Privacy by design.
Helios Gather is built for people who need useful answers without giving up control of the data behind them.
What we collect
When you create an account, we collect your name, email address, password hash, organization and workspace membership, and the forms you create. When a respondent submits a published form, we store the answers, the published form version, timestamps, and limited submission metadata needed to operate the service. If a form includes a file-upload question, respondents may also submit PDF, JPEG, or PNG files up to 5 MB each; those files are split into private chunks in the Cloudflare D1 database and linked to the form response. Upload storage is capped at 100 MB across this Forms deployment.
Why we use it
We use this information to authenticate users, enforce workspace permissions, save and publish forms, accept responses, provide response and analytics views, export authorized data, prevent misuse, maintain audit history, and improve reliability. We do not use response content for advertising or sell it.
Who can access it
Workspace members can access resources only where their server-side membership and role allow it. Public respondents can access only a published form and submit bounded answers; they cannot browse workspace resources. Workspace members with response access can download files attached to those responses. Cloudflare processes the application and database data under its service terms.
Cookies and choices
Essential cookies support authenticated sessions and security. If you accept optional analytics, Helios Gather loads Google Analytics to receive page-view events using a path with form, response, and invitation identifiers removed. Form answers and uploaded file contents are not sent to Google. Advertising signals and personalization are disabled. You can change this choice from the “Cookie settings” control in the site footer or the persistent page control after your first choice. Rejecting optional analytics does not disable essential sign-in or security cookies. Google processes analytics data under its own service terms and privacy practices.
Retention and deletion
Data is retained while it is needed to provide the workspace service, preserve published versions, support audit and security investigations, or meet a documented legal obligation. Deletion workflows are being expanded alongside the account and workspace lifecycle. Deleting a form removes its stored uploads; individual response deletion and automated retention controls are not currently available. Do not submit regulated health, payment-card, or children’s data to this development release.
Your requests
You may request access, correction, export, or deletion of account and workspace data through the designated Lucion Global privacy contact. Requests are authenticated before private data is disclosed and are processed with workspace isolation. If a request cannot be completed automatically, it is escalated for human review.
Children and regulated data
Helios Gather is not designed for knowingly collecting information from children under 13, protected health information, or payment-card data in this release. If your use case involves those categories, obtain a product and legal review before collecting them.
Contact and changes
For privacy questions, use the private Lucion Global contact described in the project’s security policy. We will update this notice when the product’s data practices materially change and will keep the version date visible.