Privacy Policy
Last updated: 2 October 2026 · Effective: 2 October 2026
This policy explains what information Helicarrier collects when you use the hosted Helicarrier Cloud service, why we collect it, and the choices you have. We try to collect as little as the product needs to run, and never to sell it.
1. Who we are
Helicarrier is a cloud hosting platform built, owned and operated by Bluefish Studio. “Helicarrier”, “we” and “us” refer to Bluefish Studio as the operator of the Helicarrier service, reachable at [email protected]. For the purposes of applicable data-protection law, we act as the data controller for your account information and as a data processor for the application data you choose to deploy and run on the platform.
2. Information we collect
Information you give us
- Account details — your name, email address, and the password hash created when you sign up.
- Organisation details — the team and project names you create, and members you invite.
- Billing details — handled by our payment processors. We store a customer reference, your invoices, account-credit purchases and payment history, but never your full card or bank-account numbers.
- Support correspondence — anything you send us by email or through our support form.
Information created by using the service
- Application content — the source code, container images, environment variables, and database contents you deploy. Your environment variables are encrypted at rest and are decrypted only at deploy time.
- Usage & metering data — the compute resources (such as memory-minutes) your services consume, used to calculate your bill.
- Operational logs — build and runtime logs from your services, and platform logs needed to operate and secure the service.
- Connection metadata — when you connect a GitHub account, the installation identifier and repository list you grant access to.
- Technical data — IP address, browser type, and session identifiers, collected automatically when you use the dashboard.
- Product analytics and session recordings — when you visit our website or use the dashboard, we record how you interact with it: pages viewed, clicks, scrolling, and a replay of what was on screen during your session. Text you type into form fields is masked, and we exclude revealed secrets, newly created API keys, database query results and the in-browser shell from recordings. When you are signed in, recordings are linked to your account so we can investigate problems you report.
3. How we use your information
- To provide, operate, build, deploy, and route your services.
- To authenticate you and keep your account secure.
- To meter usage and charge you accurately.
- To detect, prevent, and investigate abuse, fraud, and security incidents.
- To send you service-related messages (deploy results, billing notices, security alerts).
- To provide support, including reviewing session recordings to reproduce a problem you report.
- To understand how the website and dashboard are used, so we can improve them.
We do not sell your personal data, and we do not use the contents of the applications or databases you deploy for advertising or to train models.
4. Legal bases
Where data-protection law requires a legal basis, we rely on: performance of our contract with you (to provide the service), our legitimate interests (to secure and improve the platform), compliance with legal obligations (such as tax record-keeping), and your consent where specifically requested.
5. Who we share it with
We share data only with service providers that help us run Helicarrier, under contract and only as needed:
- Payment processors — Paystack (payments in naira) and Whop (payments in other currencies), to take payment for invoices and account credit. Payments are routed to them through our own payment service.
- Hosting and infrastructure — Hetzner, whose data centres run the platform, your services and our backups; and Cloudflare, which hosts our website and provides DNS and network services.
- Email delivery — Resend, to send you account, deploy and billing emails.
- Product analytics — PostHog, which processes the analytics and session recordings described in section 2.
- Source-control providers — GitHub, when you connect a repository.
- Authorities — when we are legally required to, or to protect the rights, safety, and security of our users and the platform.
6. Data retention
We keep account and application data for as long as your account is active. When you delete a project it is soft-deleted and recoverable for a short window before permanent deletion. When you close your account we delete or anonymise your personal data within a reasonable period, except where we must retain records (such as invoices) to meet legal obligations.
7. Security
We protect data in transit with TLS and encrypt secrets at rest using AES-256-GCM. Passwords are stored only as salted hashes. Access to production systems is restricted and logged. No system is perfectly secure, but we work to protect your data and to notify you promptly of any breach that affects you, as required by law.
8. Your rights
Depending on where you live, you may have the right to access, correct, export, or delete your personal data, to object to or restrict certain processing, and to withdraw consent. You can exercise most of these directly in the dashboard, or by emailing [email protected]. We will respond within the time required by applicable law.
9. Cookies
We use strictly necessary cookies to keep you signed in and to protect against cross-site request forgery. We also use an analytics cookie, set by PostHog on our own domain, to recognise your browser across visits to our website and dashboard for the analytics and session recordings described in section 2. We do not use advertising cookies.
10. International transfers
The platform and your services run in Hetzner data centres in Germany and Finland. Some of the providers listed in section 5 process data in other countries, including the United States. Where we transfer personal data across borders, we use appropriate safeguards as required by applicable law.
11. Children
Helicarrier is not directed to children under 16, and we do not knowingly collect their personal data. If you believe a child has provided us data, contact us and we will delete it.
12. Changes to this policy
We may update this policy from time to time. When we make material changes we will update the date above and, where appropriate, notify you by email or in the dashboard.
13. Contact
Questions about this policy or your data? Email [email protected].