Privacy Policy

1. Who we are

HelmFi Inc., a Delaware corporation, runs helmfi.ai and amonhen.helmfi.ai. We offer Amon Hen (market data and analytics for options and futures), a crypto terminal, AI chat, a broker workspace, a paper trading bot, alerts, and connectors and an API for AI apps. This policy covers all of them, and says what data we collect, why, who we share it with and your rights.

2. Data we collect

• Account: your email address; your password, stored only as a one-way hash, never in readable form (section 8); your plan, sign-up date and usage counts.
• Google or Apple sign-in: if you use it, the provider's account ID for you and the email address it shares with us.
• Terms acceptance: which version of our Terms and Privacy Policy you accepted, and when.
• Billing: Stripe takes your card and billing details directly. We receive your subscription status, your plan, your Stripe customer and subscription IDs, and the email address you gave Stripe. If you pay before making an account, we make your account from that email.
• Bots: the strategy settings you choose, and the simulated trades and logs of your paper bot. If you add your exchange's API keys, also those keys, encrypted at rest; we never ask for your exchange password.
• Brokerage connection (Pro and Elite): if you connect a brokerage through SnapTrade, the user ID and secret SnapTrade gives us for your connection (the secret encrypted). When you use the broker workspace, and every 10 minutes during U.S. market hours to check alert conditions, we read your accounts, positions (including cost basis and current value) and up to 180 days of account activity from your brokerage. We store the alert triggers you set and a record of the alerts your positions produce. The connection is read-only: it can't place orders or move money.
• AI chat: the questions you ask (we keep the first 500 characters of each, with your plan) and short notes we derive from your activity, such as how often you've asked the same thing. To answer you, chat also reads your bot's holdings and recent orders.
• AI apps you connect (such as ChatGPT or Claude): which app you connected and when, and a scrambled (hashed) copy of its access pass, never the pass itself. For each request the app makes: the time, the tool used and what it asked for (for example a ticker), your IP address and its network, the app and its user agent, and whether it worked. We use this to apply your plan's limits and to spot shared or resold accounts.
• Telegram alerts: if you link Telegram for alerts, the Telegram chat linked to your account, so we can send them. Send /stop or block the bot to unlink.
• Discord: if you link your Discord account, your Discord user ID tied to your HelmFi account, so our bot can give you your plan's role and answer your commands; and any alerts you set through the bot.
• Messages you send us: what you write through our contact page or by email, and your email address. Contact-page messages are also sent to our team's Telegram so we see them quickly.
• Amon Hen update emails: if you sign up for them, your email address. If you unsubscribe, we keep it marked as unsubscribed so we don't email you again.
• Logs: our servers, including Amon Hen's, log each request's IP address, page, user agent and result. We use them for security, to apply plan limits and to block automated scraping.
• Cookies and browser storage: three cookies needed to run the Service: helmfi_session keeps you signed in on helmfi.ai; amon_sess keeps you signed in on Amon Hen; hf_pf links a pay-first checkout to your browser until you set your password. If you turn ad measurement off (section 6), the hf_ads cookie remembers that. The site also keeps your account number in your browser's local storage, and notes there which sign-ups and purchases it has already dealt with for ad measurement, whether reported to Meta or not, so none is reported twice or later, and any report still waiting to be tried again, with which one it tried last. Apart from the Meta Pixel below, we use no advertising, retargeting or analytics cookies.
• Ad measurement (Meta Pixel), on helmfi.ai only, from November 24, 2026: we tell Meta which public helmfi.ai pages you visit (such as the home page or pricing), when you make an account, and when you buy a plan (which plan). Meta also receives your IP address and browser details, and we keep two cookies for Meta on helmfi.ai: _fbp, a random ID for your browser, and _fbc, which Meta ad you came from if you clicked one. Meta may match this to your Facebook or Instagram account. We use it to measure our Facebook and Instagram ads and to show them to people likely to be interested. Nothing is sent from Amon Hen (amonhen.helmfi.ai); your account pages send only the bare “made an account” or “bought a plan” event with the site's address (helmfi.ai), never the page you were on; and we never send Meta your name, your email address or anything you type. It stays off if your browser sends Global Privacy Control or Do Not Track or doesn't keep cookies, if you turn it off (section 6), or if you visit from the European Economic Area, the UK, Switzerland or a place we can't identify.

