Privacy Policy

Last updated November 3, 2026

This Privacy Policy explains what personal data SessionCollab collects, why we collect it, where we keep it and how long we keep it. "We", "us" and "our" mean Inting Technologies Inc., the company that makes SessionCollab. "You" means anyone who uses SessionCollab or visits our website.

The short version

• We collect what we need to run your account, your licences, your purchases and your sessions, and little else.
• Your music goes to the people in your session. It passes through SessionCollab's relay, which keeps a session only for its people until it's removed. To have a session removed, email us at [email protected].
• Paddle handles payments. We never see your card details.
• We don't sell your data, we don't show ads, and we don't use advertising or tracking cookies.
• You can download your data and delete your account in the app at any time.

Who we are

Inting Technologies Inc. makes SessionCollab and runs its online services: SessionCollab accounts at https://account.sessioncollab.com for accounts, licences and billing, and SessionCollab's relay, which runs sessions over the internet.

Our address is 200-4388 Rue Saint-Denis, Montréal, Quebec H2J 2L1, Canada. For anything about privacy, email [email protected].

This policy covers the SessionCollab desktop app, our online services and our website at https://sessioncollab.com. Some data is handled by others, under their own policies:

• Paddle sells SessionCollab Pro as our reseller and merchant of record, and handles payments. Paddle's own privacy policy applies to the payment data you give it.
• Google handles your sign-in if you choose to sign in with Google, under Google's own privacy policy.

What we collect and why

Your account

• Your email address, and your name. You can change your name in the app.
• Your profile picture, if you add one: we keep the image (JPEG, PNG or WebP, at most 64 KB), with any metadata such as location removed. If you sign in with Google and have no picture of your own, a link to your Google profile picture.
• If you sign in with Google: your Google account's ID.
• The versions of our Terms of Service and Privacy Policy you accepted, and when.

We use this to create and run your account, sign you in, and show who you are to the people you work with.

Signing in

• The sign-in codes we email you.
• While a sign-in or sign-up is in progress: the email address you entered.
• For each computer you're signed in on: its session, with tokens stored only as one-way hashes, and when it was used.

We use this to sign you in securely and keep you signed in. When a new computer signs in to your account, we email you.

Your computers

For each computer you sign in on, we store:

• its name (the name your operating system gives it) and its operating system;
• a one-way hash of your operating system's machine ID (the ID itself never leaves your computer);
• the public keys the app creates for that computer: one that proves it's the same computer, and one that lets invites be sealed for it;
• when it was last seen, and when it was last given a licence.

We use this to bind licences to your computers, to apply the limit of 3 computers for Pro, to show you your computers so you can sign them out, and to allow only one free trial per computer.

Your plan and purchases

• Your plan, the start and end dates of your free trial, and when licences were issued to you.
• The checkouts you start: which plan, and when.
• From Paddle: your Paddle customer ID, and the status of your subscriptions and payments, such as the plan, prices, dates, renewals, cancellations, refunds and chargebacks.

We never receive your card or other payment details. We use this to give you the plan you paid for, show it in the app, and handle support and refunds.

Invites

• When you invite someone by email: who invited whom, the email address you entered, the session's name, your name, what the invite allows, and when it was sent and answered.
• The invite itself is sealed in your app for the other person's computers. We store it sealed, and we can't open it.
• If the person has no account and you choose to email them the link, the link passes through our service into the email and isn't kept.

We use this to deliver invites and the emails about them, and to suggest the people you work with when you invite again.

Sessions on our relay

When a session runs on SessionCollab's relay, the relay keeps, for the session:

• the Live Set as the session shares it (tracks, clips, notes, devices, automation and the rest), and its recent changes;
• the audio and other files people share in it;
• the name, colour and profile picture of each person in it, as they chose them in the app;
• the host's licence, so that the people who join can check that the host has Pro: it holds the host's account name and plan, and technical IDs of their account and computer, but not their email address;
• the people the host banned from it, by a code that means something only within that session.

We use this only to run the session for the people in it: to pass changes between them, and to let them join and catch up later.

Security logs

Our services keep security logs: sign-ins, sign-outs, codes that didn't match, computers removed, data downloads, account deletions and changes made by our staff, with the IDs of the accounts and computers involved. They never hold network addresses in clear: they hold keyed one-way hashes of them, which is how we limit repeated attempts, such as asking for too many sign-in codes. Network (IP) addresses are also used for a moment, without being kept, to limit requests and to choose where a new session on our relay is stored.

When you contact us

If you email us, we receive your email address, your message and anything you attach. We use them to answer you.

Our website

Our website doesn't ask for any personal data, and has no forms. Cloudflare, which serves it, processes your network address to deliver the pages and to protect the site from attacks.

What stays on your computer

The desktop app keeps its settings, its logs, your sessions' state, copies of the files shared in them and backup copies of your Live Sets on your own computer. It keeps logs for 7 days and removes session keys from them. None of this is sent to us. We only see something from your computer if you send it to us, for example by attaching a log to a support email.

