Privacy Policy

1. Who we are

Co-Help is a desktop application for Windows and macOS, a backend service that powers its AI features, and the website at co-help.com (together, the “Service”). The Service is operated by Techtonic Innovations LLC, a Virginia limited liability company based in Reston, Virginia, USA (“Techtonic”, “we”, “us” or “our”).

Techtonic Innovations LLC is the controller (the business responsible) for the personal information described in this policy. You can reach us about anything in this policy at Help@TechtonicInnovations.com.

This policy should be read together with our Terms of Service.

2. Summary

• Your interview profile, conversations, transcripts and knowledge base stay on your machine. They are saved in the app’s data folder on your own computer, not on our servers.
• On our servers we keep a small account record: your name, email address, a hashed password (never the password itself), and your plan and billing status, plus the Stripe identifiers needed to link your purchase to your account.
• AI requests pass through our backend, are answered and discarded. To give you an answer, the app sends the relevant text (and any screenshot you take) to our backend, which forwards it to the AI providers listed in section 5 and returns the result. Our backend does not save that content and our logs are configured not to record it. We log only request metadata, such as the time, which AI model provider answered, how long it took and (for audio) the upload size, never the content.
• Payments are handled by Stripe. We never see or store your full card number.
• We do not sell your personal information and we do not “share” it for cross-context behavioral advertising.
• The website uses Google Analytics (with Google Consent Mode) and Cloudflare Web Analytics. You can accept or decline analytics cookies at any time; see section 15.

3. Information we collect

3.1 Account information

When you create an account in the app we collect your name, email address and password. Your password is sent only over an encrypted connection and is stored, on your device and on our servers, only as a one-way scrypt hash, never as the password itself. We also record your account role and status, your plan, how the account was created, and when it was created and last signed in.

3.2 Purchase and billing information

Purchases are made through Stripe (Stripe Payment Links, Stripe Checkout and the Stripe customer portal). Stripe collects your payment card details, billing details and email address directly and processes them under the Stripe Privacy Policy. From Stripe we receive your email address, your Stripe customer ID, your Stripe subscription ID (for subscriptions), the Stripe checkout session ID, the plan you bought and its payment status, and later changes to that status (for example renewals, cancellations, refunds or failed payments). We never receive your full card number.

3.3 Content you process with the app

This is the information that makes Co-Help useful during a call. It is kept on your device, and it passes through our backend only for as long as it takes to answer a request:

• Call audio. When you start listening, the app captures your computer’s system audio (the other side of your call) using your operating system’s screen/audio capture permission, and can fall back to your microphone. Short audio segments are sent over an encrypted connection to our backend, which forwards each one to Groq for speech-to-text and returns the text. Audio is held in memory only for the duration of the request and each upload is capped at 10 MB.
• Transcripts, questions and answers. The transcribed text, questions you type, and the answers you receive.
• Your profile and knowledge base. Information you enter during setup, such as your name, job title, background, resume, projects, stories, notes, the role or job description, company information, documents you upload (PDF, DOCX, text) and web pages you add by link. Files are parsed on your device, and linked web pages are fetched directly from your device.
• Screenshots. When you use screenshot Q&A, the app captures an image of your screen on your device and sends it through our backend to a vision-capable AI provider. Anything visible on your screen at that moment is included, so close anything you do not want processed.
• GitHub content (optional). If you connect GitHub (see 3.8), relevant excerpts of code from your repositories.

To generate an answer, the app includes the relevant parts of this content in the request it sends to our backend. Please do not include information you are not permitted to share (for example, another person’s confidential information or an employer’s trade secrets), and avoid including sensitive personal information such as health, financial account or government ID details in your profile or knowledge base.

3.4 Device and app information

When the app contacts our backend, our hosting provider receives your IP address and standard request details. The app checks for updates by requesting a version file from our website and downloading new versions from GitHub Releases; installers downloaded from this website are served from Google Cloud Storage. Those requests reveal your IP address, and the app version, to the service that answers them. The app does not include any third-party analytics, advertising or crash-reporting software.

3.5 Usage metadata and service logs

Our backend writes operational logs. They include a request identifier, timestamps, the type of event (for example “answer returned” or “token issued”), which AI provider answered and how long it took, which providers failed and an error code, the size in bytes of an audio segment, your plan, your Stripe customer ID and checkout session ID for purchase events, and, for account events (such as account creation, account synchronization and changes made by our administrators), your email address. Our hosting platform (Google Cloud Run) also records standard web request logs, including your IP address, user agent, the requested path, response status, latency and response size. Logs are configured to never record the content of your requests or answers (transcripts, prompts, audio, screenshots), request bodies, passwords, password hashes or your license token.

