Helmley keeps what it needs to run its courses: your account, your progress on each course and your tests. None of it is sold or used for adverts, and nothing on the site tracks you. From My profile you can download what it holds about you, or delete your account.
Who's responsible
Helmley is run by , who decides what's kept and why. For any question about your data, to ask for something on this page, or to complain, write to . You'll hear back within 30 days. If you're not happy with the answer, you can complain to the Information Commissioner's Office: ico.org.uk/make-a-complaint, or 0303 123 1113.
What's kept, and for how long
Helmley keeps these to run a course you asked to join and to keep it safe; that is its legal basis for holding them (legitimate interests). Open any one for what's in it, why, and who sees it. Who sees what explains each role.
Your accountWhile you have an account
What
Your email address, when the account was made, when you last signed in, your role, how you joined and who let you in, the name you were invited under, whether the account is suspended or due to be deleted, and when your welcome emails went (one from Helmley, and one for each course you join). Supabase, which signs you in, also keeps a record of each device you're signed in on (its address and browser) while you stay signed in there. If you sign in with Google, what Google sends with it is kept with your account too: your name, email address, a link to your Google profile picture and Google's number for your account. Helmley uses the email address.
Why
To sign you in and to run the site.
Who sees it
You, and the site's admins, super admins and owners on the Admin page.
How long
While you have an account.
How you heard about HelmleyWhile you have an account
What
What you said when you signed up: how you heard about Helmley (and, if you chose "Somewhere else", where), and that you're 18 or over; and the words of the offer you were shown then.
Why
To learn which ways of finding Helmley work, and to keep a record of what you were offered and that you said you're an adult.
Who sees it
You (it's in Download my data), and owners and super admins, who use it as counts.
How long
While you have an account.
Courses you're onWhile you have an account
What
Each course you're on, invited to or asked to join: how you came to it (signing up, an invitation, asking, joining), who invited you or decided, when, and whether you left it. For a course you're on: your start date and goal, your week if you planned it (hours, days, a time and your "When …, I'll study" plan) and when you finished or put aside its set-up.
Why
To show you your courses, and to keep a private course to the people on it and a by-request course to the people let in. Your week shows on Today and helps your professor plan.
Who sees it
You (it's in Download my data), and admins, super admins and owners on the Admin page, which doesn't show your week: only you and your professor see that. A request to join a course waits there with your name and email; their email only says a request is waiting.
How long
While you have an account.
Your profileWhile you have an account
What
Your name, photo, start date, goal, which AI you use as your professor, whether you show your progress, whether you want seasonal touches, and how you like to learn if you answered (what you'd do first with something new, how much diagrams help, where you mostly study, what got in the way before). After 10 or more days without studying: the day you last studied (or joined, if you hadn't yet), each course's planned finish date then, and the day you marked recall cards if that was how you started again.
Why
So others on your courses can see you and your professor knows what you're aiming for and how to teach you. The dates from a break let Today welcome you back and, if you re-plan, show your new finish date beside the one before the break.
Who sees it
Name, photo and start date: others signed in on your courses, unless you hide your progress. Goal, how you like to learn, the dates from a break and which AI you use: you, your professor, owners and super admins.
How long
While you have an account. You can change or remove any of it on My profile, except the dates from a break, which your next break replaces.
Your progressWhile you have an account
What
For each course you're on: each step's status and notes, your check-ins, study sessions and hours, and your plan and its history.
Why
This is the course: it's how you and your professor see where you are.
Who sees it
Which steps you've passed, skipped or are working on: others signed in on the same course, unless you hide your progress. Everything: you, your professor, owners and super admins.
How long
While you have an account, including after you leave a course: if you rejoin, you carry on where you stopped.
Your testsWhile you have an account
What
Each practice round and test: which questions you were given, when, how long it took, your score and the topics you missed. Tests are marked automatically by the database; if you think a mark is wrong, write to the address at the top of this page.
Why
To mark tests and apply the course's rules (for example, how often you can retake one), and to list the topics you've missed in two or more tests under Topics to firm up in the Guide.
Who sees it
You, your professor, owners and super admins.
How long
While you have an account.
PlacementWhile you have an account
What
If you took the ten questions in a course's set-up: which questions you were given, when, and for each step whether you got its question right. Your answers themselves aren't kept. Taking it again replaces the last result.
Why
To suggest steps you could test out of, and so your professor knows where to start.
Who sees it
You (in the set-up and in Download my data) and your professor.
How long
While you have an account.
Links you've markedWhile you have an account
What
Each link in the Guide you've marked Works or Broken: the link, the course and step it's in, whether your professor added it, and when.
Why
To move the links you've finished into the step's Done list, and so a broken one is checked again and replaced.
Who sees it
You (it's in Download my data), and your professor, who sees the ones you marked Broken. Admins see how many learners marked a course link Broken, never who.
How long
While you have an account. Undo in the Guide removes a mark.
