Privacy Policy

Sessions is a companion for people in therapy. It keeps your voice debriefs, recorded sessions and journal, and, with Sessions AI if you choose it, finds what you said you'd try in them (techniques to practise, to-dos and habits), and writes check-ins, talking points and a running story so far. This policy describes exactly what happens to your data, and names every company that processes it: the app itself does not name them, and links here instead.

Encrypted on your phone before it is stored

Your transcripts, notes, insights, plans, reflections, check-in answers, journal entries and photos, your therapist's name and your story so far are encrypted on your device with a key that only you hold, and our servers store them only in that encrypted form. The people who run Sessions cannot read them, and neither can anyone who obtains a copy of our database.

What our servers can see

A short list of facts that are not encrypted, because the service needs them to work: your email address and how you sign in; when each session happened, whether it was a debrief or a full recording, and its status; the type and status of each plan, and its timing in the words it was given (for example "this week" or "before the next session"); when each check-in is scheduled and answered; when each journal entry was written and last edited; the size of stored files; when your story so far was last updated; for a full-session recording, how long it was, whether transcription succeeded and when its audio was deleted; how and when you confirmed your therapist's consent to record; if you set a recovery passphrase, the settings used to protect your key with it (never the passphrase); for a subscription, Apple's identifier for it, its plan, expiry and status; when your free first session was used; and how many Sessions AI requests your account made each day and week, by kind and never by what was said, kept for five weeks to apply the limits. Each request to our service is logged with your account's identifier, the address it was sent to, the time and the result, and for some requests how many items it carried, never what it said; the companies that host our service and database also record the IP address a request came from.

Sessions AI, asked once for all of it

Sessions AI is the part of Sessions that sends your words to an AI model. It is optional. The app asks once, before any of it first sends anything, and the answer covers all of it: finding what you said you'd try in a session, with its summary and themes; naming a habit; the question asked when you check in on a habit; technique suggestions; your story so far; talking points; the journal's follow-up questions and reflections; Reflect; Ask your journal; Today's chat; the weekly report; the daily affirmation; and Year in review. A yes given before the ask covered all of these covered fewer of them, so the app asks again once. You can change your answer at any time in Settings → Sessions AI.

If you say yes, the words a feature needs are decrypted on your phone and sent over an encrypted connection to our service, which forwards them in memory to Anthropic's Claude model and returns the result. Your first name, the kind of therapy you picked and the topics you picked go with them only if you tick the box that allows it. Anthropic doesn't receive your account or your email address. Our service does not store or log the text or the model's output, and the result is encrypted on your phone before it is saved. Anthropic processes the text under its commercial API terms, may keep it for a limited time under those terms, and does not use it to train models.

If you say no, nothing is sent to Sessions AI: a session is kept as its transcript with nothing pulled out, you can add techniques, to-dos and habits yourself, a check-in asks a fixed question, and the journal asks its own questions. Talking points and your story so far are not written. Recording and transcribing a full session is separate from Sessions AI: it needs your therapist's consent, and is described below.

Voice debriefs stay on your phone

A voice debrief is transcribed on your device with Apple's on-device speech recognition. That audio never leaves your phone, and it is not kept once its words are written. The first time, your phone may download Apple's speech model for your language; no audio is sent to do it.

Full-session recordings are transcribed by ElevenLabs

While you record a full session, the recording is kept on your phone until the session is saved or deleted. To transcribe it, the recording is uploaded over an encrypted connection to a private staging area (this copy is not encrypted with your key, because ElevenLabs has to hear it), sent to ElevenLabs for transcription with speaker labels, and our copy of the audio is deleted before the transcript is returned. Every deletion is recorded. If the app stops after the upload and before the transcription request, that copy stays in the staging area until it is deleted. ElevenLabs receives the audio and no information about who you are. ElevenLabs processes it under its own terms; the current plan does not include ElevenLabs' zero-retention option, so ElevenLabs may retain audio under its standard policy. If ElevenLabs can't transcribe it, your phone can transcribe the recording itself. Recording another person requires their consent; see the recording-consent page.

If you choose to keep an encrypted backup of a recording's audio, it is encrypted on your phone before upload, only you can open it, and it is deleted with the session.

Signing in

You can sign in with Apple, with Google, or with an email address and a password. Apple or Google receive only the sign-in request and return a signed token; we store the account identifier and email they provide, nothing else about you from them, and we never read your session content with either. Google sign-in happens in a system browser sheet using Google's standard OAuth flow. If you use a password, it is stored only as a one-way hash by our authentication provider, Supabase; we never see it, and it is not the passphrase that protects your content. Forgetting it sends a reset link to your email address. Sign-in and reset emails are sent by Supabase.

Your recovery passphrase

Your encryption key is created on your phone. If you set a recovery passphrase, an encrypted copy of the key, wrapped under that passphrase, is stored so you can recover your data on a new phone. Until you set one, what you save is still stored on our servers in encrypted form, but only that phone holds the key that opens it. We cannot reset a passphrase; if you lose it and all your devices, the data cannot be recovered.

Kept only on your phone

Some things are stored only on your phone, never on our servers: your mood check-ins, your Reflect conversations, your kits, the lines you keep to remember, your first-run answers and preferred name, and your session times and reminders. They are deleted when you sign out or delete the app, and are not on a new phone. Most are encrypted with your key. Your kits, the areas you mark in the technique library and today's affirmation are protected by your phone's own security rather than your key, and are part of your phone's own backups. With Sessions AI on, a feature sends only the parts it needs, through our service as described above; your moods, for example, go with the weekly report and Today's chat. An export you make is a file that is not encrypted, and it goes wherever you send it.

Deletion

Deleting a session removes its transcript, insights, plans, check-ins and stored audio from our servers immediately. Deleting your account removes every row and file belonging to you, and your login, immediately. There are no soft deletes. Deleting does not reach a copy a processor keeps under its own terms (above), Apple's record of your purchases (which carries your account's identifier, below), our request logs before they expire, or a backup of our database before it expires.

Subscription

Purchases are handled by Apple. We do not receive your payment details. So that Sessions AI is available to the account that pays for it, each purchase carries your account's identifier to Apple, the app sends us the purchase as Apple signed it, and Apple tells us when it renews, ends or is refunded. We keep, for your account: Apple's identifier for the subscription, its plan, when it expires and whether it is active, and how often it has moved between Sessions accounts.

What we do not do

No advertising, no tracking, and no sale or sharing of data. The app sends no usage analytics; the only counts kept are how many Sessions AI requests your account made, to apply its limits.

Where data is stored

Your data is stored with Supabase (its database and file storage), and our service runs on Vercel. A backup of the database, where Supabase keeps one, holds what the database holds: the encrypted text and the facts listed above. It expires on Supabase's schedule.

Age

Sessions doesn't ask your age. It is not directed at children under 13 and does not knowingly collect their data; if we learn that it has, we delete it.

Changes

We will post changes here with a new date. Material changes to what a processor receives require a new consent from you.