Version date:
This notice covers HoYo Cookie Helper at helper.djdoolky76.net, an independent community tool by @djdoolky76. It is not operated by or affiliated with HoYoverse.
Your account. A clear handoff.
Your browser sends login details to this website’s hosted server over HTTPS. The server processes them and sends authentication requests to HoYoverse. Login is not processed only on your device; the website operator and hosting infrastructure are part of this data flow.
The helper prepares your HoYoLAB cookie for use in your own projects. It has no account registration, user database, advertising or analytics in its application code.
1. Data used during login
The server receives your username/email and password, RSA-encrypts them with HoYoverse’s public key for the upstream request, and temporarily holds the encrypted payload. It also processes CAPTCHA responses, email codes, verification tickets, account identifiers and tokens. Email verification requests a code for your linked address when required.
A random device ID helps HoYoverse recognize later sign-ins from this browser; it is not a hardware fingerprint. The application uses a short-lived hash of the client address for request limits.
2. Storage and retention
Pending login state expires after 10 minutes and is discarded on cancellation or completion. A completed cookie waits in server memory for up to 60 seconds, can be delivered once, and is removed before the response is sent. Expired sessions are rejected immediately; memory cleanup runs every 10 seconds. Server restarts discard sessions.
On HTTPS, __Host-helper_session (or __Host-helper_preview_session in demo mode) is Secure, HttpOnly and SameSite=Strict, with a lifetime of up to 10 minutes. __Host-helper_device has the same protections and lasts up to one year, renewed at login. HTTP local development uses names without __Host-. The app does not use localStorage, sessionStorage or service workers.
Application code does not write passwords, email codes or exported cookies to files or application logs. Hostinger and any configured network services may process IP addresses, request metadata and operational logs. Their retention and access settings are separate from the app’s in-memory deadlines; this notice does not promise that infrastructure keeps no logs.
3. External services
This site is hosted on Hostinger. Its server sends authentication and token requests to sg-public-api.hoyoverse.com. HoYoverse receives the data needed to complete these requests and network information. Its own terms and privacy practices apply.
When required, a sandboxed frame loads GeeTest and communicates with GeeTest or Captchami. These providers receive the challenge, your interactions and relevant browser/network information. The app does not give that frame your password or final cookie. Fonts, styles and logos are served by this website. External links and social apps that fetch public link previews follow their own privacy practices.
4. Your choices and controls
Cancel login to discard pending state. Close the result to clear its display; sign in again for another result. Clear this website’s browser data to remove the device ID. Keep the cookie private like a password, and never include it or an email code in screenshots or support messages.
A copied cookie remains in your clipboard and any place you paste it. One-time display cannot erase screenshots, saved network responses, clipboard history or copies, and it does not revoke the HoYoverse token. Use official HoYoverse account controls for account security and session management.
5. About this notice
This project is maintained by @djdoolky76 using the open-source HoYoLAB cookie-helper workflow. Direct questions about this website to its operator, @djdoolky76. HoYoverse does not operate this helper.
This notice describes the application and its hosted data flow. Browser extensions, your operating system, hosting infrastructure and external services have their own behavior. The version date changes when this notice is updated. A separately launched offline demo uses sample data and makes no provider login requests.