Privacy Policy
Last updated: 2026-05-31
This Privacy Policy explains how Max Shing ("we", "us", or the "Licensor") handles information in connection with the desktop application Helmfolio ("the Software"). We have designed the Software to be local-first and privacy-respecting.
1. Summary
Your trading data stays on your device. We do not operate a server that collects, stores, or analyzes your financial data. The Software runs locally and talks to third parties only when you explicitly ask it to (for example, syncing from IBKR or activating your license).
2. Data stored locally on your device
The following data is stored only on your computer (in your operating system's application data directory and/or local browser storage), never transmitted to us:
- Imported trades, open positions, NAV history, cash transactions, and any CSV or Flex data you load.
- Display preferences (theme, display name, optional portrait image).
- Your IBKR Flex token and Query ID, encrypted at rest by your operating system (via Electron safeStorage). These are sent only to Interactive Brokers' Flex Web Service through a local backend process when you choose to sync, and only to retrieve your own statements.
3. Data sent to third parties (only when you act)
- Interactive Brokers (IBKR): when you sync, your Flex token and Query ID are sent to IBKR's servers to download your statements. This is governed by IBKR's own terms and privacy policy. We are not affiliated with IBKR.
- License activation: when you activate or validate a license, your license key and a non-identifying device identifier (a hashed machine ID) are sent to our licensing service and to our payment/licensing provider (Lemon Squeezy) to verify entitlement and enforce device limits. We do not receive your payment card details; those are handled by the payment provider.
- Benchmark / market reference data: the Software may request publicly available market index data to display comparisons. These requests do not include your trading data.
4. Payments
Purchases are processed by our payment and licensing provider, Lemon Squeezy, which acts as merchant of record. Their handling of your billing information is governed by their privacy policy. We receive only the information needed to issue and manage your license (such as your email and license key status).
5. What we do not do
- We do not sell your data.
- We do not run analytics, advertising, or behavioral tracking inside the Software.
- We do not store your trades or financial data on our servers.
6. Data retention and deletion
Because your data lives on your device, you control it. You can export it to a JSON file, clear it from within the Software's Settings, or delete the application's data directory at any time. License records held by our licensing/payment provider are retained as required to administer your purchase and comply with law.
7. Security
We use reasonable measures to protect the limited data we handle (for example, OS-level encryption for stored credentials and signed license tokens). No method of storage or transmission is completely secure, and we cannot guarantee absolute security.
8. Children
The Software is not directed to individuals under the age of 18, and we do not knowingly collect data from children.
9. International users
Where applicable law (such as GDPR or similar regimes) grants you rights to access, correct, or delete personal data, you may exercise those rights by contacting us. Because most data never leaves your device, many such requests are fulfilled by you directly within the Software.
10. Changes
We may update this Privacy Policy from time to time. Material changes will be reflected by the "Last updated" date above.
11. Contact
Questions about this policy: [email protected]
Governing jurisdiction: Hong Kong