The trust contract

Helix works because users believe the rules hold. Integrating means agreeing to them — most are enforced by the protocol; the rest are conditions of staying connected.

What the protocol enforces

• You never receive source photos. No endpoint returns them. Apps get names, thumbnails, and finished generated images. Reference photos travel only vault → declared image provider, per request, and are logged.
• You never write facts directly. Learnings are proposals; the user approves each one before it exists. User-initiated subject uploads write directly but are audited as such.
• Everything is on the record.Reads, proposals, writes, generations — with your app's name, in a log the user actually looks at.
• Revocation is real. One click kills your tokens immediately, including mid-session.

What we expect from you

• Don't reconstruct what the door withholds. Don't scrape generated images to rebuild a likeness dataset, and don't persist vault context beyond your session's legitimate needs. The point of Helix is that users stop leaving copies of themselves everywhere — honor it.
• Declare your image provider honestly.Users consent to a named downstream. If you change providers, that's a new disclosure, not a config tweak.
• Upload device-direct.If your app adds subjects, photos go from the user's device to their vault. Routing them through your servers — even transiently — defeats the liability model that protects you.
• Ask in your UI before you ask in ours. Explain why you want each scope in your own onboarding; the consent page is confirmation, not persuasion.

Why this is good for you

The same rules that protect users delete your hardest problems: no face-data store on your servers means no biometric database to secure, breach, or litigate; no memory infrastructure to build; personalization with a paper trail you can point to when a user — or a regulator — asks what you knew and how.

Beta note: the protocol is v0.5 and evolving. Breaking changes will be announced to connected app developers before they ship. Request an inviteand mention you're building — beta developers get a direct line.