Privacy Policy

Last updated: October 13, 2026

This Privacy Policy explains how Open Session Inc. ("open session", "we", "us" or "our") collects, uses and shares personal information through our website at opensession.co (the "site"), and when you contact us or sign up for our emails. It also explains the choices and rights you have. "Personal information" means information that identifies you or could reasonably be linked to you.

Your use of the site is also governed by our Terms of Service.

1. Who we are and what this policy covers

Open Session Inc. is a Delaware corporation based in San Diego, California. We are a design company, and we also make BOS [Brand Operating System]. For the personal information described in this policy, we are the "controller": we decide how and why it is used. The exception is personal information we handle on a client's behalf in client work (section 2).

This policy covers:

the site, opensession.co;
the short links we publish at link.opensession.co, and our link page at links.opensession.co, which link.opensession.co leads to;
emails and other messages you exchange with us about the site or our work.

It does not cover:

BOS. BOS has its own Privacy Policy and Terms of Service at bos.live (section 15).
Other companies' websites and services, such as Substack, Cal.com, Figma and GitHub, even when we link to them or use them. Their own privacy policies apply (section 13).

2. Information we collect

Information you give us

Contact form. Your name, email address and message, and, if you choose, your company and what you are interested in (collaboration, partnership, networking or something else). We email your message to our team and keep a record of it in our contact database (see "Our contact records" below). The form also has an optional newsletter box, which starts unticked (see "Email sign-ups" below). Please do not include sensitive information, such as health or financial details, in your message.
Email sign-ups. Your email address, if you choose to give it to us. The "Stay in the loop" form in the site footer adds you to our own mailing list. The prompt that may appear when you open a free resource, and the newsletter box on the contact form, are for our newsletter on Substack: when you use them, your browser sends your address to Substack in a new tab, where Substack handles your subscription, and we keep a record that you asked to subscribe. Giving your email address is always optional: you can skip the free-resource prompt and go straight to the resource. On our link page, the prompt sends your address from your browser directly to Substack, and the site does not add it to our contact database.
Spam protection. Our contact form, footer sign-up form and free-resource prompt use a bot check that we host ourselves. It involves no third party and sets no cookies.
Emails, calls and messages. What you send us when you email us, write to us on another platform, or book a call with us. If you book a call through our booking page on Cal.com, Cal.com collects the details you enter, such as your name, email address and any notes, and shares them with us.
Client work. If your organization works with us, we receive the information needed to carry out and manage that work, such as business contact details, project information, files and our communications. Our agreement with your organization governs that information, and where it says something different from this policy, the agreement controls. When we handle personal information on a client's behalf, the client's own privacy notice also applies.

Our contact records

When you send us a message through the contact form, join our mailing list in the footer, or ask to subscribe to our newsletter through a free resource or the contact form, we keep a record of it in our contact database. The record holds your email address, any name and company you gave us, whether you are on our mailing list, what you did and when, the page you were on, the free resource you asked for or the topic and message you wrote, and the country your request came from, which our hosting provider works out from your IP address. For a sign-up, it also holds the words shown with the form or box you used. For a Substack subscription, we record only that we sent you to Substack, not whether you completed it. We use these records to answer you, to manage our mailing list, and to show what you agreed to and when.

Information collected automatically

Technical information. When you visit the site or our link page, your browser sends standard information with each request: your IP address, your browser and device type, the page you asked for, the page that referred you, and the date and time. Our hosting providers process this information to deliver pages and protect them, and may keep it in server logs for a limited time.
Your region, for cookie choices. Each time you load a page, your browser contacts Inth, which runs our consent management. Inth receives your IP address and browser details, and uses your IP address to work out which privacy rules apply where you are, so the site can offer the right cookie choices (section 7).
Analytics. We use Google Analytics to understand how the site and our link page are used. It collects information such as the pages you view, how you arrived, how long you stay and how you interact with pages, your device and browser type, and your approximate location, which Google works out from your IP address. On the site, what it collects depends on your region and your choices (section 7).
Email activity. The services that send our emails, Substack and, where we use it, Resend, may tell us whether an email was delivered or opened, or whether a link in it was clicked.

What we do not collect

Your camera feed. The "Go live" option on our home page uses your camera only if you choose it and your browser allows it. The video stays in your browser: we do not record, receive or store it. A snapshot you take is saved only to your own device. The site never uses your microphone.
Accounts and payments. The site has no visitor accounts and does not take payments.

Giving us information is your choice

Outside client work, no law or contract requires you to give us personal information. If you do not give us your name, email address and message, we cannot reply to you through the contact form. If you do not give us your email address, we cannot send you our newsletter. You can use the rest of the site without giving us your name or email address.

3. How we use information

We use personal information to:

reply to your messages and booking requests, and send you a short receipt when you use the contact form (the receipt does not repeat your message);
keep a record of the messages you send us through the site, of your sign-ups, and of what you agreed to;
send you the newsletter and other emails you signed up for, such as new posts, free resources and news about our work and products, including BOS;
run, maintain and improve the site, and understand how people use it;
keep the site secure and prevent spam, fraud and abuse;
offer, record and respect your cookie choices;
carry out and manage client work;
meet our legal obligations, enforce our Terms of Service, and protect our rights and the rights and safety of others.

