Privacy, in plain language.

What Session stores on your device

Session stores the product state needed to run your workflows, including alarms, reminder history, consent choices, normalized scan results, and the status of any Session-owned shield. It also creates a random, non-guessable identifier and stores it in the iOS Keychain. The identifier is not your email, provider username, Apple advertising identifier, or provider account name.

Camera and on-device scans

Camera access is requested only when you choose a Usage Screen Scan. Session uses the image and on-device OCR to interpret a supported coding-agent usage screen. The raw image, OCR text, prompts, code, and provider account data are not sent to PostHog, RevenueCat, or a Session server. Normalized values may remain on your device so Session can confirm the reminder you created.

A scan can be rejected when it is ambiguous, stale, unsupported, or missing required information. You can deny camera access and use a manual Reminder Only path where available.

Purchases and entitlement checks

Session uses RevenueCat’s iOS SDK to load subscription options, make or restore purchases through Apple, and verify the current Session Pro entitlement. RevenueCat receives the random Session identifier plus purchase and subscription information needed for those functions. Session does not receive your full payment-card details.

RevenueCat is always-on functional commerce when valid configuration exists. Purchases and entitlement checks continue independently of your product measurement choice or Marketing Email Consent.

Your product analytics choice

Session uses the PostHog iOS SDK for privacy-minimal product analytics and feature evaluation when valid production configuration exists. Product analytics starts enabled without an upfront opt-in. You can use the persistent opt-out independently of your subscription and Marketing Email Consent; an explicit opt-out is honored before later SDK startup.

The opt-out controls what Session sends, not what Session reads. While it is on, no product event leaves your device. Session still asks PostHog which features and limits this install should run with, because that answer decides what the app offers you rather than describing what you did with it, and while the opt-out is on that request is not recorded as an event. This is the separation purchases already have: a functional request continues, measurement stops.

Session may record bounded events such as app opens, purchase or restore outcomes, reminder creation or cancellation, and completion outcomes. Reviewed screen, lifecycle, feature-flag, safe-interaction, and sanitized error surfaces may also be enabled. Allowed properties use fixed categories, counts, versions, locale, installation distribution category, current App Store storefront country, or a one-way alarm identifier hash. Storefront country describes your store region, not your physical location or necessarily where you first downloaded Session. Session Replay and session recording remain disabled and out of scope. Scan images, OCR text, email, provider account data, prompts, code, raw URLs, and arbitrary errors are prohibited from analytics payloads.

When Product Measurement is enabled, PostHog can estimate your country, region, or city from your network IP address. AppsFlyer also maps IP addresses to an approximate location for attribution, analytics, and service operation. These estimates can be linked to the random Session identifier or device identifier. They are separate from your App Store storefront country. Session does not request location permission or read GPS location. The Product Measurement opt-out described here also applies to future app analytics and attribution.

Attribution, ATT, and marketing consent

IDFA-free AppsFlyer attribution and deep linking start when their production configuration is valid. On iPhone, an explicit Product Measurement opt-out stops future AppsFlyer collection and identity use. The website analytics preference controls PostHog only. Healthy aggregate OneLink routing uses fixed source and campaign values with bounded landing context, and it does not carry a website or PostHog identity. The current stack uses no ATT or IDFA.

To measure TikTok advertising and help optimize for paid subscriptions, AppsFlyer can forward approved app-install and paid-subscription events to TikTok, subject to the configured privacy restrictions. Eligible events can include events from people who arrived without an ad. Depending on those restrictions, shared fields can include a pseudonymous device identifier, IP address, product, purchase amount and currency, and event time. RevenueCat supplies purchase and subscription events. Session does not send IDFA, email, phone number, scan content, or provider account data for this matching.

Product Measurement opt-out stops future direct AppsFlyer collection and requests removal of RevenueCat attribution and device-matching attributes while the app is running and online. Purchases continue. An offline or closed app cannot immediately update RevenueCat, so previously queued or in-flight forwarding may continue until the update succeeds.

Marketing Email Consent is separate, starts unchecked, and controls only marketing email. It does not enable product measurement, attribution, purchases, or core product access.

App recommendations from Kickstart Exchange

Session can show one Kickstart Exchange recommendation on Today or the first-run pull-handle welcome screen when you have Limited Access and Product Measurement is enabled. Active free trials and paid subscriptions are ad-free. Turning Product Measurement off removes the recommendation and prevents new loading. An acquisition or interaction request sequence that already started may finish, including later network stages and retries. Your alarm allowance, purchases, scans, and focus workflows do not depend on recommendations.

The Exchange SDK sends application details, App Store storefront country, and advertisement interactions to operate the exchange. A shipping build may send an Apple-signed App Transaction for transient verification. Session adds no Session or RevenueCat user identifier, scan content, provider account information, email, or advertising identifier to these requests.

Kickstart describes its advertising records as unlinked to individual users or devices and not used for tracking. Its network provider processes request IP addresses to deliver traffic. See the Kickstart Exchange privacy notice for verification, retention, and service-provider details.

Notifications, alarms, and Focus Lock

Notification permission lets Session call you back at a confirmed time. Session schedules its alarms with Apple's AlarmKit on your device.

Focus Lock uses Apple's Screen Time (Family Controls) after you authorize it. The apps, websites, or categories you choose come back from Apple as opaque tokens that Session cannot read as names. Those selections stay on your device and are never sent to Session or any third party. While a Focus Lock alarm is active, Session applies a Screen Time shield (ManagedSettings) only to the apps, websites, or categories you chose. To turn it off, you scan the Usage screen with the camera; that scan is recognized on your device and its images and text are not uploaded. Session cannot control the iPhone lock screen or clear restrictions owned by Apple, another app, or system policy. Reminder Only does not shield apps.

This website

When valid production measurement configuration is deployed, website product analytics starts from the first page view. Analytics Preferences is available on every page, with a persistent opt-out, bounded data rules, and Session Replay disabled. Turning website analytics off stops future PostHog capture and clears its browser persistence without changing an otherwise healthy aggregate OneLink destination. Invalid attribution configuration, an emergency kill, construction failure, or unusable routing uses the direct verified App Store destination. Cloudflare may process ordinary request information needed to deliver and protect these pages.

The support form shown on this site is a disabled interface preview. It does not send or store a name, email, message, or other form value. No website form asks for Usage Screen Scan content, OCR text, prompts, code, provider credentials, receipts, or payment information.

Retention, deletion, and choices

Local product state remains on your device until it is cleared through the app or removed by the operating system. The Keychain identity can follow iOS Keychain retention behavior. RevenueCat and PostHog retain data under their service policies and Session’s configured account controls. You can keep the Product Measurement opt-out enabled without losing the ability to manage a purchase or to receive the current feature configuration.

For a privacy question or deletion request, use the Session support route. Do not attach scan images, OCR output, code, prompts, credentials, or payment information to a public request.

Scope and changes

This policy covers the United States en-US launch release. Verified OneLink routing and website measurement activate only under the rules above. Web2App checkout, web claims, referrals, Promotional Access, Loops signup, popups, banners, and non-en-US surfaces are not enabled in this launch package. If Session materially changes its data practices, this page will be revised before the new behavior is represented as available.