HeliomPrivacy Policy
This policy explains what data the Heliom application (“Heliom”, “the Service”) collects, what it stores on your device, why, who it is shared with, how long it is kept and how you can have it deleted. It describes the Service as it actually works today.
1. Who we are
The Service is operated by Heliom Labs LLC (“Heliom Labs”, “we”, “us”), a company incorporated in New Mexico, United States.
Registered address: 8206 Louisiana Blvd NE, Ste A #7492, Albuquerque, NM 87113, USA
Contact for any privacy request: admin@helliomlabs.com
2. What Heliom does
Heliom lets a creator upload a video once and publish it to their own accounts on YouTube, TikTok, Instagram and Facebook, from a single screen. We act only on the accounts you have explicitly connected, and only for the publications you have explicitly confirmed.
3. The short version
Heliom is deliberately built to hold as little as possible:
- There is no user account and no user database. You do not register with Heliom and you do not create a password. You sign in to each platform directly, and that is the only sign-in there is.
- We never store your videos. No video file is written to our servers or to any storage service. See section 6.
- We store nothing about you on our side. The only thing that persists between visits is a cookie in your own browser, described in section 4. The one exception is the waitlist on our website: if you choose to join it, we keep the contact details you give us, only to tell you when Heliom launches (section 5).
- There are no third-party scripts, no advertising and no tracking of any kind in the Service. Our website only counts page views in aggregate, without cookies or identifiers (section 5).
4. Cookies and information stored on or read from your device
Heliom stores information on your device, and reads it back, by placing cookies in your browser. This is the only way in which Heliom accesses your device. We set these cookies ourselves; we do not allow any third party to place, access or read cookies, identifiers or similar technology on your device through the Service.
Each cookie holds the authorisation issued by one platform when you connected it. The contents
are signed with a secret key (HMAC) so that they cannot be modified, and every cookie is set
HttpOnly (unreadable by scripts in the page), Secure (sent over HTTPS
only) and SameSite-restricted.
| Cookie | What it contains | Purpose | Lifetime |
|---|---|---|---|
heliom_google | The OAuth access and refresh tokens issued by Google for your YouTube channel. | To display your destination channel and to upload the video you selected. | 30 days |
heliom_session | The OAuth tokens issued by TikTok. | To display your TikTok account and publish the video you selected. | Up to 30 days |
heliom_facebook | The OAuth token issued by Meta for your Facebook Pages and linked Instagram accounts. | To display your Pages and accounts and publish the video you selected. | 55 days |
These cookies are strictly necessary: without them the Service cannot know which accounts you connected and cannot publish anything. They are not used to profile you, to follow you across websites, or for advertising or measurement.
Heliom uses no other storage on your device — no local storage, no session storage, no IndexedDB, no device fingerprinting, no advertising identifier, no web beacons or pixels.
You can remove a cookie at any time by disconnecting the platform inside Heliom, or by clearing
your browser's cookies for app.helliomlabs.com. Doing so ends the connection
immediately; nothing about it remains on our side, because nothing was kept there.
5. Data we collect
| Category | What it is | Where it lives |
|---|---|---|
| Platform authorisations | The access and refresh tokens issued by Google/YouTube, TikTok and Meta when you connect an account. | Only in the cookie in your browser (section 4). We keep no copy. |
| Connected-account details | The name, handle, profile picture and identifier of the account or channel you are about to publish to. For an Instagram professional account, also its biography, its follower, following and post counts, and its six most recent posts (thumbnail, type and link), so you can confirm it is the right account. | Fetched live from the platform each time the page needs to show it, displayed, and discarded. Never written down. |
| Content you submit | The video file, title, description, caption and privacy setting you choose for a publication. | Held in memory only for the duration of the transfer. Never written to disk. See section 6. |
| Technical data | IP address, browser type, request URL, timestamps and error messages. | In the standard request and function logs of our hosting provider, Netlify, under Netlify's own retention policy. We keep no separate log or database. |
| Waitlist (only if you join it) | The first name, last name, email address, country and — if you give it — phone number you enter on the waitlist form of www.helliomlabs.com, whether you also agreed to receive a text message, the language of the page, the page you signed up from and the date. | In our waitlist store on Netlify (Netlify Blobs), until we have announced the launch and for no more than 12 months, or until you ask us to remove you. |
The waitlist. Joining the waitlist is optional. We use your details only to tell you when Heliom launches — and, if you later create a Heliom account with the same email address, to pre-fill your name on it: by email, and also by text message if — and only if — you ticked the separate box for it. We do not sell them, we do not use them for advertising and we do not share them with anyone except our hosting provider and, when the launch message is sent, the service that delivers it. The form sets no cookie. To limit abuse, the server keeps a one-way fingerprint of your IP address combined with the hour of your request, from which the IP address cannot be read back. You can leave the waitlist at any time by using the unsubscribe link in our email, by replying STOP to a text message, or by writing to admin@helliomlabs.com.
Paid founder reservation. If you reserve a spot by paying your first month, we also keep your answers to the plan questions (what you do, how many accounts and videos, and your optional reason), the plan you chose, its price and the status of your payment, to open your account at launch and to handle refunds. The card payment is processed by Whop, which receives your payment details directly; we never see your card number. Emails about your reservation are sent through Brevo. We keep these records as long as needed for your account and for our accounting obligations.
