Privacy
The Helicon desktop app has no account, no sign up and no telemetry. Nothing about your code, prompts, threads or files ever leaves your machine. It makes one network request on its own behalf, an update check. This website is separate and does use analytics, described below.
Last updated · Markdown version
The app and the website are different things
Helicon is a desktop and web application you run. helicon.sh is a marketing site. They collect very different amounts, so they are described separately, and installing one does not opt you into the other.
The desktop app
| What happens | |
|---|---|
| Account | There is none. No sign up, no email, no profile. |
| Your code | Never leaves your machine. |
| Your prompts and threads | Never leave your machine. They go to Muse Code, through the muse CLI you installed. |
| Your files | Read locally by the daemon, shown locally in the viewer. |
| Credentials | Never stored or handled. Authentication belongs to your own muse login. |
| Local state | SQLite on your own disk: projects, sessions, turns. |
| Telemetry | None. There is no analytics SDK in the app. |
| Crash reports | Not collected. |
The one outbound request the app makes for itself is the update check. It asks helicon.sh whether a newer version exists. That request tells us three things: the platform, the version, and a weekly rotating hash of the IP address it came from. The hash is how an install is counted as alive without keeping an address. It is not linked to anything else, because there is nothing else to link it to.
This website
helicon.sh uses PostHog for product analytics. It is on, it includes session replay, and pretending otherwise would be the wrong way to open a privacy page.
| Collected | Detail |
|---|---|
| Page views | Which pages, in what order, and when you leave |
| Clicks | Autocapture, plus named events: downloads, GitHub links, demo plays, copied commands, platform tabs, FAQ toggles |
| Heatmaps and dead clicks | Where people click, including clicks that do nothing |
| Session replay | A reconstruction of the page as you used it. Every input field is masked before it is recorded. |
| Approximate location | Derived from IP by PostHog, at country and city level |
| Device and browser | User agent, and the platform hints your browser sends |
| Installer downloads | Recorded server side: which installer, your platform, which button, the asset and version |
Cookies
helicon-anon, set by this site, a random identifier with a one year lifetime, so a returning visit is not counted as a new person.- PostHog's own cookie and local storage entries, for the same purpose.
- No advertising cookies, no third-party trackers, and nothing sold or shared with data brokers.
Fonts are self-hosted and served from helicon.sh, so reading this page makes no request to Google. The AlternativeTo badge in the footer is a local file for the same reason.
Who else is involved
| Service | What it sees | Why |
|---|---|---|
| Vercel | Standard request logs for this site | Hosting |
| PostHog (US) | The analytics above | Understanding what the site does and does not explain |
| GitHub | Your download, when you take a release | Releases are hosted there, and GitHub counts them |
| Meta | Whatever you send Muse Code | The agent is theirs. Helicon is not in that path. |
What you can do about it
- Block the analytics. A content blocker stops PostHog, and the site works identically without it.
- Use the app offline from this site entirely. It only needs helicon.sh for the update check.
- Ask for deletion. There is no account, so the only identifier is a random cookie value. Send it and it will be removed.
- Read the source. Everything described here is in a public MIT repository, including the analytics code.
Contact and changes
Questions or a deletion request: open an issue on GitHub, or email the address on harjotrana.com. This page is dated, and the date changes when the behaviour does. Material changes are described in the changelog rather than applied quietly.
Frequently asked questions
Does Helicon send my code anywhere?
No. Nothing about your code, prompts, threads or files leaves your machine through Helicon. What you send to Muse Code goes through the muse CLI to Meta, under Meta's terms.
Does the desktop app have telemetry?
No. There is no analytics SDK in the app. The only request it makes for itself is an update check, reporting platform, version and a weekly hash of the IP.
Does Helicon store my Muse Code credentials?
No. Authentication stays with the muse CLI, from your own muse login. Helicon never reads or stores it.
Does this website record my session?
Yes. PostHog session replay is enabled, with all input fields masked before recording. A content blocker stops it and the site still works.
Is there an account?
No. No sign up, no email, no profile, and no server side record of you beyond the analytics described above.
Keep reading
- Muse Code desktop appHelicon is a free, open-source desktop and web app for the Muse Code CLI. Signed Windows installer, universal macOS DMG, sessions, diffs, approvals and cost in one window.
- TermsHelicon is MIT licensed and provided without warranty. It is an unofficial community project, not made or endorsed by Meta, and you remain responsible for what the agent does.
- ApprovalsEvery approval Muse Code raises appears in Helicon the moment it arrives. onRequest, promptUnmatched and denyUnmatched are mapped one to one, and allow all is an explicit opt in.
- PricingHelicon is free and MIT licensed with no paid tier, no account and no API key. It uses the Muse Code subscription you already pay Meta for.
Same Muse Code. Same subscription. Better interface.
Free and MIT licensed. Signed Windows installer, universal macOS DMG, and a web build against a daemon you run.