Privacy policy

What Sess collects, why, where it is kept, and how to ask us about it.

Effective 27 October 2026. Updated 2 November 2026: Sess Labs Inc. is named as responsible for your personal information. Change log

The short version

• You can answer a Sess link without an account. We keep your answers for the developer who asked, for a limited time, and a signed receipt of what you decided.
• We log only which page or API a request was for. We never log Sess links, keys or email addresses.
• We store data in Canada, in Toronto.
• To see, correct or delete your data, email ask@sess.si.

What we do with your exchanges

Your exchanges exist to be delivered, then deleted.

• No ads: Sess links, receipts, this site and the docs show no advertising.
• No tracking: they load no analytics, advertising pixels, third-party scripts or fonts.
• No training: we do not use your answers to train AI models.
• Nothing sold: we do not sell personal information.
• Delivered, then deleted: your answers are kept to deliver them to the developer who asked, then deleted, as How long we keep it sets out.

Who we are

The operator of Sess is Sess Labs Inc., British Columbia, Canada. Sess Labs Inc. is responsible for your personal information. Questions about it go to the address below.

ask@sess.si

If you answer a Sess link

A developer's agent sent you a link to a page with a question or a form. You do not need an account or a sign-in.

• What we keep: what the page showed you, your answers and when you gave them.
• What we do not collect: your name (unless the page asks for it), your network address or a device identifier.
• The signed receipt: a record that whoever held the link made this decision. It holds fingerprints of your answer and of the page, not the answer itself.
• Who decides: the developer who sent the link chooses what it asks and receives your answers. Ask them how they use what you send.

The page sets one cookie, which only shows that your answer was sent from this page. It holds nothing about you and is deleted when you close your browser. The page loads nothing from anywhere else. It tells your browser not to pass its address on to other sites and tells search engines not to list it. Where the page offers you your receipt, it keeps a small key in this browser so you can show you saved it; clearing the browser removes it.

If you save a copy

Where it is offered, Save to Sess keeps a copy of a conversation in your own account. We keep your email address, the copies you save (your answers and the receipt) and the sign-ins of your browsers. You sign in with an email code or link; Sess does not verify who you are. You can delete your account from Your receipts at any time. Your receipts uses cookies only to finish a sign-in in the browser that started it, to keep you signed in, to remember your theme choice, and to show that a form was sent from Sess itself. That last one holds nothing about you and is deleted when you close your browser. Nothing else.

If you have a developer account

• Your account: your email address, your workspace, and each signed-in browser by browser and system name (for example "Firefox on Linux").
• Your keys: API keys and trial credentials are stored only as hashes. We cannot show a key again after it is created.
• What your agents send: the requests, the pages shown, the answers and results, your webhook endpoints and the agents you register.
• Webhooks: we deliver each accepted answer, with its receipt, to the webhook endpoint you set up; once delivered, it cannot be recalled, even when the request is later deleted.
• Usage and plan: how many requests you have used, your plan and its billing status.
• Connected apps: if you connect an AI app to Sess, we keep which app you authorized and when. Removing it ends its access at once; the record that you authorized it stays, and we delete it when you ask us to.

The console at app.sess.si uses cookies only to finish a sign-in in the browser that started it, to keep you signed in, to finish an action that needed a fresh sign-in (such as creating a key), to bring you back to an app you were connecting, to remember your theme choice, to show that a form was sent from the console itself, and to let our public pages show you a Console button while you are signed in. The sign-in cookies and the one that finishes an action are tied to your account; the others hold nothing about you. Nothing else.

Our public pages use two cookies: sess_theme remembers your theme choice for a year, and sess_presence, set while you are signed in to the console, only tells the header to show Console. Neither contains personal data. If you try Sess at /try, or start an agent from a page its developer shared, that page also sets one cookie that lets this browser start a run and one that lets it follow that run and, on /try, fetch its receipt. They last a day at most, are not tied to an account, and hold random keys, nothing about you. The /try pages also set the form-check cookie, which holds nothing about you and is deleted when you close your browser.

If you pay for a plan

Stripe handles payment on its own hosted pages. We never see or store your card number. We send Stripe no name or email address; Stripe collects what it needs for the payment and for tax. We keep the identifiers of your Stripe customer and subscription and their status.

What we never log

We log only which page or API a request was for. We never log Sess links, keys or email addresses. To stop abuse we keep a scrambled form of where a request came from, never the address itself.

Where your data is stored

Sess runs on DigitalOcean in Toronto, Canada. The service, its database and the database backups are there. Some of the processors below may handle data outside Canada, including in the United States.

Who processes data for us

• DigitalOcean: hosting, the database and its backups, and the platform's logs.
• Resend: sends sign-in emails, so it receives your email address and the sign-in code and link.
• Stripe: payments, invoices and tax, for paid plans.

How long we keep it

Answers and the pages shown are kept for the period set by the developer's plan, while the request runs and for the same time after it ends, then deleted. Signed receipts are kept without automatic expiry and are deleted on request. Deleted data can stay in database backups until those backups expire. The periods and the details are on Retention and deletion.

If you save a copy, we also keep the day you first came back to Your receipts after saving it, until you close your account.

What a signed receipt is, and is not

A receipt shows what Sess accepted from whoever held the link, and that nothing in it changed. It does not verify who that person was, and it does not authorize anything. Anyone holding a receipt can check it on Verify.

Your rights

Under Canadian privacy law (PIPEDA, and British Columbia's Personal Information Protection Act), you can ask to see the personal information we hold about you, to correct it, and to have it deleted. You can also withdraw your consent, though some of the service may then stop working for you.

Email ask@sess.si. A Sess link does not identify you, so to find your answers we may need the link or the developer who sent it.

If you are not satisfied with our answer, you can complain to the Office of the Privacy Commissioner of Canada or to the Office of the Information and Privacy Commissioner for British Columbia.

Age

Accounts and paid plans are for people 18 and older. Answering a Sess link needs no account.

Changes to this policy

We post every change here with a new effective date. For a material change, we email account holders and post it here 30 days before it takes effect.

• 27 October 2026: first version.
• 30 October 2026: the operator is named as Sess Labs Inc., and the contact address is ask@sess.si.
• 31 October 2026: the cookies on our public pages, /try and the console.
• 2 November 2026: Sess Labs Inc. is named as responsible for your personal information.