This page lists every cookie and every piece of browser storage the Helix dashboard uses. It is short because there is little to list: one essential sign-in cookie, a handful of on-device preferences, and — only while you are setting a password from an emailed link — that link’s one-time token, held just for that tab. There are no advertising, analytics, or tracking cookies, and no third party sets any cookie here. That is true of every page, including our public demo site: the page-view counting we run on the demo (described below) uses no cookie and no browser storage of any kind, so this list stays complete.
The one cookie
| Name | What it does | Lifetime |
|---|---|---|
helix-token | Keeps you signed in. It holds a digitally signed (not encrypted) token identifying your account: your account id, email, name (if provided), role, company, and the session’s expiry time. It is marked httpOnly (scripts on the page can never read it), Secure (sent only over HTTPS in production), and SameSite=Lax (not sent on cross-site requests). | Up to 24 hours — it expires with your sign-in session, and is removed when you sign out or when your sessions are revoked. |
It is set when you sign in (or when you complete an invitation or password reset, which signs you in), and there is no version of the product without it — an authenticated portal cannot work without a session cookie.
Why there is no cookie consent toggle
Consent banners exist to let you refuse optional cookies — analytics, advertising, cross-site tracking. Helix sets none of those, so there is nothing to refuse: the one cookie above is strictly necessary, and the only “setting” that affects it is signing out. The demo site’s page-view counting does not change this, because it stores nothing in your browser to refuse — clearing site data or blocking cookies has nothing of its to clear. Because this cookie ties your session to your identified account, Quebec law (Law 25) requires us to tell you about it and about any means to deactivate it: there is no means to deactivate it, because the service cannot function without it. Deleting it in your browser simply signs you out. If we ever add an optional cookie, we will add a real consent control before it ships.
The demo site is different
On our public demo (demo.helixsensors.com) there is no login: the site sets helix-token automatically for every visitor, signing you into a single shared, read-only demonstration account. That cookie identifies the shared demo account — not you — and contains no information about you. It lasts up to one year so the demo stays signed in between visits, and if you delete it, an identical one is issued on your next page load. This automatic cookie exists only on the demo site; the real portal sets it only when you sign in.
On-device storage (localStorage)
The app also remembers a few things in your browser’s local storage. These values stay on your device — our servers never read them. (Your display preferences are additionally saved to your account when you change them in Settings; that server-side copy is covered by the Privacy Policy.)
| Key | What it remembers |
|---|---|
helix:preferences:<your email> | A local copy of your display preferences (theme, timezone, formats) so the app can apply them instantly while it loads. |
helix-tour-seen:<your email>, helix-viewer-tour-seen:<your email> | That you have dismissed the first-run walkthroughs. |
helix:analytics:recent:<your email> | Your recently opened sensors and scans in the analytics workspace’s search, so they can be offered again. Despite the word “analytics” in the key, this is a recent-items list for a screen of that name — not usage measurement. |
helix:ui:sheetHeight, helix:viewer:sidebar, helix:viewer:sidebar:open, helix:viewer:browser, helix:viewer:workbench, helix:dashboard:chartLayout, helix:dashboard:forecastScheme | Remembered panel sizes and layout in the viewer, and how the asset dashboard arranges and colours its charts. |
helix.glbRepair.v1 | Technical retry counters used when recovering a failed 3-D model load. |
helix:cookie-notice:v2 | That you dismissed the cookie notice, so it isn’t shown again. |
You can clear all of this at any time through your browser’s site-data controls. The app keeps working; it just forgets these conveniences (and clearing the cookie signs you out).
Storage that lasts only until you close the tab (sessionStorage)
One thing is held in session storage instead, which the browser erases when the tab closes. It is never written to disk for later visits and never reaches another tab.
| Key | What it remembers |
|---|---|
helix:magic-token | The one-time token from an invitation or password-reset link, while you are on the page that uses it. We take the token out of the web address as soon as the page opens — so it is not left in your address bar, your browser history, or the referrer sent to later requests — and the tab holds it instead, so reloading the page does not strand you with a link you can no longer use. It is deleted the moment the link is used, and erased when you close the tab. |
Page-view counting on the demo site
The public demo (demo.helixsensors.com) runs Vercel Web Analytics so we can tell whether the demo is being used. It is the only usage measurement in the product — the server logs and sign-in rate limiting described in the Privacy Policy are separate, and are about running and securing the service rather than measuring how it is used — and within the product it is deliberately confined to the demo: the signed-in dashboard loads no analytics script at all. Its data is aggregate — how many views a page got, roughly where from — never a list of people. (Our marketing site, helixsensors.com, counts page views the same cookieless way under its own privacy notice. It is a separate site with no access to any Helix account.)
- It sets no cookie and writes nothing to your browser. That is why the tables above are still the complete list.
- It records the page path, the referring site, and a country and device type worked out from your request. Counting repeat visitors without identifying them is Vercel’s job, not ours: they state that they derive a short-lived hash from the request rather than storing your IP address, and that it is not usable to identify you or to follow you across sites. We take no part in that step and never receive an IP address, a visitor list, or anything we could tie to an account — Vercel documents what it collects, and that document, not this page, is the authority on how their side works.
- It records nothing about what you click inside the demo — page views only.
- To opt out entirely, use the dashboard rather than the demo, or block
/_vercel/insightsin your browser’s content blocker. Nothing about the demo depends on it.
What we do not use
- No analytics or usage-measurement cookies, anywhere — and no analytics script at all on the signed-in dashboard. The demo site’s cookieless page-view counting is described above and is the only exception.
- No advertising or cross-site tracking of any kind.
- No third-party cookies — no other company sets or reads anything here.
- The dashboard tracks nothing, so browser signals like “Do Not Track” and Global Privacy Control have nothing to switch off there. On the demo site, those signals do not currently stop the page-view count — it collects no cookie and no identifier that survives the day, so there is nothing for them to withdraw.
Changes and contact
If we ever change what is stored in your browser, we will update this page and the date at the top before the change ships. Questions go to our privacy officer: Cohen Van Kalsbeek - CTO and Co-founder, info@helixsensors.com, 1774 Billington Rd, Bowen Island, BC, Canada - V0N 1G2.