Privacy Policy

If you create an account (a host):

• Your name, email address, chosen booking URL, and time zone.
• An avatar image URL, if you set one.
• Your password, stored only as a bcrypt hash. We never store or see the password itself.
• Your availability rules, event types, and bookings.

If you book a session (a guest):

• Your name and email address, which you enter on the booking form.
• The session you booked and its time, and a cancellation reason if you give one.

Guests do not need an account. We do not ask guests for anything beyond what the host needs to hold the session.

Calls run over WebRTC and are relayed by Cloudflare Realtime. We do not record audio or video, and we have no facility to do so.Media passes through Cloudflare's infrastructure to reach the other participants and is not stored by us.

We do collect technical measurements about call quality: how long a call took to connect, round-trip time, packet loss, and whether a connection attempt failed. These describe the connection, not its contents.

Connecting a Google Calendar is optional and off until you turn it on. When you connect one, we ask Google for two permissions and no others:

• calendar.freebusy — read the times you are busy. This returns time ranges only. We do not receive event titles, descriptions, locations, or attendees, and we could not read them if we wanted to.
• calendar.events — add a calendar entry when a session is booked, and remove it if the session is cancelled.

The access and refresh tokens Google issues are encrypted with AES-256-GCM before being written to our database, using a key held outside it. Disconnecting from your dashboard revokes the grant with Google and deletes our copy of the tokens.

Sessionly's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not use Google Calendar data for advertising, we do not sell it, and we do not use it to train machine-learning models.

To run the service you asked for: show your booking page, decide which times are bookable, send booking confirmations and cancellations, place the call, and keep the product working. We do not sell personal data, and we do not run advertising.

We use these providers. Each sees only what it needs to do its job.

• Cloudflare — video and audio relay, and network connectivity for calls.
• Google — calendar free/busy and event write-back, only if you connect a calendar.
• Resend — sending booking confirmation, cancellation, and reminder emails.
• Sentry — error reports when something breaks. These carry technical context such as a room identifier, not call contents.
• Vercel — hosting the website.
• Railway — hosting the application server and database.

Our servers and database are hosted outside India, so your data is processed abroad. We disclose personal data to law enforcement only where legally required.

• Account and booking records: for as long as your account exists.
• Sign-in sessions: refresh tokens are stored as hashes and expire on their own; signing out deletes them.
• Calendar tokens: until you disconnect, or Google revokes the grant.
• Error reports and call-quality measurements: retained on a rolling basis for debugging and never tied to call contents.

Delete your account and we delete the account and its bookings. Ask us and we will confirm when it is done.

• See or correct your details from your dashboard.
• Disconnect Google Calendar at any time from the dashboard, which revokes our access.
• Ask for a copy of your data, or for it to be deleted, by emailing us.
• Guests: email us and we will remove your booking records from a host's account on request.

Depending on where you live you may have further rights over your personal data, including access, correction, erasure, and complaint to a supervisory authority. Write to us and we will act on the request.

Sessionly is not intended for people under 16, and we do not knowingly collect their personal data.

If this policy changes in a way that affects you, we will update the date at the top and tell account holders by email before the change takes effect.

Email support@getsessionly.com with any question about this policy or a request about your data.

See also our Terms of Service.