We do not make decisions about you based solely on automated processing that have legal or similarly significant effects on you.

4. Legal bases for visitors in the EEA and the UK

If the data protection law of the European Economic Area (EEA) or the United Kingdom applies to how we handle your personal information, we rely on these legal bases:

Consent, for marketing emails and, in the EEA and the UK, for analytics cookies on the site. You can withdraw your consent at any time (sections 7 and 9). Withdrawing it does not affect what we did before.
Contract, to carry out client work, or to take steps you ask for before entering into an agreement with us.
Legitimate interests, to reply to people who contact us, to keep records of messages and sign-ups and of the consent given, to run and secure the site and prevent abuse, to apply the right cookie rules for your region, and for the basic measurement without cookies described in section 7. We weigh these interests against your rights, and you can object (section 9).
Legal obligation, where we must keep records, such as a record of your cookie choices, or respond to lawful requests.

We share personal information only as described in this policy.

Service providers

These companies help us run the site and our business, and process personal information for those purposes:

Vercel, which hosts the site and handles every request to it, including the forms you submit.
Supabase, which hosts our contact database in the United States.
Resend, which sends the emails from our contact form, and which we may also use to send emails to our mailing list.
Substack, which hosts our newsletter (see below).
Google, which provides Google Analytics and hosts our email (Google Workspace). Section 6 explains how Google may also use analytics information for its own purposes.
Inth, which runs our consent management.
Cal.com, which runs our booking page, if you book a call.
Dub, which runs our short links at link.opensession.co.
GitHub, which hosts our link page.
Other business software we use to run open session and work with clients, such as email, communication, file storage, project management, productivity and AI tools. These tools may hold or process messages and other information you send us.

Substack

When you subscribe to our newsletter on Substack, through a free resource, the contact form or our link page, your browser sends your email address to Substack, which delivers our newsletter for us. Substack also acts on its own behalf: it creates a Substack account for your email address and may use it for its own purposes, such as sending you emails about Substack, under its own privacy policy at substack.com/privacy. We do not control that use. Apart from Substack's own use described here and a business transfer described below, we do not sell, rent or give your email address to other companies for their own marketing.

Other recipients

At your direction or with your consent. When you ask us to share information, or agree that we may.
Clients and collaborators. In client work, as our agreement with the client allows.
Legal and safety. Authorities or others, when the law requires it, or when it is needed to protect the rights, property or safety of open session, our clients, visitors or others, or to enforce our Terms of Service.
Business transfers. If we are involved in a merger, acquisition, financing, reorganization or sale of assets, personal information may be transferred to the other parties as part of that transaction.
Professional advisers. Lawyers, accountants, auditors and insurers, under duties of confidentiality.

We may also share information that has been aggregated or de-identified so that it can no longer reasonably identify you.

We do not sell personal information for money. We do not show ads on the site, and we do not use advertising or retargeting pixels on it.

We do use Google Analytics. Google's consent mode includes advertising signals (called ad storage, ad user data and ad personalization) that tell Google whether information from a visit may be used for advertising. Before you make a choice in the EEA, the UK or Quebec, these signals are set to "denied". Elsewhere, our current setup sets them to "granted" by default, unless your browser sends a Global Privacy Control signal and you have not already made a choice on the site. When they are granted, Google may use information from your visit, such as cookie identifiers, your IP address and the pages you view, for its own purposes, including advertising, under Google's policies and the settings that apply to our Google Analytics account. Our link page does not use consent mode, so Google may use information from visits there in the same way, wherever you are (section 7).

Some US state privacy laws may treat this as "selling" personal information or "sharing" it for cross-context behavioral advertising (also called targeted advertising). To opt out:

Turn on Global Privacy Control in your browser, or with a browser extension that supports it. If you have not already made a choice on the site, we honor it automatically: analytics cookies stay off and Google's advertising signals are set to "denied". If you made a choice before turning it on, that choice stays in place until you change it in Cookie settings, clear the site's storage in your browser, or it expires after 12 months.
Use Cookie settings in the site footer and choose Decline. This turns off analytics cookies and sets Google's advertising signals to "denied" for your browser. Switching off only Analytics under Details stops analytics cookies but leaves Google's advertising signals as they were.
On our link page, where these two options do not apply, use Google's opt-out tool or block cookies in your browser (section 7).

7. Cookies and similar technologies

Cookies are small files a website stores in your browser. Your browser's local storage works in a similar way. This section explains how the site and our link page use them.

