Sessions Privacy Policy
Version sessions-launch-20261109-privacy-published-c5f298714420
**Effective date:** November 9, 2026 **Responsible company:** Sessions Inc., a Delcy Co. company **Business address:** 26 Indian Road, Toronto, Ontario M6R 2T9 **Privacy responsible team:** Legal / Sessions legal team **Public contact email:** hello@mysession.work **Service website:** https://www.mysession.work **Application:** https://app.mysession.work # 1 About this Policy Sessions provides live screen-sharing and collaboration services for personal use, primarily in North America. This Privacy Policy explains how Sessions Inc. handles personal information when you visit our website, create a host account, join as a guest, take part in a session or contact us. A host may use Sessions for an organization. That organization may separately decide why content is shared and who may receive it. Its privacy notices and obligations may also apply. Where Sessions processes personal information on an organization’s documented instructions, the applicable service agreement and any data processing agreement address those responsibilities. Sessions remains responsible for its own processing under applicable law. # 2 Information we process **Host account information.** When you sign up or sign in, our authentication provider, Clerk, handles the sign-in process. Sessions processes account and session identifiers, sign-in status and the profile information needed for the features you use, such as your display name. The authentication provider may also process the credentials and technical information used for your chosen sign-in method. **Account-free guest information.** The join form requires first name, last name and email. Sessions stores those details linked to the relevant invitation and session, along with guest and request identifiers, Terms acceptance details and a Privacy notice receipt. The guest flow does not verify email ownership or create a Clerk account. Entered email is not proof of identity. Join recovery uses an opaque recovery token, not an email message. **Session and connection information.** We process session and participant identifiers, roles, membership, invitations and their status, the session deadline, joins and departures, permission and control events where available, connection setup and signaling information, and operation receipts. Network and signaling information can include IP addresses, connection candidates, browser capabilities and related connection metadata. Authorization and recovery information are used to maintain the correct session access. **Screen content and participation.** We transmit the screen surface the host selects to receiving participants. Shared content may include personal information, documents, applications, notifications or other material visible in that surface. Presence and cursor features process participant labels, connection state and pointer position or movement to display activity within the session. **Technical and security information.** The app and infrastructure process request and network information, browser and device information, connection events, errors and abuse indicators needed to operate and protect the Service. Sessions stores connectivity-relay issuance metadata and sanitized diagnostics. **Communications.** If you contact us, we process the information in your request, your contact details and any attachments or diagnostics you choose to provide. Avoid sending passwords, invitation secrets or unnecessary sensitive content. **Payments.** Stripe processes subscription payments. Sessions processes account, customer, transaction and subscription records needed to administer purchases, renewals, cancellation and access to paid features. Payment information submitted to Stripe is also handled under Stripe’s privacy notice. [VERIFY THE EXACT PAYMENT FIELDS RECEIVED BY SESSIONS AND THEIR RETENTION BEFORE PUBLICATION.] Information comes from you, your device, Clerk, the host or participants in a session and the providers used to deliver the features you use. Information shown by another participant may have been supplied by that participant rather than verified by Sessions. # 3 How we use information We use personal information for these purposes: - to create and authenticate host access, check account status and secure account sessions; - to resolve invitations, admit account-free guests, identify participants and maintain the correct session membership; - to deliver live screen sharing, presence and cursor features, manage connection setup and apply session permissions and time limits; - to retain agreement and operation records, recover interrupted requests safely and resolve whether an action completed; - to diagnose connection failures, maintain service reliability, investigate abuse and protect accounts, users and infrastructure; - to answer requests, administer an authorized purchase where available, and comply with applicable legal obligations or establish, exercise or defend legal claims. **Marketing disabled at launch.