Privacy

Effective 2026-10-18

The short version

We collect what the service needs to work and nothing else. We do not sell your data, we do not run advertising, and we do not use your content to train models.

Helys is offered in the United States only, and your workspace is hosted there. You tell us where you are based when you create a workspace, and we refuse a workspace anywhere else. We are not offering Helys to people in the United Kingdom or the European Union, and the terms say so.

What we hold

• Account: your email address, your display name, your role, and the public half of each passkey. Everyone in your workspace can see each other's name, role and email address on its People page. There is no password, so there is no password to lose. If your workspace allows emailed sign-in codes, we send one to the address on your account when you ask for one, and hold a one-way hash of the code and of the address for ten minutes, with the IP address and browser that asked — never the address itself.
• Workspace content: your profile and the contact details on it (website, an email and phone for applications, a mailing address, pronouns, links), your CV, the opportunities with your notes and decisions on them, applications, tasks, drafts, and the files you upload, including the text Helys reads out of them on its own server.
• Eligibility facts, if you choose to enter any. This is the part of Helys that holds sensitive information about you, so it gets its own section below rather than a clause in a list.
• Operational records: sign-in times and IP addresses, an audit log of administrative actions, account and security changes, changes to the workspace (which sections of the profile were saved, never what was typed) and Helys's own background work, error logs, and a copy of each public listing as it was fetched. The audit log loses its addresses and browser details after 90 days and is deleted after a year; an invitation's address is redacted after 90 days if it was never accepted and after a year if it was. Session, invite, API and calendar-feed tokens are stored only as hashes, never in the clear.
• Connections, if your workspace connects Todoist: the Todoist account's id and email address, its access tokens (encrypted, never shown again), the label and project chosen, and which task here is which task there. Todoist's notices about those tasks, which carry their titles and due dates, are kept as the record of what Todoist told us. Disconnecting deletes the tokens and the links.
• Billing: your plan and its status. Card details go to Stripe and never reach us.
• Support tickets, if you file one: the subject, the whole message thread, and the name and email address you had when you wrote. These are the one thing that lives outside your workspace, in our own records, and a Helys administrator can read them. That is deliberate — a workspace locked for non-payment is exactly the one whose owner needs to reach a person, and a ticket store inside it would disappear at that moment. Deleting your workspace deletes its tickets with it.
• Bounced addresses: if mail to you bounces or you report it as spam, the address goes on a list held outside any workspace, so we stop sending to it. Tell us when the mailbox works again and we take it off.

The marketing site you are reading sets no cookies and runs no analytics.

Who else processes it

• DigitalOcean — hosting and backups, United States.
• Anthropic — scoring, extracting requirements from listings, and drafting. What is sent for scoring is the listing text plus the parts of your profile the score depends on: your practice summary, disciplines, location, what you are looking for, any eligibility fact you have ticked “Share with Helys AI” on, and a summary of your own decisions on earlier listings (which you shortlisted, applied to or ignored, and why) so the scorer learns from them. When you ask for help with a draft, the draft, the materials you choose as inputs, your CV, your pronouns, website and links are sent, including text Helys reads out of a PDF or Word document you uploaded; Helys reads those files on its own server, and the files themselves are not sent. When you ask Helys to read a call's guidelines or a page you pasted the address of, that text is sent. Your email, phone and mailing address are never sent to Anthropic. None of it is used to train models. A Claude app you connect yourself under Settings → Connect signs in as you and can read what you can, your contact details included; that is your connection, not ours.
• Amazon SES — sending the emails the service has to send.
• Stripe — payments, invoices and receipts.
• Todoist — only if somebody in your workspace connects their Todoist account under Settings → Connect; one connection per workspace. Then each open task's title, due date and whether it is done, with a line naming the call it belongs to and a link back to it here, are sent to that Todoist, and tasks labeled there are read back as tasks here; nothing else. Disconnecting revokes the access; the tasks stay where they are.
• GitHub — United States, and only for support. When we need to track a ticket as a piece of work, we copy its subject and thread into a private issue tracker hosted by GitHub. Your email address is never included.

Eligibility facts

Many funders restrict who may apply — by age, by disability, by race or ethnicity, by veteran or immigration status, by whether you were the first in your family to go to college. Helys has a place to record those facts so it can tell you whether a call is open to you before you spend a week on the application.

The fields are: age or date of birth, gender, race or ethnicity, disability, veteran status, immigration status, parent or caregiver, first-generation, LGBTQ+, and a free text box. Every one of them is optional. They are blank until you fill them in, and Helys works without any of them.

• They are stored in your workspace’s own database, like the rest of your content, and only workspace admins can see or edit them.
• They are not sent to Anthropic unless you tick “Share with Helys AI” on that particular field. The tick is off by default and it is per field, so you can share “veteran status” without sharing “disability”.
• They are used for nothing but matching you to opportunities.
• Clearing a field deletes it. Nothing is kept outside the backups.

Email we send

Only what the service needs: sign-in codes and recovery links, invitations, deadline reminders and the weekly digest unless you turn them off, answers and news on a support ticket you filed, and notices about your account. Every reminder and digest carries an unsubscribe link. Stripe sends the receipts and invoices.

How long we keep it

Your workspace is kept while your account exists. Nightly backups are kept for a rolling fourteen days with weekly copies for two months, and a copy of each night's backup is held in a private bucket at DigitalOcean for thirty days. An archive you export is deleted from the server after about a week. Locking a workspace does not delete it. Ask us to delete it and we will, backups included.

Your choices

You can see and edit your workspace content at any time, download the whole workspace as an archive from Admin → Settings, export deadlines as a calendar feed, or ask for it all to be deleted. If you are signed in, Support in the sidebar opens a ticket and is the quickest route to a person. If you cannot sign in, write to support@helys.com and a person will answer.

Security

Passkeys with user verification, emailed sign-in codes that are single-use and bound to the browser that asked for them, TLS everywhere, tokens stored as hashes, secrets encrypted at rest, per-workspace databases, and a strict content-security policy. If you find a vulnerability, please tell us at security@helys.com.

Changes

If this policy changes in a way that matters, we will email you before it takes effect.

Contact

Write to support@helys.com.