Privacy Policy

Effective date: October 13, 2026 · Last updated: October 13, 2026

Helix OnRoad is built by engineers who love traveling with their families. We care about our own families’ privacy — and especially our children’s — so we designed Helix OnRoad to collect only the personal information necessary to plan your trips. We don’t use advertising trackers, we don’t build features that let anyone track you, and we never sell your data.

1. Who we are

The Helix OnRoad consumer service (“Helix OnRoad”, “Helix”, “we”, “us”, “our”) is operated by Yuga LLC, a Delaware limited liability company with offices at Princeton Junction, NJ 08550 (“Yuga”, the “Company”). Yuga is the data controller responsible for the personal information described in this policy. The service is delivered through the website at helix-onroad.com and the Helix OnRoad apps for iOS and Android. This policy explains what personal information we collect when you use those surfaces, how we use it, who we share it with, and the choices you have.

2. Information you provide

When you create an account we collect your email address and, at your option, a display name (any name of your choice — it does not have to be your legal name). When you use the trip-planning features you may also provide: a home base address (stored as the text label you searched plus the geocoded latitude and longitude), vehicle details (make, model, fuel type, EV range and reserve), travel preferences (quiet-hours window, daily drive-time cap, distance unit, EV charger types), food preferences (cuisine bands, dietary needs), and the trip plans and itinerariesyou build (origin, destinations, waypoints, saved stops and restaurant shortlists). If you subscribe to a paid tier, Stripe collects your payment details directly — we never see or store your full card number.

3. Categories of personal information we collect

The table below summarises the categories of personal information we collect, why we collect each, and where it comes from. The individual items are described in more detail in §2 and §4.

Category	Examples	Why we collect it	Source
Identifiers & account	Email address, optional display name, opaque account id	Create and secure your account; sign you in	You; Supabase
Location	Home-base label + geocoded latitude/longitude; precise device location while the app is in use; trip origins, destinations, and waypoints	Plan routes, show your position, suggest nearby stops	You; your device (with permission)
Vehicle & preferences	Make, model, fuel type, EV range/reserve, travel and food preferences	Personalise your plans	You
Trip content	Plans, itineraries, saved stops, restaurant shortlists	Provide the core trip-planning service	You
Billing	Email, billing address, subscription status, Stripe customer id (no full card number)	Manage paid subscriptions	You; Stripe
Technical & diagnostic	IP address, user-agent, API path, timestamps, redacted crash/error reports	Security, rate-limiting, debugging	Automatically

We do not collect government identifiers, we do not access your device contacts, photos, microphone, or camera, and we do not use advertising identifiers.

4. Device permissions and location

With your permission, the mobile apps use your device’s precise location (GPS) only while the app is in use (foreground) — to show where you are on the trip and to suggest nearby stops on the way to your next major stop. We do not collect location in the background, and we do not keep a continuous location history. When you start turn-by-turn directions, the app hands the route off to the maps app you choose (for example, Apple Maps, Google Maps, or Waze); that app then provides live navigation — including any location it collects in the background — under its own privacy policy, not ours. You can grant or revoke this permission at any time in your device’s system settings; the apps remain usable with location turned off (you can search for a home base or origin instead). Precise geolocation is treated as sensitive personal information under some laws — see §14. The apps do not request access to your contacts, photos, microphone, or camera. The categories we disclose in the Apple App Store privacy labels and the Google Play Data safety form are kept consistent with this policy.

5. Information collected automatically

When the website or the mobile apps talk to our servers we receive standard request metadata: the source IP address, a user-agent string, the URL or API path, and a timestamp. This is used for security, rate-limiting, and short-term debugging; request logs are retained for no more than 30 days. The apps also send crash and error reports to our self-hosted crash-reporting service (see §7). Those reports are configured with no default personally identifiable information — the SDK is set to omit IP addresses, cookies, request bodies, screenshots, view hierarchies, and the device email/username — and we apply an additional redaction pass to strip tokens and coordinates before the event is stored. We do not use advertising identifiers (IDFA / GAID), we do not embed third-party analytics or tracking pixels, and we do not use device fingerprinting.

