Cookies and local storage
Last updated 22 July 2026
This website
hepo.ai sets no advertising cookies and runs no third-party analytics. The only thing
stored in your browser is a theme preference under the key hepo:theme, so the page
does not flash the wrong colours on your next visit. Clearing it costs you nothing.
The widget on your site
The embed uses local storage rather than cookies, which means nothing is sent on every request
to your own server. Every key is namespaced under vsh: so it cannot collide with
your application, including when the operator console is embedded inside your own admin.
| Key | Purpose | Lifetime |
|---|---|---|
vsh:visitor | The visitor id that ties chat, recording and analytics to one record | Until cleared |
vsh:conv | Which conversation to reopen so the visitor does not lose their thread | Until cleared |
vsh:widget | Whether the panel was left open, and its position | Session |
Consent
Whether you need consent before loading the widget depends on your jurisdiction and on which modules you enable. Chat alone is usually treated as strictly necessary once a visitor chooses to open it. Session recording and analytics generally are not.
The widget can be gated on your existing consent state, so one banner governs both rather than a second one appearing beside it. Load the script only after consent, or call the widget with recording disabled until consent is given. Both patterns are documented in the widget API.
What the recorder never sites
Field values. They are masked in the browser before an event is transmitted, and there is no setting that changes this. Card entry normally lives in a cross-origin frame belonging to your payment processor and is unreachable to the recorder regardless.
Questions
If your data protection officer needs something this page does not answer, mail support@hepo.ai and we will answer it rather than pointing you at a form.