** We do not enroll guests into promotional email or use their supplied email address for marketing at launch. Providing an email, joining a session or accepting the Terms does not constitute marketing consent. We do not treat acceptance of the Terms as permission for unrelated optional processing. Where consent is required, it must be appropriate to the information and circumstances. A new purpose requiring additional notice or consent must be addressed before that use begins. The content permissions in our Terms do not authorize unrelated advertising use or AI model training. [VERIFY OPTIONAL ANALYTICS, ADVERTISING TECHNOLOGIES, SALE OR ADVERTISING SHARING, AND VENDOR AI USES; ADD ANY REQUIRED DISCLOSURES AND CHOICES BEFORE PUBLICATION.] # 4 What other participants can see The host can see guest names through the roster and presence features, but not stored guest emails. Guests see their own name and anonymized labels for other guests. Participants can see screen content transmitted to them and cursor or presence information provided by the session. Guest email remains associated with the stored join record; the current admin interface does not provide a guest contact-history lookup. The host can invite people, manage available session permissions and end the session. A reusable invitation can be forwarded, so check the participant list before sharing sensitive material. Guest profile entries and display labels do not establish someone’s real-world identity. Recipients may capture or retain information using their own devices or tools. Sessions cannot guarantee that screenshots, recordings or onward disclosure will be prevented. Share only information you are authorized to disclose, hide notifications and close private material before choosing a surface. # 5 Live media and session controls The screen-sharing feature covered by this Policy provides live video transmission and does not offer a built-in recording feature in this version. The screen-capture component requests video with audio disabled. Camera and microphone capture are not part of this screen-sharing flow. The selected screen surface is transmitted to receiving participants using WebRTC, with Cloudflare STUN/TURN services supporting connectivity and relaying traffic when needed. Sessions processes connection setup and signaling separately from the shared video. The one-hour session clock starts when the host first starts sharing their screen, not when the session is created. Setup and waiting before that first share do not use the hour. Later guests, reconnections, sharing restarts and connection renewals do not restart the original clock. The host can end the session sooner. If sharing has not started, an unused session expires 30 minutes after creation. Guest joins or reconnections do not restart the waiting period. Starting the first share before that expiry begins the full, separate sharing hour. Stopping sharing, leaving, removing a participant, revoking an invitation and ending the session have different effects on access. None of these actions erases information already received by a participant or automatically deletes all account, guest, acceptance, signaling or operation records. Provider cleanup can remain pending after local sharing stops. # 6 Service providers and other disclosures We use providers to operate the Service. The Service uses: - **Cloudflare** for application hosting through Workers, session coordination and SQLite-backed Durable Object storage, and WebRTC STUN/TURN connectivity services; - **Clerk** for host account authentication, sign-in sessions and the profile information used by host features. Stripe provides payment processing and subscription billing. These providers process information needed for their functions, including relevant account, transaction, request, network or session information. Guest join details are handled by Sessions’ server and storage; the account-free join route does not require a guest Clerk account. [COMPLETE THE APPROVED PROVIDER LIST, LEGAL PROVIDER ENTITIES, CONTRACTUAL ROLES, PROCESSING COUNTRIES AND ANY SUPPORT, EMAIL, ANALYTICS, BACKUP, PAYMENT OR WEBSITE PROVIDERS. IF THE SEPARATE MARKETING WEBSITE USES GOOGLE FONTS OR DIFFERENT HOSTING OR ACCESS CONTROLS, DISCLOSE THOSE REQUESTS AND PROVIDERS.] Providers acting on our behalf may handle information only for the authorized purposes and applicable contractual and legal requirements. Independent services you choose to use have their own privacy notices. We remain responsible for information handled on our behalf where applicable law makes us responsible. We may disclose information where legally required or permitted to respond to lawful requests, prevent or investigate unlawful activity, protect rights or safety, and establish, exercise or defend legal claims. In a proposed or completed transfer of the relevant business, information may be disclosed subject to applicable confidentiality, legal safeguards and required notices. # 7 International processing Providers may process information outside your province, state or country. Information processed in another location can be subject to that location’s laws and lawful access by its authorities. [INSERT VERIFIED PROCESSING LOCATIONS AND THE APPLICABLE TRANSFER MECHANISMS, ASSESSMENTS AND SAFEGUARDS. INCLUDE HOW TO REQUEST A COPY OR DESCRIPTION WHERE REQUIRED.] Contact our privacy contact for information about processing locations and applicable safeguards. A host’s or guest’s location does not determine where the Service’s providers process information. # 8 Cookies and browser storage Clerk may use cookies or similar technologies needed for host sign-in and account security. The account-free guest entry flow does not load Clerk to create