6. Cookies and local storage

The website uses a small number of first-party cookies set by our authentication provider (Supabase) to keep you signed in and to refresh your session. These are strictly necessary for the site to function. We do not set advertising, analytics, or cross-site tracking cookies. The mobile apps store your authentication token in the operating system’s secure keychain / keystore rather than in a cookie.

7. Service providers and third parties

We use a small number of third-party services to run the product. Each processes only the data described below, under a written data processing agreement, and none is authorised to use your data for their own marketing.

Supabase — authentication and session management. Receives your email address, password (hashed by Supabase; never seen by us in plaintext), email-confirmation status, and sign-in timestamps.
Stripe — subscription billing. Receives your email address, billing address, and payment method. Stripe stores your card details on our behalf under PCI DSS; we only ever receive a Stripe customer identifier and subscription status.
Amazon Web Services — hosting and storage for our application servers, database, and encrypted backups.
Crash Log — a self-hosted crash and error reporting service. Receives the redacted crash payload described in §5, tagged with an opaque user id (never your email or name) so we can filter reports by affected user. Events are retained for 5 days.
Mapping and points-of-interest providers— when you build a trip we query our internal mapping, routing, and points-of-interest services to enrich your plan. We also use Foursquare Places and Google Places for restaurants, rest stops, and detailed charger metadata. These services receive only the coordinates or free-text search terms needed to answer the query; they do not receive your account identity.

8. How we use your information

We do not use your trip data, location, or preferences for advertising, and we do not sell your personal information. When we call third-party services on your behalf (for example, Foursquare Places or Google Places for restaurant or charger lookups), we send only the query context needed to answer the request — coordinates or free-text search terms — and never your email, name, account identifier, or any other personally identifiable information. We use the information described above to: operate the trip-planning service (compute routes, suggest breaks, shortlist restaurants and chargers, remember your preferences); create and secure your account and manage your subscription; diagnose crashes and reliability issues; detect and prevent abuse and fraud; and communicate with you about the service.

The messages we send you are transactional— sign-in confirmations, subscription receipts, and material policy changes. They are necessary to operate your account and cannot be turned off while your account is active. We will only send non-transactional(marketing) messages if you have opted in, and every such message includes an unsubscribe link.

We may create aggregated or de-identifiedinformation that cannot reasonably be used to identify you (for example, to understand usage and improve reliability), and we commit not to attempt to re-identify it.

9. Profiling and automated decisions

We use your travel, food, and vehicle preferences to personalise your plans — for example, to rank restaurants, choose breaks, and shortlist chargers that fit your inputs. This is a form of profiling carried out solely to provide the trip-planning features you ask for. We do not make decisions that produce legal or similarly significant effects about you through solely automated means, and we do not use your data for credit, employment, insurance, or similar eligibility decisions. Where state law grants a right to opt out of certain profiling, you may contact us (see §18); note that opting out of personalisation may limit core functionality.

10. Legal bases (EU / UK / Swiss users)

Where GDPR or the UK GDPR applies, we rely on the following legal bases: performance of a contract (to provide the service you signed up for and to bill for paid tiers); legitimate interests (security, abuse prevention, diagnosing crashes, and improving reliability — balanced against your rights and freedoms); legal obligation(responding to lawful requests, keeping billing and audit records); and consent where we ask for it explicitly (for example, before sending a non-transactional message).

11. Data retention

Your account data (profile, vehicles, travel and food preferences, plans, trips, saved stops, shortlists) is kept for as long as your account is active. When you delete your account (see §13) all of it is removed from our live databases immediately, and drops out of encrypted backups on the schedule described here: automated database backups are retained for 14 days (daily) and 60 days (weekly) before being expired. Crash and error reports are retained for 5 days. Request logs are retained for at most 30 days. A minimal audit-log entry recording that an account was deleted (the deleted user’s email address at the time of deletion, the action, and the timestamp) is retained for up to 2 years to satisfy security, fraud, and compliance obligations. Stripe retains billing records independently under its own retention policy as required by financial regulations.

12. Where your data is stored

Helix OnRoad is hosted in the United States, with encrypted disaster-recovery copies kept in a separate United States region. Our database is partitioned by residency region so that user data belonging to residents of a given region (for example, EU users) can be stored on and served from database shards dedicated to that region. If you access the service from outside the United States, your personal information will be transferred to and processed in the United States. Where required (for example, transfers of EU / UK / Swiss personal data), we rely on the European Commission’s Standard Contractual Clauses (and the UK Addendum where applicable) with our sub-processors.

