Cookie & Storage Notice
Everything heliocad.com and app.heliocad.com store in your browser, what it is for, and how to change your choices.
Effective August 15, 2026
Overview
HelioCad sets no third-party cookies and loads no advertising or third-party analytics scripts. Fonts are self-hosted. What we do store falls into two categories:
- Necessary (always on): your sign-in session, preferences, autosave drafts, bot protection on sign-in, and the record of your consent choice.
- Analytics (your choice): a first-party page-view beacon and the three small keys it needs. In the EU, EEA, UK and Switzerland it runs only after you accept; elsewhere it runs by default and you can turn it off. It is always off when your browser sends a Global Privacy Control signal.
Necessary cookies (both sites)
These are the only cookies HelioCad itself sets. Both are shared between heliocad.com and app.heliocad.com so you make one choice.
| Name | Type | Purpose | Lifetime |
|---|---|---|---|
hc_consent | Cookie on Domain=heliocad.com | Your consent choice: analytics on or off, when and where you chose (banner, preferences, browser signal or regional default), and which consent model applied. Lets both sites honor the choice without asking again. | 12 months |
hc_geo | Session cookie on Domain=heliocad.com | Two-letter country code from your connection, set at our website's edge. Used only to pick the opt-in or opt-out consent model without a network lookup. | Until you close the browser |
Analytics (your choice)
With analytics on, each page view sends one small beacon to engine.heliocad.com. It contains the page URL (query strings removed, except utm_ campaign tags), the referring site without its query string, your screen width, a random session ID, and a yes/no flag for whether this browser has visited before. Our server adds a pseudonymous visitor hash that changes every day, browser and OS family, device type, and country; your IP address is used to build the hash and to rate-limit, and is not stored with the event. Events are kept for 13 months. Beacons carrying a Sec-GPC: 1 or DNT: 1 header are discarded.
The same beacon also reports the outcome of the bot check on the sign-up and sign-in pages — whether it passed silently, had to show you a checkbox, or failed — so we can tell a quiet day apart from a security check that is locking people out. It carries a short outcome name and nothing else new: no account, no email address, no form contents. With analytics off, none of it is sent.
| Key | Type | Purpose | Lifetime |
|---|---|---|---|
_hc_seen | localStorage | A single yes/no flag: this browser has visited before. Not an identifier. | Until cleared, or removed when you turn analytics off |
_hc_sid | sessionStorage | Random session ID so page views within one visit can be grouped. | Until the tab closes; renewed after 30 minutes idle |
_hc_last | sessionStorage | Time of the last page view, used for the 30-minute session window. | Until the tab closes |
Turning analytics off removes these keys immediately and stops the beacon. Nothing is written before you choose in the EU, EEA, UK and Switzerland.
app.heliocad.com storage
The application keeps its working state in your browser so it loads fast, remembers your setup, and can recover unsaved work. None of it is used for tracking. All entries are necessary or functional and are not subject to the analytics choice.
| Key | Type | Purpose | Lifetime |
|---|---|---|---|
sb-<ref>-auth-token | localStorage | Your sign-in session (Supabase Auth). It is not a cookie. | Until you sign out or the session expires |
heliocad-* | localStorage (about 20 keys) | UI preferences and workspace state: panel and rail layout, navigation, tool defaults and presets, named views, render, simulation, CAM, drawing, laser and machine-control settings, sketch palette, keyboard shortcut box. | Persistent |
heliocad:* | localStorage / IndexedDB | Onboarding and nudge bookkeeping (which guides you dismissed, install-prompt snooze, unit and plane picker preferences) and draft index and recovery hints. | Persistent |
heliocad:draft:* | IndexedDB | Autosave of unsaved work so it can be recovered. | Until saved or cleaned up (about 30 days) |
heliocad:cookie-consent-posted | localStorage | Notes that your latest cookie choice was already recorded on your account, so we don't record it twice. | Persistent |
helio_ws_client_id | sessionStorage | Identifies this tab to the live-update connection. | Until the tab closes |
helio_capture_session | sessionStorage | Links your phone to the desktop during a photo capture session. | Until the tab closes or the capture ends |
helio_spec_sheet_mode | localStorage | Remembers when the AI shows a spec sheet before building. | Persistent |
heliocad_pending_invite_token | localStorage | Holds a team invitation while you sign in or sign up. | Until the invite is accepted |
mouseControlsGuideDismissed, autoValidateModel | localStorage | Remembers that you dismissed the mouse-controls guide; your auto-validate preference in AI chat. | Persistent |
| Service worker cache | Cache Storage | Caches the app's own static files so it loads fast and can be installed to a home screen. No personal data. | Managed by the browser; refreshed when the app updates |
Third-party components
heliocad.com loads no third-party scripts at all. Its hosting provider, Vercel, keeps standard server logs. On app.heliocad.com:
- Cloudflare Turnstile runs in an embedded frame from challenges.cloudflare.com on the sign-in and sign-up pages to block bots. It sends your IP address and browser information to Cloudflare and may store data on its own domain under Cloudflare's privacy policy. Strictly necessary; not subject to the analytics choice.
- Cloudflare CDN fronts app.heliocad.com and engine.heliocad.com. When it runs a security check it may set its own cookies (for example
__cf_bmorcf_clearance). Strictly necessary. - Google-hosted <model-viewer> loads from ajax.googleapis.com only on public share pages (app.heliocad.com/view/<id>) to display the shared model in 3D and AR. Google sees the request for the script (IP address, browser string). Necessary to display the shared model; not loaded anywhere else.
Your choices
- Change your analytics choice any time with (also in the footer of every page and under Account → Privacy in the app). Your choice is kept for 12 months and applies to both sites.
- A Global Privacy Control signal from your browser turns analytics off automatically and locks it off; the dialog then shows "Opt-out preference signal honored". See Do Not Track and Global Privacy Control in the Privacy Policy.
- You can also clear cookies and site data in your browser settings. Clearing
hc_consentmakes us ask again; blocking necessary storage will stop sign-in from working. - Questions: privacy@heliocad.com. How the data is used is described in the Privacy Policy.