Privacy Policy

Last updated October 30, 2026.

LLM Research Labs LLC operates Helpful Mods. This policy explains how we handle information when you browse our website, contact us, or use purchase and download services when they are offered. Email support@helpfulmods.com to ask about your information or make a privacy request.

Account sign-in and optional analytics described below apply only where those features are made available. Browsing the public catalog does not require an account or permission for analytics.

Information we handle

Website visits. Our hosting and security services receive information needed to serve requests, such as IP address, browser and device information, requested pages, time of access and error information. The pages request fonts from Google Fonts, which receives connection information when your browser makes those requests. Font requests are separate from the optional analytics described below.

Account sign-in, when available. Our account service uses Google Firebase Authentication. Available methods are Google, GitHub, and email with a password and verified email address. An optional authenticator-app second factor can protect the account. SMS, Apple and passwordless email sign-in are not offered by this configuration.

Firebase and your chosen sign-in provider process the identifiers, email address, available profile details and verification information needed to authenticate you. Firebase also processes browser and connection information to secure sign-in and prevent abuse. We use the verified account identity, provider and security state to control access. Firebase manages passwords and verification/reset messages. Authentication material is kept in origin-scoped browser session storage; it is not sent to our AI support system. See Firebase's privacy information.

Connecting another sign-in provider requires your explicit agreement and recent authentication. Sharing an email address does not automatically merge accounts or purchases. A support email alone does not authorize removing an authentication factor, changing ownership or deleting an account.

Purchases and account services, when offered. We process the information needed to identify the purchaser, record a license and provide access. This can include a verified account identifier, contact information, quotes, mod and license details, amounts and currencies, Stripe customer and payment identifiers, payment and refund status, included fix-access dates, fulfillment records and download grants. The commerce service uses an opaque buyer ID, stores order records in Cloudflare D1 and keeps private source archives in Cloudflare R2 behind access checks.

If an agent-purchase feature is offered and you create purchase authority, we also record its permitted products, spending limit, expiry, reservations and revocation status. The order database and application logs do not retain raw card details, shared payment tokens or merchant API keys. Payment credentials are processed by Stripe and any wallet you choose. Do not send full card numbers to support.

Support email. Mail to support@helpfulmods.com is received by our Stalwart mailbox on an OVH-hosted server. The mailbox receives the original email, including any attachments. Our automated support worker uses the sender and recipient addresses, subject, plain-text message and thread headers to organize a request and prepare a reply. It does not download or open attachment contents or send those attachments to the AI provider. An attachment can still remain in the original mailbox message.

For routine answers, support may send the subject and plain-text message to OpenAI's API with approved public product information, and may send an automatic email reply in the conversation. Billing, account and privacy requests are recorded for further review rather than treated as authority for automatic account or financial changes. Support keeps request status, delivery receipts and limited message identifiers to avoid duplicate work and replies. Email alone does not authorize an ownership change or account deletion.

Please remove passwords, API keys, full payment information and customer records that are not needed to explain the problem.

Optional website analytics

Where analytics is enabled, you can choose No analytics or Allow analytics. We load Google Analytics only after you allow it. Declining leaves the public site available. The integration sends no Google Analytics requests, including consent-only pings, before that choice. Existing Google Fonts requests are separate.

After consent, Google processes a pseudonymous cookie identifier, browser and device information, geographic information derived from the connection, and activity on selected public pages. Our supplied events use fixed public page information and known catalog product identifiers. They can indicate that a mod was opened, a public package plan was used, or catalog search or the setup example was used. They do not contain search text, example answers, names, email addresses, account IDs, order/payment information or support messages. Visits containing query strings, unknown fragments or unapproved routes are omitted. Analytics is excluded from authentication, account, checkout, private-resource and support-message screens.

Google's normal consented visit/session events may also occur. Optional automatic form, scroll, outbound-link, video and file-download detection is disabled, as are Google Signals, user-provided-data features, optional account sharing and advertising personalization. Granular device and location collection remains enabled. We use this information to understand use of the public site; we do not use this integration for advertising audiences.

You can change your choice through Analytics settings, then No analytics. This stops further collection by the integration. With working browser storage, the control remembers your choice, removes its analytics cookies and reloads the page to unload the tag. If the browser prevents saving the choice, the control explains the problem and collection remains stopped on that page; you may be asked again on a later page. A Global Privacy Control or Do Not Track signal also blocks analytics, including a previously remembered permission. Withdrawal does not recall information Google has already received. See the Cookie Policy for storage periods and controls.