a guest account. The guest journey uses browser session storage to recover an interrupted join. Before a join is confirmed, it can contain the pending invitation and recovery information, the entered name and email, and the Terms version and acceptance details. After confirmation, the pending profile and acceptance details are removed from that browser entry; minimal recovery and routing information remains while needed for the journey. This does not remove the corresponding server records. An invitation token is carried in the link’s URL fragment and removed from the address bar after the app captures it. Anyone who receives the link may still be able to use it while it is valid. Do not include invitation or recovery information in screenshots, diagnostics or public messages. You can restrict cookies or storage using available browser controls, but blocking necessary storage may prevent sign-in or safe recovery of a join. Optional technologies require the choices and consent applicable law requires. # 9 Retention and deletion The one-hour session limit governs live access, not deletion. Guest names and email addresses, session links and acceptance records remain stored after a session ends. Automatic guest-profile and evidence deletion schedules are not enabled in the current implementation. Account cancellation, expiry and leaving a session do not erase these records. Our retention schedule must distinguish these categories: - Host accounts and authentication records - Guest names and email, invitations and membership - Terms acceptance and operation receipts - Signaling, cursor or presence history and diagnostics - Support and any transaction records - Marketing contact details, consent and suppression records - Backups and archives Retention must reflect the purpose, applicable legal requirements, security needs and any justified dispute or preservation requirement. Archiving is a form of retention, not erasure. Where information is no longer needed, it must be deleted or made no longer identifiable in accordance with the approved schedule and applicable law. Signing out, closing an account, canceling a subscription and requesting deletion are separate actions. A deletion request must be assessed against applicable rights and lawful exceptions; a pending request is not confirmation that erasure has completed. Requests may be sent to hello@mysession.work. # 10 Security We use access controls and session authorization measures designed to restrict access to the appropriate account and session. Infrastructure providers also operate security controls for their services. No system can guarantee absolute security. Keep account credentials and invitation links confidential, use trusted devices and report suspected unauthorized access to hello@mysession.work. These precautions do not remove Sessions’ own legal responsibilities. # 11 Your choices and rights You can choose whether to create a host account, join a session or share a screen. The host controls the selected sharing surface, and participants can use the available Stop, Leave and End controls. Choosing not to provide information required for a feature may prevent that feature from working. Depending on applicable law, you may have rights to access or obtain a copy of personal information, correct inaccuracies, request deletion, receive portable information, restrict or object to certain processing, and withdraw consent where processing relies on consent. These rights have legal conditions and exceptions. Withdrawing consent does not undo processing that was lawful before withdrawal. Send a request or complaint to hello@mysession.work. We may request proportionate information to verify your identity and authority. An unverified guest email alone may be insufficient to establish entitlement to another person’s records. We respond within applicable legal time limits and explain any lawful refusal and available recourse. You may also complain to the privacy regulator responsible for your jurisdiction. For information an organization independently shares through Sessions, you may also need to contact that organization. We will address requests concerning our own processing and provide assistance required by our role and applicable law. Promotional email and guest marketing enrollment are disabled at launch. Guest email is not a marketing opt-in. If marketing is introduced later, Sessions will first provide the required notice, obtain any required separate consent and offer an unsubscribe method. Any necessary service or security communication is not permission to add promotional content. # 12 Age eligibility Sessions is intended for people who have reached the age of majority where they live and can enter the Terms. It is not directed to children. If you believe a child has provided personal information through an ineligible account or join, contact hello@mysession.work so we can assess the information and take the action required by applicable law. # 13 Changes and contact We may update this Policy as our practices change. We will identify the revised effective date and provide additional notice or obtain consent when required by law. A revised Policy does not by itself authorize a new use that requires separate permission. For privacy questions, requests or complaints, contact Legal / Sessions legal team at hello@mysession.work, 26 Indian Road, Toronto, Ontario M6R 2T9.