3.6 Website information

• Google Analytics 4 collects information about your visit, such as pages viewed, referring site, approximate location derived from your IP address, and device and browser information. Whether it may set cookies depends on your choice and your region; see section 15.
• Cloudflare Web Analytics runs on our homepage. It is a cookieless page-performance and visit counter that does not use cookies or local storage to identify you.
• Downloads after checkout. After you pay, the download page sends the Stripe checkout session ID from the page address to our backend, which confirms the payment with Stripe and records a pending purchase (see section 4) so your purchase is recognized when you sign up in the app.
• Third-party content. Our pages load fonts from Google Fonts and scripts from cdnjs (Cloudflare) and jsDelivr. These services receive your IP address and browser information when your browser requests those files.

3.7 Support emails and demo requests

If you email us, we receive your email address and whatever you include in your message. If you request a demo on our homepage, the name, email address, company, message and preferred date and time you enter are delivered to our inbox by EmailJS (EmailJS Privacy Policy). If EmailJS is unavailable, the form instead opens a pre-filled email in your own mail program, and nothing is sent until you send that email yourself.

3.8 GitHub connection (optional)

You can connect GitHub in the app’s setup screen, either by signing in with GitHub or by pasting a personal access token. The app uses that authorization, directly from your device, to read your GitHub profile, repository information and file contents from GitHub’s API, and includes relevant code excerpts in AI requests as described in 3.3. Your GitHub token is stored on your device, encrypted (using your operating system’s credential protection where it is available). It is not sent to our backend. You can remove it with Disconnect in the GitHub Connection section of setup, and you can revoke Co-Help’s access at any time in your GitHub account settings. GitHub processes your information under the GitHub General Privacy Statement.

3.9 Internal notifications

When a new account is created, our systems may send an internal notification containing the new account’s name and email address to a messaging tool used only by our team, so we can welcome and support new users.

3.10 Emails we send

We do not send marketing emails. Stripe sends payment receipts and billing emails on our behalf. We email you ourselves only to answer your messages or about your account, purchases, security or changes to our terms or this policy.

4. What stays on your device and what reaches our servers

5. AI providers (sub-processors)

Co-Help does not run its own AI models. Our backend sends each answer request to several AI providers at the same time and returns the first good answer. By default a request goes to the flagship pool (OpenAI, Anthropic and Google). If that whole pool is unavailable, the app retries with a broader pool (OpenAI, Anthropic, Google, DeepSeek and Mistral AI) and then a fast pool (Groq, OpenAI, Google and Anthropic). Screenshot requests go only to providers that accept images (OpenAI, Anthropic and Google). All speech-to-text goes to Groq.

As of the date of this policy, these are the only AI providers that receive request content:

DeepSeek processes data in China. When the flagship pool is unavailable, text answer requests can be sent to DeepSeek, which processes and stores data in the People’s Republic of China, where the law may allow government authorities to access it. Screenshots and audio are never sent to DeepSeek.

We use these providers’ developer APIs, not their consumer chat apps. Each provider processes request content under its own API terms, subject to each provider’s API data policies, which may allow it to keep content for a limited period (for example, for abuse and misuse monitoring). Google applies different data-use terms to paid and unpaid Gemini API services; please review the linked policies. We will update this section before any additional AI provider begins receiving request content.

6. How we use information and our legal bases

We use personal information only for the purposes below. If you are in the European Economic Area (EEA), the United Kingdom or Switzerland, the right-hand column shows the legal basis we rely on under Article 6 of the GDPR (and the UK GDPR and Swiss law).

We do not use your interview content to train AI models, we do not make decisions about you based solely on automated processing that produce legal or similarly significant effects, and we do not build advertising profiles. Where we rely on legitimate interests, you can object (see section 12). Where we rely on consent, you can withdraw it at any time without affecting processing that happened before.

7. How we share information

We do not sell personal information, and we do not share it for cross-context behavioral advertising (as those terms are defined in the California Consumer Privacy Act, as amended). We have not done so in the last 12 months. We disclose personal information only:

• To service providers that process it for us: Google Cloud (hosting on Cloud Run, Firestore database, Secret Manager, Cloud Logging and Cloud Storage, in the United States); the AI providers in section 5; Stripe (payments); EmailJS (demo-request delivery); Google Analytics and Cloudflare (website analytics); and our email and team-messaging providers.
• At your direction, for example to GitHub when you connect it.
• For legal reasons: to comply with law, a court order or other legal process; to protect the rights, property or safety of you, us or others; or to enforce our Terms of Service.
• In a business transfer: as part of a merger, acquisition, financing or sale of assets, in which case this policy will continue to apply to your information unless you are notified otherwise.

