Privacy Policy

Last updated: November 10, 2026

This policy explains what information SessionFS ("SessionFS", "we", "us") collects when you use the SessionFS website at sessionfs.dev, the dashboard at app.sessionfs.dev, the hosted API, and the sfs command-line tool and background daemon (together, the "Service"), how we use it, and the choices you have. If you have questions, email privacy@sessionfs.dev.

The short version

• SessionFS is local-first. The daemon captures your AI coding sessions on your own machine. Nothing is uploaded unless you sign in and turn on cloud sync, or choose to push, share or hand off a session.
• We don't sell your information, and we don't use it for advertising.
• We don't run AI models with our own keys. When you use an AI feature, your content goes to the AI provider you configured, with your key or your organization's key.
• The website and dashboard load no analytics or advertising trackers.
• The CLI sends a small amount of anonymous usage telemetry, which you can turn off. The telemetry page lists every field.
• You can delete your synced data, and you can ask us for a copy of it or to delete your account.

Self-hosted deployments

If your organization runs SessionFS on its own infrastructure, your data stays on that infrastructure and SessionFS does not receive it. Your organization is responsible for how that data is handled, and its own policies apply. This policy then covers only what you send us directly, such as an email to support.

Information we collect

Account information

When you create an account we collect your email address and, if you provide them, your display name and organization details. If you sign in through your organization's single sign-on, we receive the identifier and email address your identity provider shares with us. If you link a GitHub account, we receive your GitHub user and installation identifiers. We store hashed API keys, never the raw key after it is shown to you.

Content you choose to sync or upload

If you turn on sync or use team features, we store the content you send us. This can include captured AI coding sessions (messages, tool calls and their results, file paths relative to your workspace, model names and token counts), project context and knowledge entries, wiki pages, tickets and comments, agent run records, handoffs, rules, meeting transcripts and chat threads you upload, conversations with the session helper, and anything else you put into the Service. Session content can contain source code and anything else that appeared in your coding session, so please review what you sync. SessionFS includes secret and sensitive-data scanning that can block or redact some secrets before storage, but it cannot catch everything.

Billing information

Payments are processed by Stripe. We receive your billing name, email, plan, subscription status and the last digits and brand of your card. We never receive or store your full card number.

Usage telemetry from the CLI

The sfs tool sends a few anonymous events, such as "installed" or "first session captured", with a random install ID, the SessionFS version, your operating system and a timestamp. It never sends session content, file paths, project names, email addresses or credentials. It tells you about telemetry before the first event is sent, and you can turn it off at any time. Details and opt-out instructions are on the telemetry page. Self-hosted installs send telemetry to their own server, not to us.

Technical and log information

When you use the hosted Service, our servers record standard request information such as IP address, user agent, the requested URL, response status and timing. We use it to run, secure and rate-limit the Service and to investigate errors and abuse.

Information from integrations you connect

If you connect an integration such as Jira, Confluence, GitHub or GitLab, we receive and store the data needed for that integration to work, such as issue keys, page links, repository names, pull request details and webhook events. Credentials for these integrations are stored encrypted.

Messages you send us

If you email support, sales or privacy, we keep that correspondence so we can help you.

How we use information

• To provide the Service: store and sync your sessions, run search and team features, send the emails you ask for (account verification, invitations, handoffs, notifications and digests) and process payments.
• To keep the Service secure: authenticate you, prevent abuse and fraud, enforce rate limits and investigate incidents.
• To support you and to tell you about important changes to the Service or these terms.
• To understand adoption and improve the product, using anonymous telemetry and aggregate usage.
• To meet legal obligations, such as tax and accounting records.

We do not use your synced content to train AI models, and we do not sell or rent your information.

AI providers you configure

Some features call a large language model, for example the session helper, security audits, narrative summaries and meeting action-item extraction. SessionFS does not supply a model key for these. They run with a key you or your organization saved, and the relevant content is sent to the provider you chose (for example Anthropic, OpenAI, Google or another supported provider). That provider's terms and privacy policy govern what it does with the data. If you don't configure a key, these features don't run.