What other people in a session see

The people in a session see what you share and change in it, along with the name, colour and picture you choose in the app. If you host, they also see your account name as the host: the app shows them your licence, so their app can check that you have Pro. The licence includes your account name, your plan, and technical IDs for your account and your computer. It doesn't include your email address. Whoever runs the relay of a session can see this information too.

Cookies

Our website sets no cookies. When it protects the site from bots, Cloudflare may set a strictly necessary security cookie of its own.

The sign-in pages at https://account.sessioncollab.com, which open in your browser if you sign in with Google, use one cookie. It lasts 15 minutes and keeps your sign-in secure by tying it to your browser. It's strictly necessary for signing in, so it doesn't need your consent.

When you buy Pro, Paddle's checkout opens in your browser, served by Paddle. Paddle may use its own cookies there; see Paddle's privacy policy.

We don't use advertising or tracking cookies anywhere.

Who we share data with

We don't sell your personal data, and we don't share it for advertising. We share it only with:

• Paddle, our reseller and merchant of record. When you start a purchase, we send Paddle your email address and your account ID, so the purchase is linked to your account. Paddle tells us your customer ID and the status of your purchases. Paddle's own privacy policy applies to payment data.
• Cloudflare, which hosts our website, SessionCollab accounts and SessionCollab's relay, and stores their data.
• Resend, which sends our emails: sign-in codes, invites, and notices such as a new computer signing in. It receives the recipient's email address and the email.
• Google, only if you sign in with Google. Google gives us your Google account ID, email address, name and profile picture link. Google's own privacy policy applies to your Google account.
• Professional advisers, such as lawyers and accountants, when we need their help. They must keep it confidential.
• Authorities, when the law requires it, or when it's necessary to protect the rights, safety or property of our users, us or others.
• A buyer or successor, if we sell, merge or reorganize our business. This policy would continue to apply to your data.

Where we keep your data

• Your account, your computers, your plan and the rest of SessionCollab accounts' data are stored by Cloudflare in North America.
• Sessions on our relay are stored by Cloudflare near where they were started, and their files in North America.
• Emails are sent through Resend, in the United States.

How long we keep your data

• Your account, computers, picture and plan: as long as your account exists.
• Sign-in codes: deleted once used or expired.
• Sign-ins and sign-ups in progress: deleted a day after they expire.
• Computers' sessions: a session ends after 90 days without use, and after a year in any case; an ended session's record is deleted 30 days later.
• Invites: they can be answered for 24 hours; their sealed copies are deleted when they're answered or expire, and their record 180 days after they were sent.
• Sessions on our relay, with their files: kept until someone in the session asks us to remove them.
• Checkouts never paid: deleted after 30 days.
• Payment, subscription and refund records: kept for our financial records, also after you delete your account. Paddle's notifications about them are deleted after 90 days.
• Security logs: 400 days.
• Trial records: one-way hashes of computers that have used a free trial. We keep them after an account is deleted, so a computer can't start a second trial.
• Support emails: as long as we need them to handle your request and any follow-up.
• Backups: our provider keeps restorable copies of the accounts' database for 30 days, so data we delete is gone from them 30 days later.

Downloading your data

In the app, Settings › Account › Download your data saves a copy of what SessionCollab accounts hold about you, in a common, machine-readable format (JSON): your account, your picture, your linked sign-ins, your computers and their sessions, your subscriptions and payments, invites and your account's security events.

When you delete your account

You can delete your account in the app: Settings › Account › Delete account. If you have a subscription, cancel it first. When you delete your account:

• you're signed out everywhere at once;
• your email address, name, picture, computers, sign-ins, linked Google identity, invites and unpaid checkouts are deleted;
• what remains is an anonymous record of your plan, purchases, subscriptions and refunds, with your Paddle customer ID, which we keep as financial records;
• we keep the one-way hashes of computers that used a free trial, to prevent trial abuse, and security log entries, which no longer lead to anyone.

Deleting your account doesn't delete the files the app keeps on your computer, such as backups of your Sets. Sessions on our relay that you took part in stay for the other people in them; to have one removed, email us. Paddle keeps its own records under its own policy.

How we protect your data

• Connections between the app, your browser and our services are encrypted in transit (HTTPS).
• There are no passwords to steal. We store sign-ins in a form that can't be read back, even by us.
• Each signed-in computer has a key that never leaves it, and its sign-in only works with that key.
• Our servers digitally sign every licence, so the app can tell if one has been forged or altered.
• Your computer's machine ID never leaves your computer. We only receive a one-way hash of it.
• On your computer, the app keeps your sign-in and your computer's keys encrypted by your operating system (the Data Protection API on Windows, the Keychain on macOS).
• Invites are sealed for the invited person's computers, and we can't open them.
• Paddle handles payments, so your card details never reach us.

No system is perfectly secure.

Your data

You can download your data and delete your account in the app at any time: see Downloading your data and When you delete your account. For anything else about your data, email [email protected].

Children

You must be at least 16 to use SessionCollab.

Changes to this policy

We may update this policy when SessionCollab or the law changes. If we make a significant change, we'll tell you by email or in the app before it takes effect. We last updated this policy on November 3, 2026.

Contact us

Questions about this policy or your data? Email us at [email protected], see our contact page, or write to us at: