Table of Contents
1. Who We Are & Overview
This Privacy Policy applies to the Helix collaborative productivity web platform (hosted at https://helix.seraphimstudio.in), designed, owned, and operated by Seraphim Studio("Seraphim Studio", "we", "us", or "our"). Helix is a product of Seraphim Studio. This policy governs the manner in which Helix collects, uses, maintains, and discloses information gathered from users ("User", "you") of the website and associated services.
By accessing or using Helix, you acknowledge that you have read and understood the practices described in this Privacy Policy.
2. Information We Collect
We collect information in the following categories:
- Account Information: When you register directly or authenticate via Google OAuth, we collect your email address, chosen username, hashed passwords (for credential accounts), and profile avatar picture.
- Workspace & Collaboration Data: Projects, tasks, subtask checklists, calendar appointments, kanban cards, and chat channel messages that you explicitly create and share inside Helix.
- Technical & Usage Logs: IP address, browser type, device information, operating system, and session timestamps used solely for security auditing and diagnostic error reporting.
3. Google API Services & Google Calendar Data (Limited Use Policy)
Helix offers optional integrations with Google OAuth authentication and the Google Calendar API (requesting scopes openid, email, profile, and https://www.googleapis.com/auth/calendar.events).
How We Access, Use, and Store Google User Data:
- Access: We access your basic Google profile details (name, email, and avatar) for identity verification, and your Google Calendar events (titles, descriptions, and start/end timestamps).
- Use: Google Calendar data is accessed solely to enable bidirectional schedule synchronization—displaying your Google events inside Helix Calendar and optionally exporting your Helix tasks and schedule events to your Google Calendar.
- Storage: Google OAuth tokens (access tokens and refresh tokens) are encrypted and stored in our PostgreSQL database to maintain your scheduled synchronization. We do not store sensitive Google account credentials or passwords.
- No Sale or Advertising: Helix does NOT sell, rent, monetize, transfer, or disclose Google user data to third-party data brokers, advertisers, or data marketplaces under any circumstances.
- No AI Model Training: Your Google Calendar event data is strictly used for in-app schedule rendering. We do NOT use Google user data to train, tune, or improve generalized artificial intelligence or machine learning models.
Helix's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
You can revoke Helix's access to your Google account at any moment through your Helix Settings panel or directly in your Google Security Permissions. Revoking access immediately halts synchronization and permanently deletes stored access tokens.
4. How We Use Collected Data
Helix utilizes collected information strictly for legitimate operational purposes:
- Providing, maintaining, and updating the Helix collaboration and task tracking platform.
- Facilitating real-time project synchronization and team chat communication.
- Authenticating user sessions and safeguarding accounts against unauthorized intrusions.
- Providing customer support and responding to system error logs.
- Delivering user-configured browser and system activity notifications.
5. Data Storage, Security & Retention
We employ industry-standard technical safeguards to protect your personal and workspace information. All communications between your browser and our servers are encrypted using Transport Layer Security (TLS/SSL). Passwords are cryptographically hashed using salted bcrypt prior to database storage.
User data is persisted securely in cloud databases managed by Neon (AWS ap-southeast-1 region) with strict network isolation. We retain your data as long as your account remains active or until you request account deletion.
6. Data Sharing & Third Parties
We do not sell, trade, or rent personal identification information to others. We share data only with trusted service providers necessary to operate the application infrastructure:
- Neon PostgreSQL: Cloud database storage provider.
- Upstash Redis: High-performance caching and WebSocket adapter.
- Google Cloud: OAuth identity verification and calendar sync (when initiated by the user).
7. Your Rights & Data Deletion
Depending on your location (including rights under GDPR and CCPA), you possess the right to:
- Access, export, or receive a copy of your personal data stored on Helix.
- Rectify inaccurate personal details or update your username and email address via Settings.
- Request the complete deletion of your account and all associated workspace records.
- Disconnect third-party integrations (such as Google Calendar) at any time.
To exercise any of these rights, please contact our privacy representative directly at seraphimcreationverse@gmail.com.
8. Cookies & Local Storage
Helix utilizes essential HTTP cookies strictly to maintain user authentication sessions (NextAuth session tokens). We also utilize browser LocalStorage solely to preserve client-side UI configurations, such as your dark/light theme, font sizes, sidebar collapse status, and dismissed notification alerts.
9. Contact Information
If you have any questions, concerns, or requests regarding this Privacy Policy or Helix's data practices, please reach out to:
Seraphim Studio / Helix Legal Desk
Attn: Privacy & Data Protection Officer
seraphimcreationverse@gmail.com