13. Your privacy rights and how to exercise them

You have the right to access the personal information we hold about you, correct inaccuracies, receive a copy in a portable format, object to or restrict certain processing, and request deletion of your account and its associated data. Depending on where you live you may also have additional rights under laws such as the EU / UK GDPR, the California Consumer Privacy Act (CCPA / CPRA), Canada’s PIPEDA, or comparable regimes; we honour these rights regardless of your location. You can:

Update your profile (display name, home base, preferences, vehicles) from the Profile tab in the mobile app or the account settings on the web.
Delete your account yourself from the “Danger zone” section of the Profile screen in the mobile apps. Deletion cancels any active Stripe subscription, removes your row and every cascaded record (vehicles, plans, trips, sections, stops, shortlists, preferences) from our sharded database, and deletes your authentication record at Supabase. The action is immediate and cannot be undone; only the retention exceptions described in §11 apply.
Contact us at help@helix-onroad.com for access, portability, correction, restriction, or objection requests, or to delete an account you can no longer sign into. We aim to respond within 30 days and will verify your identity before acting on any request.

You will not be discriminated against for exercising any of these rights. If you are in the EU / UK / Switzerland and are not satisfied with our response, you have the right to lodge a complaint with your local data-protection authority.

14. California and other US state privacy rights

Categories collected and disclosed. In the past 12 months we collected the categories of personal information listed in §3 (identifiers and account, location, vehicle and preferences, trip content, billing, and technical/diagnostic data), from the sources and for the purposes described there. We disclose personal information to the service providers listed in §7 for those business purposes only.

No sale or sharing. We do not sell your personal information and we do not share it for cross-context behavioral advertising, as those terms are defined under the California Consumer Privacy Act (as amended by the CPRA). We have not done so in the preceding 12 months.

Sensitive personal information. The only sensitive personal information we handle is precise geolocation (§4), used solely to provide the features you request and never to infer characteristics about you. Because we do not use or disclose it for any other purpose, the CPRA right to limit the use of sensitive personal information does not change how we operate; you can disable location entirely in your device settings.

Opt-out preference signals. Because we do not sell or share personal information, there is nothing to opt out of; where your browser sends a Global Privacy Control (GPC) signal, no further action is required.

Other US states. If you reside in a state with a comprehensive privacy law (for example, Virginia, Colorado, Connecticut, Texas, Oregon, Montana, or Utah), you have rights to access, correct, delete, and obtain a portable copy of your personal information, and to opt out of targeted advertising, sale, and certain profiling — which, as described above, we do not engage in. We honour these rights regardless of where you live.

Appeals. If we deny your request, you may appeal by replying to our decision or writing to help@helix-onroad.com with the subject “Privacy appeal.” We will respond within the timeframe required by applicable law; if the appeal is denied, you may contact your state attorney general.

Authorised agents. You may use an authorised agent to submit a request on your behalf; we will ask for proof of authorisation and may still verify your identity directly.

15. Security

We take reasonable technical and organisational measures to protect your information: TLS on every network path, encryption at rest for the primary database and backups, strict IAM boundaries around production credentials, rate limiting and abuse controls at the edge, and least-privilege access for engineers. No system is perfectly secure, but we continuously review and improve these controls.

16. Children

Helix OnRoad is not directed to children under 13 (or under 16 in the European Economic Area and the United Kingdom), and we do not knowingly collect personal information from them. If you believe a child has provided us with personal information, please contact us and we will delete it.

17. Changes to this policy

We may update this policy from time to time. When we do, we will change the “Last updated” date at the top of this page and, for material changes, notify you by email or in the app before the change takes effect.

18. Contact

Questions, requests, or complaints about this policy or our privacy practices can be directed to Yuga LLC:

Email: help@helix-onroad.com
Post: Yuga LLC, Attn: Privacy, Princeton Junction, NJ 08550, USA

If you are in the EU, UK, or Switzerland, you may address GDPR inquiries — including any request relating to an Article 27 representative — to the email above, and, if you are not satisfied with our response, lodge a complaint with your local data-protection authority.