3. How we use it

• To run the Service: sign you in, show your plan's data, run your bot, answer your AI chat, send the alerts you asked for.
• To keep it working fairly: apply plan limits, spot shared or resold accounts, block scraping and abuse.
• To keep a record of your acceptance of our Terms and Privacy Policy.
• To email you about your account, billing and security, and, only if you agreed, about new features.
• To improve the Service, from usage counted across members.
• To measure our Facebook and Instagram ads and show them to people likely to be interested, through the Meta Pixel on helmfi.ai (section 2), unless you turn it off.
• To meet legal duties, prevent fraud and enforce our Terms.

4. Who we share it with

Service providers that run parts of the Service for us:

• Stripe: payments, tax and invoices. Receives your billing details directly from you.
• Hetzner: hosts our servers in Ashburn, Virginia.
• Cloudflare: DNS, delivery and DDoS protection. Sees request details such as your IP address and the page.
• Anthropic: AI chat on paid plans. Receives your chat messages and the account details chat uses.
• Groq: AI chat for accounts without a plan, and market-regime classification. Receives your chat messages and the account details chat uses, and market data.
• Resend: sends our account email. Receives your email address and the message.
• SnapTrade: the brokerage connection, if you use it (Pro and Elite). You sign in to your brokerage through SnapTrade, which passes your account, position and activity data to us read-only. Receives a SnapTrade user ID for you.
• Telegram: delivers the alerts you linked, and sends contact-page messages to our team. Receives the alert or message, and for alerts your Telegram chat.
• HelmFi's own computer in the U.S.: keeps a nightly copy of our database for 14 days, and runs a backup AI model when Groq is busy or a plan's AI budget is used up.

Advertising: from November 24, 2026, Meta Platforms (Facebook and Instagram) receives what the Meta Pixel on helmfi.ai sends (section 2). Meta's own privacy policy covers what it does with it.

Services you choose: an AI app you connect receives the answers to the requests you make through it, including your own account details when you ask; its own privacy policy covers what it does with them. What you post on our Discord is covered by Discord's policy. If live trading opens and you connect an exchange, the exchange receives your bot's orders.

We disclose information when the law requires it (for example a subpoena or court order) or to protect rights, safety or property. We do not sell your personal information. The only data we share for advertising is what the Meta Pixel on helmfi.ai sends (section 2), and you can turn that off (section 6).

5. How long we keep it

• Account and subscription: while your account is open, and up to 2 years after it closes, for tax and audit.
• Terms acceptance record: while your account is open, and 3 years after it closes.
• Bot settings and trade history: while your account is open. When you delete your account, your exchange keys are deleted, your login email is replaced, and these are kept as records.
• Brokerage connection: until you disconnect it or delete your account. Then we delete the connection, your alert triggers and the alert records, and ask SnapTrade to delete your SnapTrade user.
• AI chat questions and the notes derived from them: while your account is open; deleted when you delete your account.
• Google or Apple sign-in record: while your account is open; deleted when you delete your account.
• AI app connection: until you disconnect it, or after 30 days without use. Its request log: 90 days.
• Telegram link: until you unlink. Discord link and bot alerts: until you unlink or remove them.
• Messages you send us: up to 2 years.
• Amon Hen update emails: until you unsubscribe; after that, marked as unsubscribed so we don't email you again.
• Server logs: up to 30 days for access logs, 90 days for application logs.
• Backups: 14 days.

6. Your rights

Depending on where you live, you can ask to see, correct, delete or export your data, or object to or restrict some uses. Ask through our contact page; we answer within 30 days. Deleting data can be limited by records we must keep for tax or audit.

Ad measurement, Global Privacy Control and Do Not Track: if your browser sends Global Privacy Control or Do Not Track, the Meta Pixel stays off. You can also turn it off for this browser here; the choice is kept in the hf_ads cookie, so clearing your cookies turns it back on.

7. Where your data is

Our servers and your account data are in the United States (Hetzner, Ashburn, Virginia). The nightly backup is also in the United States, on a computer HelmFi controls. AI chat and market-regime requests go to U.S.-based providers (Anthropic and Groq) or to the backup model on HelmFi's own computer. If you use HelmFi from outside the U.S., your data is moved to and processed in the U.S., under those providers' data-processing terms and standard contractual safeguards where they apply.

8. Security

We use HTTPS everywhere, encrypt stored exchange credentials, hash passwords with Argon2 (a few older passwords move to it when their owners next sign in), and limit who can reach our servers. If a breach affects your data, we will tell you without undue delay.

9. Children

HelmFi is for people 18 and over. We don't knowingly collect data from anyone under 18.

10. Changes to this policy

We will tell you about material changes by email or in the Service, for example with an accept box, at least 14 days before they take effect, and change the date at the top.

11. Contact

Privacy questions and data requests: use our contact page.