quit, or force-quit an application from the Apps panel — for example Safari or Xcode.
• Which browser a tab action targeted — safari or chrome. Never the tab's title or URL.
• Error text from a failed connection or purchase. The message the SSH library or StoreKit produced. Some of these messages may embed the host or username you typed.
• Which screen was opened, which shortcut was pressed, which power or media action was used, and the selected language.

Firebase also collects a standard technical baseline of its own with each event: an app instance identifier, device model, operating system version, app version, and an approximate region derived from the IP address of the request. This is Google's automatic collection, not something Helm chooses to send. Both stop when you switch analytics off — and switching it off also resets the app instance identifier.

1.5 — What Helm reads from your Mac but never keeps

Several panels display live information pulled from your Mac over the SSH session: running applications, open Safari and Chrome tabs, disk usage and volume names, Bluetooth device names and battery levels, the currently playing track, and the screenshot you capture. This information is read on demand, shown on your iPhone, and discarded when the panel refreshes or the session ends. None of it is written to our servers — we have none — and none of it appears in analytics events, with the single exception of the application names described in § 1.4.

A screenshot is written outside the app only when you tap Save to Photos, which places the image in your own photo library on your iPhone, or Copy, which places it on your clipboard.

What we do NOT collect.

Helm does not collect:

• The contents of any SSH command, response, or output
• Your Mac's IP address, host address, or local network configuration
• Your SSH password (stored locally in iOS Keychain only)
• Location data — Helm asks for no location permission at all
• Contacts or address book
• Photos, camera, or microphone data. Helm can write a screenshot into your photo library when you ask it to, and never reads anything back out
• Health or fitness data
• Browsing history, tab titles, or tab URLs — the Tabs panel reads them live from your Mac and shows them to you, and nothing about them is transmitted (see § 1.5)
• The contents of your files, or the names of anything on your disks
• Device advertising identifiers (IDFA) — Helm shows no ads and never asks for tracking permission
• Crash reports. No crash-reporting SDK is embedded in the app

How we use your information.

Third-party services.

Helm relies on a small number of third-party services. All of them are limited in scope, and none of them receives your shell traffic.

4.1 — Firebase by Google

Helm embeds exactly one Firebase product: Firebase Analytics. It receives the anonymous usage events set out in § 1.4, together with the technical baseline Google collects automatically. We do not link these events to a personal identity, and you can switch the whole thing off from Settings → Privacy → Anonymous analytics. Turning it off stops collection immediately and resets the app instance identifier.

Firebase Crashlytics, Authentication, Firestore, Cloud Functions, Messaging, Remote Config and Ads are not used by Helm and are not linked into the app.

Firebase privacy policy: firebase.google.com/support/privacy ↗

Google privacy policy: policies.google.com/privacy ↗

4.2 — Apple services

• iOS Keychain. Stores your SSH password locally on the device, protected by the same Secure Enclave that guards Face ID and Apple Pay.
• StoreKit 2. Manages the Helm Pro one-time in-app unlock. All transactions are handled by Apple. See Apple's Privacy Policy ↗.
• Bonjour / mDNS. Apple's local network discovery service, used to find your Mac on the local network. No external network is involved.

4.3 — Helpers running on your Mac (optional)

For full trackpad and bluetooth control, Helm uses two small open-source command-line tools that you install yourself on the Mac:

• cliclick — pointer / keyboard simulation (BSD-licensed, audited).
• blueutil — bluetooth connect/disconnect (MIT-licensed, audited).

These tools run on your Mac, not on our servers. They do not collect or transmit data.

Data sharing.

We do not sell, rent, trade, or share your personal data with third parties for advertising, marketing, or any purpose other than those described in this policy.

Anonymous, aggregated usage events are processed by Firebase Analytics solely for the purpose of understanding feature usage in aggregate.

Storage & security.

• SSH session. Encrypted end-to-end between your iPhone and your Mac using the standard SSH protocol. The session never leaves your local network unless you have explicitly bridged it (e.g. via a personal VPN you control).
• Password. Stored in iOS Keychain, protected by iOS device-level encryption and Secure Enclave. Never transmitted to us.
• Host fingerprint pinning. First-connection trust on first use, then enforced on every subsequent connection. A mismatch refuses the connection.
• On-device preferences. Stored using Apple's UserDefaults framework, protected by iOS data protection.
• Confirmations for halt-states. Sleep, lock, restart, shut down, and force-quit are double-checked before the shell command is sent.

Data retention.

• On-device data. Saved Macs, preferences, and host fingerprints stay on the device until you uninstall the app or delete them manually — tap the gear beside a saved Mac on the Connect screen, then Remove device.
• iOS Keychain entries. Removed when you uninstall the app (per iOS standard behaviour) or when you delete the saved device.
• Anonymous analytics events. Retained by Firebase per Google's standard retention windows. They contain no identifiers tied to you.
• No server-side user data. We do not run a server that holds your personal data.

Your rights.

You have the following rights regarding your data:

• Access. All saved devices, preferences, and pinned fingerprints are visible inside the app at all times.
• Correction. You can edit any saved device from the gear beside it on the Connect screen, and any preference from Settings.
• Deletion. Connect → gear → Remove device deletes a saved Mac together with its Keychain password and its pinned host fingerprint. Uninstalling the app removes everything Helm has stored locally.
• Opt-out of analytics. Toggle off Settings → Privacy → Anonymous analytics. It takes effect immediately, and the app instance identifier held by Firebase is reset at the same time.
• Portability. Since data lives on your device, you retain full control. If you'd like an export of your locally-saved configuration, contact us at the address below.

Children's privacy.

Helm is not directed at children under the age of 13. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided personal information through the app, please contact us and we will take steps to delete that information.

International data transfers.

Anonymous Firebase Analytics events are processed by Google's infrastructure and may be stored in any region in which Firebase operates. By using Helm with analytics enabled, you acknowledge that those aggregated and anonymous events may be processed across borders in accordance with Google's privacy policy and applicable data protection regulations, including GDPR. Disable analytics in Settings → Privacy if you prefer that no telemetry leaves your device.

Changes to this policy.

We may update this Privacy Policy from time to time. Any changes will be reflected by updating the "Last updated" date at the top of this page. We encourage you to review this page periodically. Continued use of the app after changes constitutes acceptance of the revised policy.

Contact us.

If you have questions, concerns, or requests regarding this Privacy Policy or your data, please reach out — the captain reads every signal flag.