Recall cardsWhile you have an account
What
For each recall card you've marked: how sure you said you were the last time, whether you got it, how many times you've marked it (and how often you were sure but missed it), when you last marked it and when it comes back.
Why
To bring each card back at the right time: soon if you missed it, later if you knew it. A card you were sure of but missed is also listed under Topics to firm up in the Guide until you get it right.
Who sees it
You (it's in Download my data). Your professor and the admins don't see it.
How long
While you have an account. Leaving a course keeps them, as it keeps your other records there.
Extra time on testsWhile you have an account
What
Only if an admin gives you extra time: the setting itself (1.5 or 2 times the usual 90 seconds a question). The reason isn't kept on the site; it stays in your email to the admins.
Why
So the database gives you that time on every test and marks it fairly.
Who sees it
You (on a test's rules card and in Download my data), admins, super admins and owners.
How long
While you have an account. Each change is in the record of admin actions.
Plans from your professorWhile you have an account
What
Each plan your professor sends through Helmley's connector, with its message, whether you applied or declined it, and when. Each plan belongs to one course.
Why
So your professor can reshape your course, and you decide on every change.
Who sees it
You and your professor. Helmley opens the links in a plan, when it's sent and once a week after, to check they still work; that record keeps the links only, not who they're for, and admins see how many plans use a link that has stopped working.
How long
While you have an account.
Your professor's notesUntil you delete them
What
Short notes your professor saves about you through Helmley's connector: a goal, a struggle, what you agreed or something else, with which AI wrote it, when, and whether it was later marked out of date. A note is about one course, or about you on every course.
Why
So your professor remembers you in a new chat, on your phone or on another AI.
Who sees it
You (on My profile and in Download my data), and your professors: an AI you've connected reads the notes for the course it's helping with and the ones about you. Admins don't see them.
How long
Until you delete them on My profile (one at a time or all at once) or delete your account. A professor can mark a note out of date but can't delete it.
AIs you've connectedUntil you delete your account
What
Each AI you connect as your professor through Helmley's connector: its name, when you approved it, whether it's signed in now, and when it last used Helmley and how many times (not what it read), and when you disconnected it. The AI's own entry in Helmley's sign-in is removed the day after if nobody approved it, or a week after everyone who approved it has disconnected it.
Why
So you can see which AIs can reach your learning and disconnect any of them, and so Helmley can tell you when your AI has really connected.
Who sees it
You (on My profile and in Download my data). Admins don't see it.
How long
A connected AI keeps its access until you disconnect it on My profile, which cuts it off at once. The record stays until you delete your account.
Your request to joinDeclined: 30 days. Approved: while you have an account
What
The email, name and answers you gave on Request access.
Why
So an admin can decide on it.
Who sees it
Admins, super admins and owners, on the Admin page. Their email only says a request is waiting, without your details.
How long
Declined, or approved but the account is gone: deleted 30 days after the decision. Approved: while you have an account. Waiting: until an admin decides.
Messages from a suspended account90 days after an admin deals with them
What
What you write on the Account suspended page.
Why
So admins can look at a suspension again.
Who sees it
Admins, super admins and owners, on the Admin page. Their email only says a message is waiting, without its text.
How long
Deleted 90 days after an admin has dealt with it.
The record of admin actionsWhile Helmley runs; emails go once there's no account
What
Who invited, approved, declined, withdrew, suspended or restored whom, who changed whose role or test time, and who asked to delete their account or changed their mind, with dates, the roles given and whether the person was told.
Why
So every decision about people can be checked later.
Who sees it
Admins, super admins and owners.
How long
As long as Helmley runs. Once a person has no account (declined, invitation withdrawn, or deleted), their email is removed after 30 days, or straight away when they delete their account; the lines stay, under an anonymous id.
NotificationsUntil you turn them off
What
If you turn notifications on for a device: that device's address at its maker's push service (Apple, Google or Mozilla), the two keys its browser gives for writing to it, a label such as "iPhone", and your choices (plans, retakes, study reminder days and time, and a pause if you set one). Each notification sent is noted (which kind, and when) so none goes twice. For a study reminder, the note also says when you next opened Helmley after it, and whether it was a question instead: if three reminders in a row go by without you opening Helmley, the next one asks whether the time still suits you.
Why
To tell you a plan has arrived, a retake is open, or it's the study time you picked, and to ask rather than keep reminding you when that time stops suiting you.
Who sees it
You (My profile lists your devices). Each notification is encrypted for your device, so the push service that carries it can't read it.
How long
A device: until you turn notifications off there, sign out there, or the push service says it's gone. Your choices: while you have an account. The note of what was sent: 30 days.
When a page breaksThe example: 30 days after that error was last seen
What
If something on a page goes wrong: the error, which of the site's files it came from, the page, your browser in a few words (such as "Safari 26, iPhone") and whether you were signed in. Not your name, email, account or address: those are taken out before anything is kept. Each kind of error is kept once, with a count and the latest example.
