What are cookies?
Cookies are small text files stored on your device when you visit a website. They help websites work properly and provide information to the site owners.
Cookies we use
Sessional only uses cookies that are strictly necessary for the service to function. We do not use tracking or advertising cookies. We load no analytics or advertising scripts.
All of them are set once you are signed in, with one exception: the document-link unlock cookie is set for someone who has no Sessional account and has opened a link a professional sent them. Reading our public pages sets no cookie at all.
| Cookie | Purpose | Duration | Type |
|---|---|---|---|
| ss_session_v2 | Keeps you signed in to your account | 30 days | Strictly necessary |
| ss_role | Stores your account type for page access | 30 days | Strictly necessary |
| ss_verified | Records whether your email has been verified | 30 days | Strictly necessary |
| csrf_token | Protects forms and requests against cross-site request forgery. Set when you sign in, not when you are reading a public page. | 24 hours | Strictly necessary |
| ss_demo | Marks a read-only demo session, so demo accounts cannot change data | 30 days | Strictly necessary |
| ss_impersonating_as | Marks an assisted-support session, the mode in which a member of our staff views your account with your permission in order to help you. Set on the staff member's browser, never on yours. | 30 minutes, with no extension | Strictly necessary |
| ss_ds_unlock_… | Records that you entered the correct code on a locked document link, so the documents on that link open without asking again. One per link, and only on the browser that unlocked it. | 30 minutes | Strictly necessary |
| ss_bounce, ss_role_bounce, ss_role_refresh, ss_imp_bounce | Short-lived breakers that stop a stale sign-in state sending your browser round a redirect loop. Each holds the value 1 and nothing else. | 10 seconds | Strictly necessary |
| xero_oauth_state, xero_pkce_verifier | Set only while you are connecting Xero, so we can confirm the reply from Xero belongs to the request you started | 10 minutes | Strictly necessary |
What we store on your device
As well as the cookies above, we use your browser’s own storage to remember small preferences. None of it is sent to our servers on its own, none of it is used to identify you, and clearing your browser data removes all of it.
- ss_invoice_import_v1: the invoice you were drafting on the free tool, on your device only, so it survives the click through to signup and does not have to be typed again. It holds what you typed, including the organisation and the line items. Nothing about it reaches us unless you create an account and choose to carry it over.
- ss_inv_count: how many invoices you have made on the free tool, so the page can tell you when you are near the limit.
- ss-theme: whether you chose light or dark mode.
- sessional-cookie-consent: that you have seen the cookie notice, so it is not shown again.
- promo-banner-dismissed-v2: that you closed the promotional banner.
- sessional.cta-dismissed: that you closed the sign-up prompt at the bottom of the page. Cleared when you close the tab.
- sessional.desktop-nudge-dismissed-at: when you last closed the “this works better on a bigger screen” note, so it stays away for ten minutes. Cleared when you close the tab.
- sessional.cpd.sandy-seen: that you have already seen the introduction to the reflection assistant.
- admin-sidebar-collapsed and ssml.admin.accounts.savedViews: layout and saved filters, on our own staff’s browsers in the admin console only.
While a member of our staff is writing a reply to you, their browser may hold that unsent draft in tab storage so a page reload does not lose it. It is cleared when the tab is closed.
Third-party cookies
No third party sets a cookie on sessional.co.uk. We load no analytics or advertising scripts.
When you subscribe or change your payment method, we send you to Stripe’s own checkout and billing pages, and Stripe sets its own cookies there. Those are governed by Stripe's privacy policy. The same is true of Xero’s pages if you connect Xero.
Managing cookies
You can control cookies through your browser settings. Blocking strictly necessary cookies may prevent you from signing in or using the service. Since we only use essential cookies, there are no optional cookies to disable.
Your rights
Under the Privacy and Electronic Communications Regulations (PECR) and UK GDPR, you have the right to know what cookies are being used and why. If you have questions about our use of cookies, contact us at [email protected].
Last updated: 8 September 2026