--- title: "Cookie Notice - Helix" description: "Every cookie and browser-storage item Helix sets, what each one does, how long it lasts, and why it does not need your consent. helix.id itself stores nothing." source: "/privacy/cookies" updated: "2026-09-17" --- # Cookie Notice Last updated 17 September 2026 - Version 1.0 This notice lists every cookie and every other item Helix stores on your device, what each one does, how long it lasts, and why it does not need your consent. It goes with our Privacy Notice at , which explains everything else about how we handle personal information. We would rather list the items than describe them in categories, so you can check what we say against what your browser shows you. ## The short version On our corporate site, helix.id, we store nothing. No cookies, no browser storage. In our product, the customer dashboard and the verification widget, we store a small number of items. All but one are strictly necessary: without them you could not sign in, the site could not protect you against forged requests, and the verification flow could not remember which step you are on. The one exception remembers whether you chose the light or dark theme. We do not use analytics cookies anywhere. Our analytics runs in a cookie-free configuration that stores nothing on your device, and session identifiers are removed before anything reaches it. We do not use cookies for advertising, and we do not allow anyone else to. ## Why these items do not need your consent The law that governs storage on your device, PECR in the UK and the ePrivacy Directive in the EU, does not require consent for items that are strictly necessary to provide a service you have asked for. Signing in, staying signed in, and being protected from cross-site request forgery are that kind of item. Each row below says which purpose it serves. The theme preference is not strictly necessary. You set it by choosing a theme, it exists only to honour that choice, and you can clear it at any time. That is the kind of appearance setting the law treats as exempt from consent where the user has chosen it, provided we tell you about it, which is what this row does. ## Corporate site: helix.id We store nothing on your device when you visit helix.id. Until 15 September 2026 the site carried a consent banner supplied by Termly, which stored two items of its own. The banner has been removed and those items are no longer set. If you visited before that date, you may still have them in your browser; clearing site data for helix.id removes them. ## Product: cookies | Name | What it does | How long it lasts | Why it is necessary | | -------------- | --------------------------------------------------------------------------------------------------------------------------------------- | ----------------- | ------------------- | | access\_token | Keeps a dashboard user signed in | 1 hour | Sign-in | | id\_token | Carries the signed-in user's identity details, name and email, to the dashboard | 1 hour | Sign-in | | refresh\_token | Renews the dashboard session so you are not signed out every hour | 30 days | Sign-in | | csrf\_token | Protects against cross-site request forgery. Readable by the page by design, so it can be sent back on each request | 30 days | Security | | helix\_jwt | Keeps an end user signed in after passkey or voice verification, including inside a partner's embedded widget | 30 minutes | Sign-in | | helix\_session | Identifies the verification attempt in progress and links it to our abuse and bot checks. Removed before anything reaches our analytics | 1 hour | Security | ## Product: browser storage that is not a cookie The law treats local storage and session storage the same way it treats cookies, so we list them too. | Name | What it does | How long it lasts | Why it is necessary | | ---------------------------- | -------------------------------------------------------------------------------------------------------------- | -------------------- | ----------------------------------------------------------------------------------- | | helix\_flow\_id | One-time reference that ties the steps of a single sign-up together. Deleted as soon as the account is created | The browser tab only | Sign-up flow | | capsule\_credential\_present | Remembers that this device already has a credential, so we show you sign-in rather than sign-up | Until you clear it | Sign-in flow | | voice-enrollment-completed | Remembers that voice set-up finished, so you are not sent through it twice | The browser tab only | Set-up flow | | helix.vercel.session | Signs in users who reach the dashboard through the Vercel marketplace | The browser tab only | Sign-in, Vercel users only | | vite-ui-theme | Remembers your light or dark theme choice | Until you clear it | Not strictly necessary. A preference you set, honoured until you change or clear it | ## Where a business uses voice matching Some businesses configure our technology so that you are matched against a voice you set up earlier. In that case an encrypted voice reference is created and held on your own device. It is never sent to Helix. It is storage on your device, so we mention it here, though it exists only because you set up that feature. Clearing that site's data or removing the passkey you created removes it, and once the key is gone what remains cannot be unlocked by anyone, including us. Our End-User Processing Notice at explains the voice check itself. ## Analytics We use PostHog to understand how our site and product are used. It runs in cookieless mode on both. It sets no cookies, stores nothing on your device, receives no IP address, and receives no session identifier, because we remove identifiers before events are sent. Session recording is off. What it receives is aggregate usage: which pages and features are used, how often, and whether they work. ## Advertising We do not use cookies or any other storage for advertising. We do not permit third parties to place tracking technologies on our site or in our product to target advertising at you, and we do not share information with advertising networks. ## How to clear these items Your browser settings let you view and delete cookies and site storage for helix.id and for any partner site where you used our verification widget. If you clear the necessary items you will be signed out and, where a business uses voice matching, you will need to set up your voice reference again. Clearing the theme preference returns the dashboard to its default appearance. ## Changes to this notice This notice changes whenever the items we store change. Changes are approved before they are published, and we keep every previous version and its approval record. The version and date at the top tell you which one you are reading. ## Contact Questions about this notice: . Our Privacy Notice at explains who we are, how to contact our UK and EU representative, and what rights you have. ## Sitemap See the full [sitemap](https://helix.id/sitemap.md) for all pages.