Privacy Policy

Effective as of 14 November 2026

Sessionly (“Sessionly,” “I,” “me,” or “we”) is a ledger of AI coding agent sessions: what was asked, which tools ran, which files changed and what it cost. It is operated by Kristiyan Ivanov, an individual (“the operator”). This Privacy Policy describes how I process personal information collected through the website at sessionly.dev, the hosted Sessionly service when I offer it (the “Hosted Service”), the sale of licenses, and emails you and I exchange (collectively, the “Service”).

The Service is intended for businesses and developers. When an organization (“org”) uses Sessionly for its team, that org decides whose sessions are collected, what an upload contains and who may see it. If you are an engineer whose sessions your employer or client collects with Sessionly, they are responsible for that collection; please direct questions about it to them first.

The software on your machine, and self-hosted installs. The sessionly program stores what it captures in a folder on your own machine (~/.sessionly). It does not report usage, telemetry or account data to me and does not check for updates. Its only network connection is the upload to the server you connect it to with sessionly connect; until you do that, nothing leaves the machine. If you run the Sessionly server yourself, everything described below is stored on your infrastructure, not mine, and license files are verified offline. This policy therefore applies to local and self-hosted use only to the extent you contact me, buy a license, or use the website.

Personal Information I Collect

Information you provide

• Communications data from our exchanges, such as when you email me for support, to ask about a license or to be told when the Hosted Service opens: your email address, your name if you give it, and what you write.
• License data. If you buy a Business or Enterprise license: the name and identifier of your org, the edition, the number of people it covers, its dates, a contact email address, and the billing details needed to issue an invoice. The license file itself contains the org identifier, edition, features, seats and dates, and no personal information.
• Account data on the Hosted Service: for each access token, the email address it is issued to (stored lower-case), an optional name, its role (admin, member or ci), and when it was created, last used and revoked. Only a hash of the token is stored. There are no passwords.

Information uploaded to the Hosted Service

A machine connected to the Hosted Service uploads one session record for each coding agent session. With the default content level (metadata) a record contains:

• a random identifier of the machine, which agent ran the session (Claude Code, Cursor or Grok), the session's identifier, and when it started and ended;
• the git user name and email address and the repository's remote address, as set in git on that machine. They are a label, not a verified identity;
• counts and timings: prompts and how long each turn took, tool calls with the tool's name, status, duration and the size of its output, subagents, permission requests;
• the files the agent read or changed, as paths relative to the repository or to the home directory, with lines added and removed;
• models, token counts and cost;
• the rewrite measurement: how many of the lines the agent added are still in each file.

Two things are added only if the person uploading switches them on:

• Previews (sessionly settings --content previews): the first 200 characters of each prompt, a one-line summary of each tool call (the shell command, search pattern or URL, cut to 200 characters), the first 200 characters of an error, the session's title, and SHA-256 hashes of prompts and tool inputs. A preview can contain anything that was typed or run, including personal information or a secret.
• Line hashes (sessionly settings --line-hashes on): for each changed file and model, a short one-way hash of every line the agent added. A hash does not give the line back, but a short or common line can be guessed and checked against it.

If an org adds the Sessionly GitHub Action to a repository, the Action sends a pull request report when a pull request is opened, pushed to, reviewed and closed: the repository's name, the pull request's number, title and address, its author's GitHub user name, its state, branch names and dates, counts of commits, reviews, review comments and review rounds, and, per changed file, hashes of the lines the pull request adds. The email addresses on the pull request's commits are sent with each report so that lines are matched only to sessions by the people who committed; they are used for that comparison and are not stored.

What is never uploaded: full prompts, the agent's replies, file contents, the output of commands, the raw capture kept on the machine, and absolute paths under a home directory. No source code is uploaded, by the program or by the Action.

Automatic data collection

• This website (sessionly.dev) is static. It sets no cookies, loads no scripts and uses no analytics. Vercel, which serves it, keeps its own request logs (including IP addresses) under Vercel's Privacy Policy.
• The dashboard keeps your access token in your browser's local storage so you stay signed in. It sets no cookies and has no analytics.
• Server logs. The Sessionly server does not write a log of requests. The infrastructure in front of the Hosted Service will keep ordinary connection logs (IP address, time, address requested, status); how long they are kept will be stated here before the Hosted Service opens.
• Email. I do not embed tracking pixels, and I do not use open or click tracking.

How I Use Personal Information

Service delivery and operations

• Provide, operate and maintain the Service, including storing uploaded sessions and pull request reports and showing them to the people in the org who are allowed to see them;
• Issue access tokens and license files;
• Issue invoices and keep the records the law requires;
• Keep the Service secure and prevent abuse;
• Communicate with you about the Service: security notices, changes to these policies, support and administrative messages;
• Respond to your requests, questions and feedback.

Compliance and protection

• Comply with applicable laws, lawful requests and legal process;
• Protect my, your or others' rights, privacy, safety or property, including by making and defending legal claims;
• Enforce the Terms of Service;
• Prevent, identify, investigate and deter fraudulent, harmful, unauthorized or illegal activity.

I do not use your data to train models, to build advertising profiles, or for marketing to third parties. I do not use uploaded sessions to assess the people in them; what an org does with its own sessions is that org's decision and responsibility.

