You can capture and organize notes locally without a Sessions account. Signing in, enabling Cloud Sync, publishing a shared note, and agreeing to cloud processing each have their own purpose and data boundary.
1. Local notes and on-device processing
Sessions keeps recordings, imported audio, notes, transcripts, and saved generated content in the app’s private storage on your iPhone. On-device transcription and intelligence use Apple frameworks. Choosing the local experience does not upload this content to Sessions.
Apple or device-managed backups may include app data depending on your settings. We cannot recover content that exists only on a lost device or delete copies held in your own backups or export destinations.
2. Optional Sessions accounts
Sign in with Apple is used for optional account features. Google sign-in is being prepared and is available only when offered in your build. These providers verify your identity; Sessions does not receive your Apple or Google password.
We store the provider’s stable account identifier, the email address and name supplied for sign-in, verification information, and Sessions login records. We use them to authenticate you, protect account access, and associate enabled services and purchase entitlements with your account. A provider may supply a private relay email or limit the profile it shares. Cloudflare and Neon provide the infrastructure for these account records.
Google sign-in requests only basic identity information: your profile, email, and an identifier used to verify sign-in. It does not request access to Gmail, Google Drive, or Google Calendar. Signing in does not itself give a cloud model access to your recordings or notes.
3. Cloud Sync and shared notes
When Cloud Sync is enabled and available, supported note content and organization data are stored for your Sessions account using Neon and delivered between your devices using PowerSync. Sync is an optional service; it is separate from sending content to a model for processing. Recording backup is a separate capability and is not implied by note sync.
Publishing a shared note stores an encrypted snapshot using Cloudflare and Neon. The link contains the key the recipient’s browser needs to open it. Anyone with the complete link can read and copy that snapshot, so share links only with people you intend to give access. Revoking a publication prevents future retrieval from Sessions but cannot remove copies someone has already saved.
4. Optional cloud processing
Private test builds can offer Cloud Transcription and Cloud Insights. Each requires its own account-bound agreement and can be controlled separately from Cloud Sync. The in-app disclosure identifies what is sent and the applicable processing policy before you agree.
Cloud Transcription sends eligible audio through Cloudflare to the configured speech provider, Deepgram or ElevenLabs. Cloud Insights sends the completed transcript and necessary language and date context through Cloudflare to OpenAI for titles, summaries, and suggested action items. The current Cloud Insights policy excludes audio and Assistant conversations.
Sessions encrypts retained cloud-processing inputs and results. Development policies require input cleanup after processing and within 24 hours if abandoned, and result cleanup after acknowledgement or within 24 hours. Content-free job and usage records are retained for 90 days in Development. Provider-specific handling is stated in the applicable in-app disclosure. Turning off a feature stops new automatic work; withdrawing its processing agreement also cancels pending work and requests retained-content cleanup. A request already sent to a provider cannot be recalled.
An unavailable on-device feature does not authorize an undisclosed upload. Your note content is not used for advertising. Current private processing routes are configured to prevent model-training use of submitted content.
5. Permissions and purchases
Sessions requests microphone access for recording, notification permission for reminders, and Calendar or Reminders access when you enable those integrations. You can change permissions in iOS Settings. Apple handles App Store purchases; Sessions may verify transaction and entitlement identifiers to provide purchased features and prevent misuse.
6. Website, infrastructure, and support
The marketing website has no advertising, client-side analytics, account form, or tracking cookies. Cloudflare delivers the website and API and may process IP addresses, browser details, requested pages, and request times to deliver and protect the service. Infrastructure providers handle operational records under their applicable terms.
If you email us, we receive your address, message, and any attachments you send. Include only the information needed for your request. We do not need a private recording or transcript for ordinary account support.
7. Retention, deletion, and your choices
Local content remains until you delete it or remove the app, subject to device backups. Deleting a note also schedules cleanup of its locally managed audio. Account and synced records are retained to provide the enabled service; signing out or removing the app does not delete a server account. Shared snapshots and exported copies have separate lifecycles.
You can export supported content, manage permissions and cloud preferences, and revoke shared publications. For account access or deletion requests during development, contact tobitech@ymail.com. We may need to verify account ownership before acting. Where applicable, you may have rights to access, correct, export, or delete personal data. The complete in-app account-deletion flow is still being prepared for release.
Limited records may need to be retained for security, transaction integrity, or legal obligations. Removal from provider backups follows their retention schedules; it is not an immediate erasure of every backup copy.
8. Disclosure and security
We do not sell personal information or share it for behavioral advertising. Information is handled by the providers needed for the features you enable, destinations you choose, and where required by law. We use HTTPS, account access controls, and iOS storage protections. Keep your device and account secure; no storage or transmission system is risk-free.
9. Children and policy changes
Sessions is not directed to children under 13. Contact us if you believe a child has provided personal information. We update the date on this page when the policy changes and provide additional notice and consent for material changes where required.
10. Contact
Support and privacy questions can be sent totobitech@ymail.com.