Privacy, in plain words
Proof-of-Life checks that a real person is present without learning who they are. This notice explains what it handles, what it never touches, how long anything is kept and how to reach us.
Who we are
Proof-of-Life is provided by Helius Network Ltd, a company registered in England and Wales (company number 16679286), 128 City Road, London EC1V 2NX, United Kingdom. For anything about privacy, write to hashim@heliusnetwork.com.
- When a website or app uses our hosted service, that organisation decides why the check is run and Helius Network acts as its processor. Customers sign a data processing agreement.
- Helius Network is the controller for the pseudonymous enrolment records it keeps to estimate uniqueness across sites.
- For a self-hosted Enterprise deployment, the customer is the controller for its own verifier.
What Proof-of-Life never uses
Proof-of-Life uses no biometrics. It does not use a camera, a face, a fingerprint template, a voice or an identity document, on the phone or on our servers. It does not collect your name, email address, phone number or photograph.
Liveness comes from how a hand-held phone moves during a random 9-second challenge. Uniqueness comes from a passkey-based device anchor, history across days and places, and co-verification by other verified people, and is reported as a confidence score, not a guarantee. Platform checks such as Apple App Attest and Google Play Integrity are planned and are not used today.
The passkey step asks you to confirm with your phone's screen lock. Your phone decides how that works: a PIN, a pattern, or the phone's own face or fingerprint unlock if you have set one up. That check happens inside the phone's secure hardware. We receive only a cryptographic signature and a flag that the screen lock was confirmed, never any biometric data, and we cannot tell which unlock method you used.
Motion data is not used to identify or authenticate a specific person, is never compared with a stored template of you, and is deleted within 60 seconds. Our view is that it is not biometric data as processed here; the pending DPIA is expected to confirm this.
What is handled, and why
| Data | Leaves your phone? | What we keep | Why |
|---|---|---|---|
| Motion stream (about 9 seconds of acceleration and rotation) | Yes, inside an AES-256-GCM envelope encrypted on the phone | Nothing. Decrypted in memory, checked and deleted within 60 seconds | Liveness |
| Motion summary (12 numbers such as tremor level and timing) | Derived on our server | 24 hours, then deleted | Phone-farm detection |
| Replay fingerprint (a hash and a coarse orientation path) | Derived on our server | 24 hours, in memory | Replay detection |
| Passkey | Public key, signatures and a random credential ID, over TLS | The public key and a keyed hash of the credential ID (the device anchor), for as long as the enrolment exists. The raw credential ID is never stored | One active identity per passkey |
| Location area (optional) | Only a coarse area about 20 to 40 km wide, computed on the phone. Never coordinates | Up to 30 areas, encrypted, each deleted 180 days after it was last seen | Proof of history, farm grouping, co-verification |
| Check dates | No | Up to 60 dates, none older than 180 days, encrypted | Proof of history, rate limits |
| Network tag and sensor clock fingerprint | Derived on our server, from a keyed hash of the IP prefix | 24 hours | Farm detection |
| Co-verification (vouches) | No | Who vouched for whom, as pseudonymous IDs, encrypted, while the enrolment exists and at most 180 days | Uniqueness, collusion detection |
| Account binding (step-up) | Your provider sends a hash of its account ID | A keyed hash, with the person reference encrypted, while the enrolment exists or until the provider deletes it | Same person on every step-up after the first trusted one |
| GPS trace and motion (activity verification only) | Yes, inside an AES-256-GCM envelope encrypted on the phone | Nothing. Checked and deleted within 60 seconds. Only distance, duration and a confidence are returned | Activity verification |
| IP address | Seen by our server | Not stored. Logs carry a short keyed hash, and abuse counters per network prefix last minutes | Abuse prevention |
| Browser signals (browser type, automation flag, clock skew) | Yes | Not stored; checked per request | Bot detection |
Security
Uploads are encrypted on the phone (AES-256-GCM). History, vouches and account bindings are encrypted at rest with keys rotated every 30 days. Every decision is written to a tamper-evident audit log that refuses fields that look like personal data.
Pseudonymity
Each website sees a different pseudonymous ID for the same person, so websites cannot link their users to each other through Proof-of-Life. We never learn who an enrolment belongs to. Passes are signed and can be checked against our published keys; anchoring a hash on Solana is optional and never includes personal data.
How long we keep things
| Item | Deleted after |
|---|---|
| Raw motion streams and GPS traces | Immediately after the check, at most 60 seconds |
| Motion summaries and replay fingerprints | 24 hours |
| Check sessions | 10 minutes |
| Single-use tokens | On expiry: 120 seconds, or 10 minutes for activity |
| App pass records | 7 days |
| Dates and coarse areas in your history | 180 days after last seen, at most 60 dates and 30 areas |
| Enrolment (device anchor, public key, history, vouches) | While your pass can be reused (30 days by default) plus a re-verification window. Automatic expiry of inactive enrolments is being added before general availability |
| Logs | Contain no personal data |
Your choices and rights
- Location is optional unless the website requires it, and you can skip it. Motion sensor access is something you grant in your browser or app.
- Lawful basis. For bot and fraud prevention we expect to rely on legitimate interests, with consent for the optional location area. The pending DPIA will confirm this.
- Access and deletion. Because we hold no name or contact details, we find your enrolment by your passkey, not by who you are. A self-service page where you confirm with your passkey to see or delete your enrolment is being added before general availability. Until then, write to hashim@heliusnetwork.com and we will help.
- Complaints. You can complain to the UK Information Commissioner's Office (ico.org.uk), or to the data protection authority where you live.
Regulation
PoL Gate is a bot-prevention service. In regulated payments, PoL Step-up is an additional anti-fraud layer and is not a strong customer authentication factor under PSD2 unless and until it is certified for that purpose.
Early-access requests on this site
When you use the early-access form, we collect your name, work email, organisation, sector, the product you are interested in, an expected volume and your optional message. If you happen to be signed in to heliusnetwork.app, we also record your Helius account ID with the request. To limit abuse we keep keyed one-way hashes of your IP address and of its network (made with a secret key held only on our server); the IP address itself is not stored.
- Why: to reply to you about early access and pilots. We do not add you to a newsletter and do not sell or share your details.
- Lawful basis: your consent, given with the tick box. You can withdraw it at any time by writing to us.
- Where: the request is stored in our database hosted by Supabase, which acts as our processor.
- How long: as long as we are discussing early access with you, and never more than 24 months; requests older than that are deleted automatically. We delete yours sooner if you ask.
The rest of heliusnetwork.app, including the Helius Network app, is covered by its own terms. Questions: hashim@heliusnetwork.com.