SESSIOS

Privacy notice

Last updated 12 August 2026

The short version: we hold your email address, a hash of your password, a record of the devices you are signed in on, and what your subscription is doing. Your source code never reaches us. You can erase all of it yourself, from your account page, in about ten seconds.

Who is responsible

The controller is [LEGAL NAME], [FULL ADDRESS], registered under [SIREN]. For anything on this page, write to [PRIVACY EMAIL].

What we hold, and why

Your account

Your email address, a hash of your password (Argon2id — we cannot read the password itself), whether the address has been verified, and the dates the account was created and last changed. We need this to give you an account at all: the legal basis is the performance of our contract with you.

Your sessions

For each device you sign in on: the date, the IP address, and the browser’s user-agent string. This is what lets your account page show you where you are signed in and let you sign a device out — the point of holding it is that you can spot one you do not recognise. Basis: our legitimate interest in the security of your account, and yours.

Your subscription

Your Stripe customer identifier, the plan, the status, the current period end and whether a cancellation is scheduled. When you delete your account we blank the address on the Stripe customer; invoices already issued keep it, because accounting law requires them to say who paid. Card numbers never touch our servers — Stripe holds those. Basis: performance of the contract, and our legal obligation to keep accounting records.

Email tokens

When you verify an address or reset a password, we store a hash of the single-use token and its expiry, never the token itself. They are deleted when used, and expire in twenty-four hours (verification) or one hour (reset).

What we do not hold

Your code, your prompts, your agents’ output and your git history stay on your machine. Sessios runs locally and does not send them anywhere. We do not profile you, we do not advertise, and we do not sell anything about you to anyone.

Cookies

This site sets two cookies, both strictly necessary and both unreadable by JavaScript: one holding your short-lived access token, one holding the token that renews it. They exist only to keep you signed in. There is no analytics, no tracking, and therefore no consent banner — French and EU law require consent for cookies that are not strictly necessary, and we do not set any.

Who else sees it

  • Stripe (Stripe Payments Europe, Ltd., Ireland) — payments, subscriptions and invoices. Stripe receives your email address and holds your payment details as its own controller for parts of that processing.
  • [EMAIL PROVIDER] — delivery of verification and password-reset emails. It receives your address and the content of those messages.
  • [HOSTING PROVIDER(S)] — the servers this site and its API run on.

Where a processor moves data outside the European Economic Area, it is covered by the European Commission’s standard contractual clauses. Nobody else receives your data, except where the law obliges us to hand it over.

How long

  • Account and subscription state: while your account exists.
  • Sessions: until revoked or expired; refresh tokens last thirty days.
  • Email tokens: until used, or one to twenty-four hours.
  • Signup and login attempts, with the originating IP address: kept to throttle brute-force attempts and account-creation floods, which is our legitimate interest and yours.
  • A record that a free trial has been used: a keyed one-way hash of your account, your address and your card’s Stripe fingerprint, plus a date. It holds nothing that identifies you to anyone reading it, and it survives the deletion of your account — otherwise deleting and re-registering would be a way to take the free trial again and again. Kept for fraud prevention, which the GDPR names as a legitimate interest (Recital 47).
  • Invoices and accounting records: ten years, as French commercial law requires. This survives the deletion of your account — we are not free to erase them.

Your rights

You may ask for access to your data, correct it, have it erased, restrict or object to its processing, and receive it in a portable form. Two of these you can exercise yourself, immediately, without asking us:

  • Erasure — the delete button on your account page removes your account, your sessions and your subscription state, and cancels any live subscription first.
  • Security — the same page lists your signed-in devices and lets you end any of them.
  • Rectification — you can change your email address from your account page. The new one has to be confirmed from its own inbox, and your current address is told the change was asked for.

For anything else, write to [PRIVACY EMAIL]. We answer within one month. If our answer does not satisfy you, you may complain to the CNIL — cnil.fr — or to the supervisory authority where you live.

Changes

If we change how any of this works, we will update this page and change the date at the top. If a change matters to you, we will tell you by email rather than leaving you to notice.