Organization accounts

If you use SessionFS as a member of an organization, the organization's owners and admins can manage your membership and can see content shared with the organization's projects. When we process data for an organization, we do so on its behalf and under its instructions. Please contact your organization about its data practices.

Legal bases (EEA and UK)

If you are in the European Economic Area or the United Kingdom, we rely on these legal bases:

• Contract: to provide the Service you signed up for, including storage, sync, team features and billing.
• Legitimate interests: to secure the Service, prevent abuse, provide support, and measure adoption with anonymous telemetry, which you can turn off.
• Legal obligation: to keep records the law requires.
• Consent: where we ask for it, which you can withdraw at any time.

Who we share information with

We share information only with service providers that help us run the Service, under contracts that limit their use of it:

• Google Cloud: hosting, databases, file storage and logs, in the United States.
• Vercel: hosting for the website and dashboard.
• Stripe: payment processing.
• Resend: sending transactional email.
• Google Fonts: the website loads its fonts from Google, which receives your IP address when it serves them.

We also share information when you direct us to, for example with the AI provider you configured, an integration you connected, a teammate you hand a session to, or anyone who opens a share link you create. We may disclose information if the law requires it, to protect the rights and safety of our users or the public, or as part of a merger, acquisition or sale of assets, in which case this policy continues to apply.

Cookies and browser storage

We don't use advertising or analytics cookies. Single sign-on and GitHub account linking use short-lived, strictly necessary cookies to complete the flow safely. The dashboard keeps your sign-in and display preferences, such as list or grid view and theme, in your browser's local storage.

How long we keep information

• Account information: while your account is open, then deleted when you close it, except what we must keep for legal or accounting reasons.
• Synced content: until you delete it. Deleted sessions go to Trash first, where you can restore them, and are then permanently removed.
• Session helper conversations: 90 days by default. Organizations can change this.
• Meeting transcripts and chat threads: 180 days by default. Organizations can change this.
• AI usage records (token counts, not content): up to about 13 months, for budgets and billing.
• Server logs: about 30 days.
• Billing records: as long as tax and accounting law requires.

Backups may keep deleted data for a short period before they expire.

Your rights and choices

• Delete sessions, projects and other content in the dashboard or with the sfs CLI.
• Turn off cloud sync, or keep SessionFS entirely local by never signing in.
• Turn off CLI telemetry, as described on the telemetry page.
• Ask us for a copy of your information, to correct it, to delete your account, or to restrict or object to how we use it.

Email privacy@sessionfs.dev to make a request. We'll respond within 30 days and may need to verify your identity first. If you are in the EEA or UK, you also have the right to complain to your local data protection authority.

California residents: we do not sell or share personal information for cross-context behavioral advertising, and we don't use sensitive personal information to infer characteristics about you. You may request access to or deletion of your information as described above, and we won't treat you differently for doing so.

International transfers

We store data in the United States. If you use the Service from outside the United States, your information is transferred there. Where the law requires it, we rely on appropriate safeguards for these transfers, such as the European Commission's Standard Contractual Clauses.

Security

We encrypt data in transit with TLS and at rest. Integration credentials and saved AI keys are encrypted separately, and API keys are stored hashed. Access is limited by role and project, and we log administrative actions. No system is perfectly secure; if we learn of a breach that affects your information, we will notify you as the law requires. To report a security issue, email security@sessionfs.dev.

Children

The Service is not intended for anyone under 16, and we don't knowingly collect information from them. If you believe a child has given us information, contact us and we will delete it.

Changes to this policy

We'll post any changes on this page and update the date at the top. If a change is significant, we'll tell you by email or in the dashboard before it takes effect.

Contact

SessionFS
Privacy: privacy@sessionfs.dev
Security: security@sessionfs.dev