How we use it

We use information to serve the website, answer inquiries, fulfill orders, provide licensed downloads and included fixes, maintain accurate payment and access records, investigate defects, prevent abuse and comply with legal obligations.

Where a privacy law requires a legal basis, these activities may rely on performing an agreement with you, our legitimate interests in operating and securing the service, a legal obligation, or your consent when it is required. You can decline an optional feature and still browse the public catalog.

Optional website analytics relies on your permission. Withdrawing it does not affect the lawfulness of processing that occurred while it applied.

AI processing and other providers

For an AI-assisted email reply, we may send the subject and plain-text inquiry to OpenAI's API with approved product information. The integration asks OpenAI not to retain a stored Responses object. This setting does not eliminate every provider log or override OpenAI's applicable security, abuse-monitoring or legal retention rules. OpenAI states that API data is not used to train its models by default. OpenAI's business-data practices

Hosting, security, account, payment and support providers process the information needed for their services. Stripe may act as a processor or as an independent controller, depending on the payment activity. If you choose Link or another wallet, its own account and privacy terms also apply. Stripe Privacy Policy

We may disclose information when required by law, to address fraud or a security incident, to protect legal rights, or as part of a business transfer subject to applicable protections. We do not publish private conversations in the catalog or make customer source downloads publicly available.

The mods you run yourself

Buying source does not send us your application's customer records, provider credentials or private setup answers. Your installed mod runs in the environment you configure. It may send information to providers or destinations you choose, according to the mod's documented behavior. You are responsible for the notices, permissions and retention settings for your own application. Information you later choose to share with our support team is covered by this policy.

Retention and deletion

Our support email system is configured to delete message content, replies, receipts and event history after 30 days from receipt. It also permanently deletes messages older than 30 days from the dedicated support mailbox, including original attachments and sent copies, during housekeeping. A content-free hash used to prevent duplicate processing remains until 90 days after receipt. Contact support@helpfulmods.com to request review or earlier deletion of support information.

These periods describe the active support systems. Deleting an email does not immediately erase every backup or a provider's security, abuse-monitoring or legally required records. We have not verified a complete deletion timetable for hosting-provider backups.

Payment, license, consent, security and dispute records may need to be kept separately for their business or legal purpose. Provider retention is governed by the applicable provider terms and legal obligations. A request to delete support information does not itself cancel or refund an order.

Firebase retains authentication records until we initiate deletion of the associated user; removal then follows Google's published retention rules. Ending a browser session or clearing its storage does not delete those provider records. To request account deletion, contact us so we can verify the request and explain any separate records that must be retained. This does not promise that purchase, license or support records disappear with the sign-in identity. Firebase retention information

For optional Google Analytics, user-level and event-level retention are each set to two months, with resetting on new activity turned off. Google processes expired data through its monthly deletion cycle. This setting does not impose a two-month deletion deadline on standard aggregated reports, which may remain longer. It is separate from the browser's analytics-cookie lifetime. Google Analytics retention information

We keep other information for as long as needed for the purpose described here, including providing access to licensed purchases, accounting, resolving disputes and meeting legal obligations. Ask us about the records associated with your account or request deletion through the contact methods below.

Your choices

You may ask to access, correct or delete information about you. Depending on where you live and which law applies, you may also have rights to a copy of your data, restriction, objection, withdrawal of consent, an authorized-agent request or a complaint to a privacy regulator. We may need to verify your identity and authority before acting. We will explain if a legal obligation or another applicable exception prevents the requested action.

Browser settings let you remove or block site storage. This does not remove support emails or a provider's own records. See our Cookie Policy.

Global Privacy Control and Do Not Track block the optional analytics described here. They do not prevent sign-in, checkout or other essential functions that you request. We will update this notice before introducing materially different tracking or on-site chat processing.

Children, international processing and changes

Helpful Mods is intended for people building and operating software products and is not directed to children under 13. If you believe a child under 13 has provided personal information, contact us so we can investigate and take appropriate action.

Our service providers may process information in the countries where they operate. The protections and transfer requirements that apply depend on the information, provider and relevant law. Contact us for information about a particular request or service.

We will post changes to this policy with a new date and provide additional notice when a material change or applicable law requires it.