Cookie policy
How Sessional uses cookies and similar technologies.
What are cookies?
Cookies are small text files stored on your device when you visit a website. They help websites work properly and provide information to the site owners.
Cookies we use
Essential cookies for account access and security are always used. Google Analytics loads only after you opt in through the cookie banner, and only on public marketing pages. It never loads on account pages or pages whose URLs can carry a token. Our first-party visit beacon stays cookie-free.
| Cookie | Purpose | Duration | Type |
|---|---|---|---|
| ss_session | Keeps you signed in to your account | 30 days | Strictly necessary |
| ss_role | Stores your account type for page access | 30 days | Strictly necessary |
| ss_verified | Records whether your email has been verified | 30 days | Strictly necessary |
| ss_demo | Marks the read-only demo account so it cannot change data (set only when you use the demo login) | Session | Strictly necessary |
| csrf_token | Protects signed-in forms and account changes from cross-site request forgery | 24 hours | Strictly necessary |
| admin-persona | Remembers the selected administration workspace view | 30 days | Strictly necessary |
| xero_oauth_state | Validates the return from Xero while connecting an account | 10 minutes | Strictly necessary |
| xero_pkce_verifier | Completes the secure Xero account connection | 10 minutes | Strictly necessary |
Optional Google Analytics cookies
When you opt in, Google Analytics uses the following cookies, as described in Google's GA4 cookie documentation.
| Cookie | Purpose | Default expiry |
|---|---|---|
_ga | Distinguishes users | 2 years |
_ga_<container-id> | Persists session state | 2 years |
When the tag loads, Google receives your IP address and device information and uses the IP address to estimate location. Google may process this information outside Australia.
Local storage
We also use browser local storage to remember your theme preference (light or dark mode) and cookie consent status. This data stays on your device and is never sent to our servers.
Third-party cookies
When you use Stripe to manage your subscription or payment method, Stripe may set its own cookies. These are governed by Stripe's privacy policy.
Managing cookies
You can withdraw Google Analytics consent at any time through the “Cookie settings” link in the footer: choosing “Essential only” stops the tag and deletes its cookies. You can also control cookies through your browser settings. Blocking strictly necessary cookies may prevent you from signing in or using the service.
Your rights
Under the Privacy Act 1988 (Cth) and the Australian Privacy Principles, you have the right to know what cookies are being used and why. If you have questions about our use of cookies, contact us at [email protected].
Last updated: 1 November 2026