This notice covers helmhouse.io and the run-apps Helmhouse builds and distributes. It is short because the software is built so that there is little to say.
Helmhouse does not sell an app. Each run-app is built for one team and reaches that team’s own systems, so no two are the same. What they share is one of two architectures, and it is the architecture that decides what is collected. Both are described below. Wheelhouse and STUNL Admin, named on the home page, are instances of the first and second.
This website
helmhouse.io is a static page. It sets no cookies, writes nothing to local storage, runs no analytics, carries no tracking pixels, and makes no third-party requests of any kind. It loads no fonts, scripts or images from anyone else. There is nothing to consent to, which is why you were not asked to.
The web server keeps a standard access log: your IP address, the time, the request line, the response status, the referring page and your browser's user-agent string. The public proxy and page server write to fixed-size rolling buffers, currently about 80 MB in total, that overwrite their oldest entries as they fill. There is no archive of it, and no analysis, profiling or reporting is run over it. It exists so that a fault or an attack can be investigated.
The site is hosted on a server operated by OVH Hosting, Inc. in Canada.
The homepage’s inquiry form prepares an email brief in your browser. Its contents are not submitted to Helmhouse by the form. You choose whether to open an email draft, send it in your email app, or copy the brief to your clipboard.
If you email contact@helmhouse.io, we hold your message and your address for as long as the conversation is useful, and for a reasonable period afterwards.
Mac-mediated run-apps (Type A)
An iPhone reaching an engineer's own Mac. Wheelhouse is the instance shown on the home page.
- Mac-mediated work credentials stay on the Mac. Jira, GitHub and Datadog credentials for these workflows stay on the Mac. The phone holds its pairing identity. Optional phone-side access has a separate device-local boundary, described below.
- Work content never lands on our servers. Ticket text, code diffs and log lines cross the relay only as ciphertext. Helmhouse cannot read it or forge it.
- The control plane stores a small routing record: your email address, the hostname you chose, your devices' public keys, and what is needed to deliver a notification, which is an APNs token, a device name and a device model. It never holds work content and never holds a work credential.
- Push notifications are sealed. The fallback text iOS can show before the app decrypts a notification names a tool, never the work.
Optional access on the phone
Wheelhouse can also sign in to AWS directly on the phone, if you choose to enable that access. Its AWS token and client registration are held in the app’s private Keychain group on that device, are not synced through iCloud, and are removed when you sign out. They are separate from the Mac’s AWS session.
The optional phone VPN runs on the phone when you explicitly connect it. Its sign-in assertion is used for that connection; no VPN credential is stored between connections. This is separate from using the phone to connect the Mac’s VPN.
Phone-direct run-apps (Type B)
An operations console for one owned service. STUNL Admin is the instance shown on the home page.
- There is no Helmhouse backend in the data path. The app signs in to the operator's own systems and talks to them directly.
- Credentials live only in the app's private Keychain group on the device.
- Demo mode is fictional. It shows sample data from a company that does not exist, fetches nothing and changes nothing.
Face ID and Touch ID
Consequential actions are gated behind Face ID or Touch ID through Apple's LocalAuthentication framework. That framework returns a pass or a fail and nothing else.
No biometric identifier, template or image is ever collected, transmitted, stored or seen by Helmhouse or by any run-app it builds. Biometric data does not leave Apple's Secure Enclave on your device, and there is nothing for us to retain or disclose.
What we never do
- No advertising, anywhere.
- No selling or sharing of personal information, for advertising or otherwise.
- No third-party analytics or attribution SDKs in any run-app we build.
- No behavioural profiling, and no automated decision-making about you.
Children
These are tools for professional engineers, distributed to the teams they are built for. Nothing here is directed at children, and none of it is intended for anyone under 13.
Access, correction and deletion
Write to contact@helmhouse.io and we will tell you what is held and remove it on request. For a Mac-mediated run-app, unpairing a device removes its keys from your Mac, and we will delete the control-plane record for your account and devices when you ask.
Changes
If this notice changes in a way that matters, the effective date above changes with it.
Contact
Helmhouse, Chicago, Illinois, USA. contact@helmhouse.io