How I Share Personal Information

I do not sell personal information. I share it only as follows:

• Service providers that work on my behalf and may process personal information only to provide their service to me:

  Provider	Purpose	What they see
  Vercel	Hosting this website	Web request logs for sessionly.dev

  The Hosted Service is not open yet, so no provider hosts session data for me today. The provider that will host it, and any payment or email provider it uses, will be added to this table before it opens. Email you send me is handled by my mailbox provider.
• Your org. An admin of an org can see every session and pull request report uploaded to that org, and the list of its tokens. A member sees their own sessions.
• Professional advisors, such as an accountant or lawyer, where necessary in the course of their services to me.
• Authorities and others, where I believe in good faith it is necessary to comply with applicable law or to protect the rights, privacy, safety or property of myself or others.
• A successor operator. If I transfer Sessionly to a company I form or to another operator, or if the Service is otherwise sold or merged, personal information may be transferred to the successor, who will be bound by this policy until it is changed with notice to you.

Data Retention

• Uploaded sessions and pull request reports are kept while the org's account on the Hosted Service exists, and deleted when the org asks me to delete them or closes its account. Uploading a session again replaces the earlier copy.
• Tokens are kept while the account exists. A revoked token stops working at once; its entry (email, role, dates, never the token) is kept so the org can see who had access.
• License and invoice records are kept as long as tax and accounting law requires.
• Emails are kept as long as they are needed to answer you and to keep a record of what was agreed.

When I no longer need personal information, I delete or anonymize it. To delete your account and its data, email me (see below). What the sessionly program keeps on your own machine is yours to delete: remove ~/.sessionly.

Security

Only a hash of each access token is stored. The program refuses to upload over plain HTTP to anything but a server on the same machine. A member's token reads only that person's sessions, and a token for the GitHub Action can report pull requests and nothing else. The security page describes these measures and their limits. Still, security risk is inherent in all internet and information technologies, and I cannot guarantee the security of your personal information.

International Data Transfers

I am based in Bulgaria. Vercel is a United States company and serves this website from its network worldwide, so the request logs for your visit may be processed in the United States and elsewhere. Where the Hosted Service runs will be stated here before it opens.

If you are located in the European Economic Area, the United Kingdom or Switzerland, I will ensure that any transfer of your personal information is carried out in accordance with applicable data protection law, including by relying on standard contractual clauses approved by the European Commission or other appropriate safeguards offered by the service providers above.

Information for European Users (GDPR)

If you are located in the EEA, the United Kingdom or Switzerland, the following additional provisions apply.

Data controller. Kristiyan Ivanov, a self-employed individual registered in Bulgaria (BULSTAT 180490275), is the controller for website, license, billing and communications data, and for the email address an account is opened with. For the sessions and pull request reports an org uploads to the Hosted Service, the org is the controller and I act as its processor under the Data Processing Agreement, which forms part of the Terms of Service.

Legal bases for processing.

• Performance of a contract: processing needed to provide the Service to you under the Terms of Service, including issuing tokens and licenses.
• Legitimate interests: operating and securing the Service, preventing abuse, and communicating with you, where those interests are not overridden by your rights.
• Compliance with legal obligations: for example keeping invoice records.
• Consent: where you have given it for a specific purpose, such as asking to be told when the Hosted Service opens. You may withdraw consent at any time by contacting me.

Your rights under GDPR. In addition to the rights below, you may lodge a complaint with your local data protection supervisory authority if you believe my processing of your personal information violates applicable law.

Your Rights and Choices

Regardless of where you are located, you may:

• Access the personal information I hold about you;
• Update or correct inaccurate personal information;
• Delete your personal information, including your account;
• Export your personal information in a portable format;
• Object to or restrict certain processing of your personal information.

Some of this you can do yourself: sessionly export shows exactly what your machine would upload for a session, sessionly disconnect stops uploads, and an org's admins can revoke tokens. If your sessions were uploaded by or for an org, ask that org first, since it decides what happens to them. For anything else, email kristiyan@sessionly.dev. I will respond in accordance with applicable law and within a reasonable time.

Emails. I send service emails only: replies to what you wrote, tokens and license files you asked for, invoices, and notices about the Service or these policies. I do not currently run a marketing list; if I start one, it will be opt-in with an unsubscribe link in every message.

Cookies and tracking. Neither this website nor the dashboard sets cookies. The dashboard uses your browser's local storage only to keep you signed in; signing out or clearing it removes the token. There are no analytics, advertising or cross-site trackers, so there is no cookie banner.

Declining to provide information. I need certain information, such as an email address for a token or the name of your org for a license, to provide the Service. If you do not provide it, I may not be able to provide the Service to you.

Other Sites and Services

Sessionly reads sessions recorded by coding agents made by third parties (Claude Code, Cursor, Grok) and its Action runs on GitHub. The website links to GitHub, where the code is published. These links and integrations are not an endorsement of, or a representation that I am affiliated with, any third party. I do not control those services and am not responsible for their actions. Please read their privacy policies.

Children

The Service is not intended for anyone under 16 years of age, and I do not knowingly collect personal information from children under 16. If you believe a child has provided me with personal information, please contact me and I will delete it as the law requires.

Changes to This Privacy Policy

I may modify this Privacy Policy at any time. If I make material changes, I will notify you by updating the date at the top, posting the new version on the website and, where the change affects account holders, emailing the address on your account. Changes take effect when posted unless stated otherwise. Your use of the Service after the effective date of a modified policy means you accept it.

How to Contact Me

• Email: kristiyan@sessionly.dev
• Operator: Kristiyan Ivanov, ul. Vasil Petleshkov 31-33, apt. 17, 1510 Sofia, Bulgaria