Prices in your currency. To show prices in your currency, our website asks our hosting provider, Netlify, which country your IP address belongs to. Only the two-letter country code is used; we do not store it or your IP address. Your browser keeps that country code in its session storage until you close the tab. If you choose a region and currency yourself in the menu at the top of the page, your browser remembers that choice (for example “eu”) in its local storage, so the next visit uses it; it is never sent to us, and you can change it at any time from the same menu or by clearing the site's data in your browser.
Counting visits. To know how many people visit our website, each page you open on www.helliomlabs.com sends us a small anonymous count: the page, the day and time (to the minute), the type of device (phone, tablet or computer, from your browser’s description), the country (from your IP address, as for prices), the website you came from (its name only, for the first page of your visit) and whether it is the first page of your visit. We store no IP address, no cookie and no identifier, so these counts cannot be linked to you or to each other. Your browser keeps a “first page seen” marker in its session storage until you close the tab. Counts are kept in our statistics store on Netlify (Netlify Blobs) for no more than 24 months.
6. What happens to your video
Your video is never stored by Heliom.
- For YouTube and TikTok, the file does not pass through us at all: your browser uploads it straight to the platform's own upload endpoint, using an upload session that Heliom opens on your behalf.
- For Facebook and Instagram, Meta does not offer a pre-signed upload address, so the bytes are relayed through our server functions in one-megabyte chunks. Each chunk is held in memory, forwarded to Meta and immediately discarded. Nothing is written to disk and nothing is retained after the transfer.
7. What we never do
- We do not sell, rent or trade your personal data or your content.
- We do not use your content, or data obtained through any platform API, to train machine-learning or artificial-intelligence models.
- We do not use your data for advertising, ad targeting, measurement or profiling.
- We do not read, download or analyse content from your connected accounts beyond what is strictly needed to show you which account will receive the publication, to publish what you asked us to publish and to report the result.
- We do not publish anything without your explicit, per-publication confirmation.
- We do not add a watermark, a mention or any content of our own to what you publish.
8. Google and YouTube API Services
Heliom uses YouTube API Services. By connecting a YouTube account you also agree to be bound by the YouTube Terms of Service, and the Google Privacy Policy applies to Google's handling of your data.
Heliom's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.
We use exactly two endpoints: channels.list, to show you the destination channel
before you publish, and videos.insert, to upload the video you selected. We do not
read your watch history, your subscriptions, your comments or your analytics, and we do not
display or embed YouTube content.
We store no YouTube API Data. Channel details are fetched live each time they
need to be displayed and are never written to any store, so there is nothing for us to refresh,
update or delete on a schedule. The only persistent item is your authorisation in the
heliom_google cookie, which expires within 30 days and is removed immediately when
you disconnect.
You can revoke Heliom's access to your Google account at any time at myaccount.google.com/permissions.
9. TikTok and Meta
When you connect a TikTok, Facebook or Instagram account, the platform authenticates you directly; we never see your password. Platform tokens stay in the cookie described in section 4 and are never sent back to the page.
You can disconnect an account from inside Heliom at any time, or revoke access from the platform itself — in Facebook and Instagram under Settings › Apps and websites, in TikTok under Settings › Security › Manage app permissions.
10. Who we share data with
We share only what is necessary, and only in order to do what you asked:
- The platforms you selected — we send them your video and the text you wrote, at your request, on your own accounts.
- Our hosting provider, Netlify — which serves the Service, records the standard request logs described in section 5 and stores the waitlist.
- The service that delivers our launch message — if you joined the waitlist, only your email address (and phone number, if you agreed to a text message), only to send that message.
- Public authorities — only where we are legally compelled, and only to the extent required.
We have no advertising partner, no third-party analytics provider and no data broker.
11. Paying for Heliom
Heliom is not charging for the Service at this stage. When subscriptions open, payment will be handled entirely by our payment provider: we will receive only a subscription status and a transaction reference, and will never see or store your card number or mobile-money PIN. This policy will be updated before that happens.
12. Legal bases (GDPR)
- Performance of a contract — connecting the platforms you chose and publishing the videos you confirmed.
- Legitimate interest — security, fraud prevention and diagnosing failures.
- Consent — for anything optional, such as joining the waitlist and receiving the launch message, which you may withdraw at any time.
The cookies in section 4 are strictly necessary to provide a service you explicitly requested, and are set only once you choose to connect a platform.
13. Your rights
You may request access to your data, correction, deletion, restriction, portability, or object to a processing. Write to admin@helliomlabs.com and we will answer within 30 days. If you are in the European Union, you may also lodge a complaint with your national supervisory authority.
If you joined the waitlist, write to us from the address you used and we will remove you.
Otherwise, because Heliom keeps no user record, there is usually nothing for us to retrieve
or erase: disconnecting a platform, or clearing your browser cookies for
app.helliomlabs.com, already removes everything Heliom held. Content already published
on a platform is no longer under our control — you must delete it on that platform yourself.
14. Security
All connections use TLS. Cookie contents are signed with a secret key and are never exposed to scripts in the page. Platform tokens are never sent to the browser as readable values. No system is perfectly secure; if a breach affects your data we will notify you and the competent authority as required by law.
15. Children
Heliom is not intended for anyone under 18. We do not knowingly collect data from minors. If you believe a minor is using the Service, write to admin@helliomlabs.com.
16. Changes to this policy
We may update this policy. The date at the top always reflects the current version, and we will announce in the application any change that materially affects your rights.