Why
So broken pages are found and fixed.
Who sees it
Admins, super admins and owners, on the Admin page.
How long
The example is cleared 30 days after that kind of error was last seen; the error itself and its count stay.
On your deviceUntil you sign out there
What
Your sign-in, a working copy of your progress, anyone else's progress you last looked at, and your light or dark theme, in the browser's storage. There are no cookies. The site's own pages and files are also kept, so Helmley opens without a signal: they hold nothing about you.
Why
To keep you signed in and make the pages quick.
Who sees it
Only that browser.
How long
Someone else's progress: until you go back to your own. Your progress: cleared when you sign out there, or the next time the site opens in that browser after you've been signed out, or when someone else signs in there. The theme stays until you change it.
Who sees what
You
Everything about you. Only you can change your profile and progress; admins can change your role or suspend your account.
Others on your courses
Signed in only: your name, photo, start date and which steps you've passed, skipped or are working on. Turn off "Show my progress to others on my courses" on My profile and they see nothing.
Your professor
Whatever your professor, an AI you connected, reads through Helmley's connector: your profile, progress, tests and course, the links you marked Broken, and its notes about you. Your professor's own service (Claude, ChatGPT, Gemini or another) handles that under your account with them.
Admins
Account details (name, photo, email, role, how you joined, last sign-in), requests to join and messages. Not your goal, notes, check-ins or scores.
Owners and super admins
The people who run Helmley. Your whole profile, progress and tests, read-only, plus what admins see, to help learners and look after the site.
If an admin invites you or approves your request, your welcome email names them, and a reply goes to their email address.
Helmley is built and looked after with Claude, Anthropic's AI. While fixing a problem it may read records in the database. What it reads stays in that working session; it's never copied into the build log, documents or code.
Where it's kept
Supabase holds the database and signs you in, in . Its server functions (invitations, emails, your professor's connector) run in whichever of its locations is nearest the request, which can be outside the UK. It keeps technical logs, such as the address a request came from, for a short time.
Brevo sends the site's emails: invitations, sign-in codes and notices. It keeps a log of each email (who it went to, the subject and when) for .
Cloudflare hosts the pages, answering from whichever of its locations is nearest you, which can be outside the UK. Like any web host, it logs the address of a visit for security. It also counts visits to each page (Cloudflare Web Analytics): page views, the site a visit came from and the country, with no cookies, nothing kept in your browser and nothing that identifies you or follows you between visits. Owners see only the totals. When you sign up, its Turnstile check looks at your browser for a moment to tell a person from a bot, under Cloudflare's privacy terms.GitHub forwards the site's old address here and stores the weekly backups (below).
Google, if you sign in with Google: its button loads from Google when you open the sign-in panel, so Google sees that visit, and when you use it Google knows you signed in to Helmley. Under Google's privacy terms.
Apple, Google or Mozilla, if you turn notifications on: your device's maker carries them to it, encrypted, under its own terms.
Anthropic, through Claude, as above.
Each works under its own privacy terms. The site's fonts and code are served from the site itself, so a visit sends your address only to the site's host (Cloudflare) and Supabase, never to font, script or analytics companies. Scripts from elsewhere come only from Cloudflare itself: its visit counter, and the sign-up check. The one other is Google's sign-in button, which loads from Google when you open the sign-in panel.
Backups
Once a week the whole database is copied, encrypted, to private storage, so Helmley can recover from a disaster. Each copy is deleted automatically after 12 weeks and is never used for anything else. A copy from 19 October 2026, made before this page existed, has been removed from that storage; GitHub may keep it, still encrypted, until its own clean-up. If a backup is ever restored, the restore steps delete again any account deleted since.
What you can do
Get a copy: Download my data on My profile gives you one file with what Helmley holds about you. Test questions and answers are left out, so the tests stay fair, and so are Supabase's records of your signed-in devices: write to the address above for those.
Correct it: change your profile and progress yourself. For anything else, write to the address above.
Delete your account: on My profile (below is what happens).
Object, or ask for less to be done with your data: write to the address above.
Can't sign in (for example, a suspended account)? Write to the address above for any of these.
Deleting your account
14 days to change your mind
Day 0You ask, on My profile
You're hidden from others on your courses and signed out on every device. The AIs you connected as your professor lose access.
Days 1–14Changed your mind?
Sign in again and choose Cancel deletion: everything comes back as it was.
Day 15Deleted
Your account and everything tied to it: profile, photo, progress, tests, plans, your professor's notes and messages. Your request to join goes too, and your email is removed from the record of admin actions; its lines about your account stay under an anonymous id, which is also kept with the date so a restored backup can't bring the account back. Backup copies roll off within 12 weeks.
The site always needs an owner: the only owner has to make someone else an owner before deleting their account.
Changes
When this page changes, the date at the top changes too.