8. How long we keep information

We may keep information longer where the law requires it, or where it is needed to resolve a dispute, prevent fraud or abuse, or enforce our agreements, and only for as long as that need lasts.

9. Security

We use administrative, technical and organizational measures designed to protect personal information, including: encryption in transit (HTTPS/TLS) between the app, the website and our backend; AI provider keys and our signing secrets held in Google Secret Manager and never shipped in the app; passwords stored only as scrypt hashes; license tokens stored only as keyed hashes; database records keyed by keyed hashes of email addresses; encryption at rest provided by Google Cloud; rate limiting and input validation on our backend; and access to production systems limited to authorized personnel. On your device, your license token and GitHub token are encrypted using your operating system’s credential store where it is available.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If you believe your account or license token has been compromised, tell us at Help@TechtonicInnovations.com so we can revoke it. If a data breach affects your personal information, we will notify you and the relevant authorities as the law requires.

10. International data transfers

We are based in the United States and our backend and database run in the United States. If you use the Service from outside the United States, your information is collected and processed in the United States, whose data-protection laws may differ from those where you live. Our service providers may process information in the United States and other countries; as described in section 5, Mistral AI is based in France and DeepSeek processes data in the People’s Republic of China.

Where personal information of people in the EEA, the UK or Switzerland is transferred to a country that has not been found to provide adequate protection, we rely on the European Commission’s Standard Contractual Clauses (with the UK International Data Transfer Addendum and Swiss amendments where relevant) as incorporated in our providers’ data processing terms, or, where no such mechanism is available, on the transfer being necessary to perform our contract with you at your request (GDPR Art. 49(1)(b)). You can ask us for more information about these safeguards using the contact details in section 19.

11. Your privacy rights

Depending on where you live, you may have some or all of the rights below. We extend the core rights of access, correction and deletion to all users, wherever they live.

• Access / know: confirm whether we process your personal information and get a copy of it.
• Correction: fix inaccurate information.
• Deletion: ask us to delete your information.
• Portability: receive your information in a portable, machine-readable format.
• Objection and restriction: object to, or ask us to limit, certain processing.
• Withdraw consent: where we rely on consent, withdraw it at any time.
• Opt out: of sale, of sharing for targeted advertising, and of profiling (we do none of these).

How to exercise your rights

Email Help@TechtonicInnovations.com from the email address on your account, with the subject line “Privacy Request” and the right you want to exercise. Information stored only on your device is under your control: you can view it in the app, and delete it by removing the app’s data folder.

• Verification. To protect you, we verify requests by confirming that they come from the email address on the account, and we may ask for information that matches our records (for example details of your purchase). We will not ask for more information than we need.
• Authorized agents. You may use an authorized agent. We will ask the agent for proof of your signed permission, and may ask you to verify your identity with us directly, unless the agent holds a valid power of attorney.
• Timing. We respond within the time the law that applies to you requires (for example, one month under the GDPR and 45 days under US state laws), and we will tell you if we need an extension that the law allows.
• Deletion. When we delete your account, we delete your account record and revoke your license tokens so AI access stops. Deleting your account does not cancel a Stripe subscription by itself; cancel it first (see our Terms) so you are not billed again. We may keep limited information where the law requires or allows it (for example, transaction records needed for tax purposes).
• No discrimination. We will not deny you the Service, charge you a different price or provide a different quality of service because you exercised a privacy right.

12. EEA, UK and Swiss residents

If the GDPR, the UK GDPR or the Swiss Federal Act on Data Protection applies to you, you have the rights to access, rectification, erasure, restriction of processing, data portability and to object to processing based on our legitimate interests, and the right to withdraw consent at any time. The legal bases we rely on are listed in section 6. Providing account and payment information is necessary to enter into a contract with us; without it we cannot provide the paid Service.

You also have the right to lodge a complaint with a data-protection supervisory authority, in particular in the country where you live or work or where you believe an infringement occurred. In the UK this is the Information Commissioner’s Office, and in Switzerland the Federal Data Protection and Information Commissioner. We would appreciate the chance to address your concern first, so please contact us.

