SESSIONLY
COOKIE POLICY
Effective date: 31 August 2026 · Version 1.0
The short version
We do not track you.
We set a small number of cookies that are necessary for Sessionly to work at all — keeping you signed in, and keeping your session secure. That is the whole list.
No analytics cookies. No advertising cookies. No pixels. No session replay. Nothing that follows you to other websites, and nothing that tells anyone else you were here.
There is no cookie banner on Sessionly because there is nothing to ask you about. If that ever changes, you will be asked before anything is set — not afterwards.
1. What this covers
This Cookie Policy explains what Sessionly stores on your device, and why. It forms part of our Terms of Service and should be read with our Privacy Policy, which covers everything else we do with information about you.
"Cookies" here means cookies and the other ways a website can store things on your device, including browser storage. We have described both, because the distinction matters to engineers and not to anyone else.
2. The cookies we set
All of these are first-party — set by Sessionly, readable only by Sessionly — and all are strictly necessary. Sessionly does not work without them.
| Cookie | What it does | How long it lasts |
|---|---|---|
| Session token | Keeps you signed in, so you do not re-enter your password on every page | 30 days for students and experts. 8 hours for administrators |
| Callback cookie | Completes the sign-in process and returns you to the page you were on | Until sign-in finishes |
| CSRF token | Protects you from a hostile site submitting a form on your behalf without your knowledge | For the length of your visit |
You hold one set of these for each role you use. If you are both a student and an expert, you have two sets, and they are separate.
All of them carry three protections, and it is worth saying what each does. httpOnly means no script running in your browser can read them, so a hostile script cannot steal your session. secure means they travel only over an encrypted connection. SameSite means they are not sent when another site makes a request to us, which is what stops a hostile page acting on your behalf.
3. Other things we store on your device
Not cookies, but stored on your device in browser local storage, so you should know about them.
| What | Why | How long |
|---|---|---|
| A booking in progress | So that if you sign in partway through booking, you return to where you were rather than starting again | Until the booking completes, or you clear it |
| A referral code | If you arrived through a referral link, so credit reaches the right person | 30 days |
| Dismissal markers | So a notice you have closed does not reappear every time you load a page | Until you clear your browser storage |
None of these identifies you to us before you sign in, and none is shared with anyone.
4. Third parties
Sessionly loads very little from anyone else, and we would rather list it than summarise it.
| Who | When | What happens |
|---|---|---|
| Only if you choose to sign in with Google | Google sets cookies on its own domain as part of signing you in. That is between you and Google, under their policies | |
| Stripe | Only when you pay | Payment happens on Stripe's own pages, not ours. Stripe sets its own cookies there, on its own domain. Stripe's scripts do not run on Sessionly's pages at all |
| Agora | Only inside a live session | Our video provider connects your call. Its code is loaded only when you are in a session, and not on any other page |
That is the complete list of anything that runs in your browser or sets a cookie. No analytics provider, no advertising network, no social media pixel, no session-replay tool, no tag manager, no A/B testing service, no marketing automation.
One thing that is not a cookie but that you should know about anyway. Sessionly runs on hosting infrastructure that, like every web host, records technical details of each request — including your IP address and browser type — for security and reliability. That happens at the server rather than on your device, so it is not a cookie and nothing is stored in your browser. We have described it here rather than leave it out, and what is kept and for how long is set out in our Privacy Policy.
5. Why there is no cookie banner
Consent is required for cookies that are not necessary — analytics, advertising, anything that builds a profile of you. We do not set any of those, so there is nothing to ask you to agree to.
We have deliberately not put up a banner offering you a choice that does not exist. A banner implies there is something behind it, and there is not.
If we ever add anything non-essential, a real consent request comes first — one that actually blocks the thing until you agree, and that you can change your mind about. We will update this policy before that happens, not after.
6. Controlling what is stored
You can clear or block cookies through your browser settings. Every major browser has this under privacy or security settings.
Be aware of what blocking ours does: because the only cookies we set are the ones that keep you signed in and keep your session secure, blocking them means you cannot stay signed in and cannot book a session. There is no partial mode where you keep the service and lose the tracking, because there is no tracking.
You can clear browser storage the same way, which removes the functional items listed in section 3.
7. Changes
If we change what we store, we will update this policy and change the date at the top. If a change means we start setting something non-essential, we will ask you first rather than telling you afterwards.
Previous versions of this policy are retained. If you want to know what it said on a particular date, ask us.
8. Contact
Questions about anything here:
Sessionly, a California corporation
100 N Clark Drive, Apt 403
Los Angeles, CA 90048
hi@sessionly.co