13. California residents (CCPA/CPRA)

This section is our notice at collection and privacy policy disclosure under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (“CCPA”). In the last 12 months we collected the categories of personal information below. We collect them from you, from your device, and from Stripe, for the business purposes described in section 6, and keep them for the periods in section 8.

We do not collect inferences to profile you, and we use sensitive personal information only to provide the Service and keep it secure, as the CCPA permits, so the right to limit its use does not apply. We do not knowingly sell or share the personal information of consumers under 16.

Your California rights. You have the right to know what personal information we collect, use and disclose (including specific pieces); to delete it; to correct inaccurate information; to opt out of the sale or sharing of personal information (we do neither); to limit the use of sensitive personal information (which we do not use for any purpose that triggers this right); and not to be discriminated against for exercising these rights. To exercise them, follow section 11. We will confirm receipt within 10 business days and respond within 45 calendar days, extendable once by another 45 days with notice. We honor Global Privacy Control signals as described in section 16.

Shine the Light. We do not disclose personal information to third parties for their own direct-marketing purposes.

14. Virginia and other US states

Residents of Virginia (Virginia Consumer Data Protection Act) and of other US states with comprehensive privacy laws, such as Colorado, Connecticut, Utah, Texas and Oregon, may have the rights to confirm whether we process their personal data and to access it, to correct it, to delete it, to obtain a portable copy, and to opt out of targeted advertising, the sale of personal data, and profiling in furtherance of decisions with legal or similarly significant effects. We do not sell personal data, use it for targeted advertising, or profile you in that way. We process sensitive data (such as account log-in credentials) only as needed to provide the Service. To exercise your rights, follow section 11. We respond within 45 days, extendable once by another 45 days where reasonably necessary, with notice.

Appeals. If we decline to act on your request, you may appeal by emailing Help@TechtonicInnovations.com with the subject line “Privacy Appeal” within a reasonable time after our decision. We will respond in writing within 60 days, explaining what we did and why. If your appeal is denied, you may contact your state Attorney General; Virginia residents can contact the Office of the Attorney General of Virginia at www.oag.state.va.us.

15. Cookies, analytics and your choices

Our website uses Google Analytics 4 with Google Consent Mode, and your choice controls whether Google Analytics may set cookies:

• In the EEA, the UK and Switzerland, analytics cookies are off by default and are set only if you click Accept.
• Elsewhere, analytics cookies are on by default and you can turn them off at any time by clicking Decline.
• Advertising features are always off. We set Google’s advertising consent signals (ad storage, ad user data and ad personalization) to “denied” for everyone and disable Google Signals and ad personalization in our analytics configuration.
• When analytics cookies are declined or not yet accepted, Google Analytics does not set or read cookies. Google may still receive basic, cookieless signals (such as the page, the time, browser details and the fact that consent was not given) that it does not use to identify you.
• We show a banner on your first visit so you can choose. Your choice is saved in your browser’s local storage (not a cookie) under the name ch_consent. When you decline, we also remove any Google Analytics cookies already set on our domain.

Stripe sets its own cookies on its checkout pages under the Stripe Privacy Policy. The desktop app does not use cookies for tracking.

You can change your choice at any time:

You can also block or delete cookies in your browser settings, or install the Google Analytics Opt-out Browser Add-on. Learn how Google uses information from sites that use its services at business.safety.google/privacy, and about Cloudflare in the Cloudflare Privacy Policy.

16. Do Not Track and Global Privacy Control

We honor Global Privacy Control (GPC) and Do Not Track (DNT) browser signals on co-help.com. If your browser sends either signal, we keep Google Analytics cookies off for that browser, we do not show the cookie banner, and we treat the signal as a valid request to opt out of the sale or sharing of your personal information (which we do not do in any case).

17. Children

The Service is intended only for adults. You must be at least 18 years old to use it. We do not knowingly collect personal information from anyone under 18. If you believe someone under 18 has given us personal information, contact us and we will delete it.

18. Changes to this policy

We may update this policy from time to time. We will post the updated version on this page and change the “Last updated” date above. If we make material changes, we will give you notice in advance, for example in the app, by email to the address on your account, or on this website, and where the law requires your consent to a change, we will ask for it.

19. Contact us

Techtonic Innovations LLC
Reston, Virginia, USA
Email: Help@TechtonicInnovations.com

For privacy requests, please use the subject line “Privacy Request” (or “Privacy Appeal” for appeals).