How analytics works on the site

Google's analytics tag loads on every page of the site, for every visitor. It uses Google's consent mode, which tells Google whether analytics cookies may be used. What happens depends on where you are visiting from, which Inth works out from your IP address:

The EEA, the UK and Quebec. We ask first. A consent panel offers Accept all, Decline and Details. Analytics cookies are set only if you accept.
California. Analytics cookies are on by default. Until you make a choice, a consent panel lets you accept, or turn analytics off under Details. Section 6 explains how to also turn off Google's advertising signals. If you have not made a choice, we honor Global Privacy Control signals automatically.
Everywhere else, including Switzerland and US states other than California. Analytics cookies are on by default, and we do not show a consent panel unless you open Cookie settings. If you have not made a choice, we honor Global Privacy Control signals here too.

When analytics cookies are off, for example before you make a choice in a region where we ask first, after you decline, or when we honor a Global Privacy Control signal, Google's tag does not set analytics cookies. It may still send Google basic measurement requests without cookies. These requests can include the page you are viewing and the page that referred you, and, like any web request, your IP address and browser and device details.

Our link page

Our link page at links.opensession.co works differently. Google Analytics loads there for every visitor in every region, without a consent panel, and may set the analytics cookies listed below without asking first. Cookie settings and Global Privacy Control do not apply there. You can block it with Google's opt-out tool or your browser settings.

The cookies and storage we use

Necessary

c15t (a cookie and a local storage entry, set by the site): remembers your cookie choices, when you made them, and a random identifier for your choice. It is set only when you make a choice, and lasts 12 months.
c15t-pending-consent-submissions (local storage): briefly holds a choice that could not yet be sent to Inth, until it can be sent.

Preferences

os-theme (local storage): remembers a light or dark theme, if you choose one.
os_resource_access (local storage): if you answer the optional email prompt on a free resource, your browser keeps a note that you chose to subscribe or skipped, and when, so that we know whether to ask you again. It can stay until you clear your browser storage. It never contains your email address and is not sent to us.

You can remove these preference entries at any time by clearing your browser storage.

Analytics (set by Google; on the site, only when analytics cookies are allowed)

_ga: distinguishes visitors. Up to 2 years.
_ga_VCQFSDNWJN: keeps track of sessions for our Google Analytics property. Up to 2 years.

Some browsers limit these cookies to a shorter period.

Short links

When you follow one of our short links at link.opensession.co, Dub, which runs them, may record the click, and sets a cookie on link.opensession.co whose name begins with dub_id. It lasts about one hour.

The bot check on our forms and the camera feature set no cookies.

Your choices

Cookie settings. Use the Cookie settings button in the site footer to review or change your choice at any time.
Global Privacy Control. In regions where analytics is on by default, if you have not already made a choice on the site, we honor a Global Privacy Control signal from your browser automatically, as described in section 6.
Browser settings. You can block or delete cookies and local storage in your browser. If you do, the site will no longer remember your choices.
Google's opt-out tool. Google offers a browser add-on that stops Google Analytics from collecting information about your visits, at tools.google.com/dlpage/gaoptout.
Do Not Track. Some browsers send a "Do Not Track" signal. There is no common standard for responding to it, and the site does not respond to it. We do honor Global Privacy Control, as described above.

To learn how Google uses information from sites that use its services, see policies.google.com/technologies/partner-sites.

Other than Google, as described in this section and section 6, we do not allow third parties to collect personal information about your online activities over time and across different websites when you use the site.

8. How long we keep information

We keep personal information only for as long as we need it for the purposes in this policy, unless the law requires or allows us to keep it longer, for example to resolve disputes or to establish or defend legal claims.

Messages and contact form submissions. Messages reach us by email. The site also records each contact form submission in our contact database, even if the email to our team does not go through. We keep them for as long as we need them to reply, follow up and keep a record of our conversations. You can ask us to delete them (section 9). Resend keeps records of the emails it sends for us under its own retention settings.
Email sign-ups. Your address stays on our mailing list or our newsletter until you unsubscribe or ask us to delete it. After you unsubscribe, we or our email provider may keep a minimal record of your address and the fact that you unsubscribed, so that we do not email you again. We may keep the record of your sign-ups in our contact database, including what you agreed to and when, for as long as we need it to show that you agreed. Unsubscribing through Substack does not change that record. Substack keeps your Substack account under its own policy.
Analytics. Google keeps analytics data for the retention period set in our Google Analytics account. Analytics cookies last up to 2 years (section 7).
Cookie choices. Your browser keeps your choice for 12 months. Inth keeps a record of choices made on the site so that we can show what was chosen and when.
Server logs. Kept by our hosting providers for a limited time, under their retention settings.
Bookings. Cal.com and our calendars keep booking details for as long as we need them to arrange and follow up on the call.
Client work. For the length of the work, and afterwards for as long as our agreement with the client allows or as we need for legal, tax and accounting purposes.

9. Your rights and choices

Unsubscribing from our emails

Every email from our Substack newsletter has an unsubscribe link. Using it removes you from our Substack newsletter, but not from our own mailing list. Your Substack account remains, and you can manage or delete it through Substack.
Any marketing email we send through another service, such as Resend, has its own unsubscribe link.
Unsubscribing from one list may not remove you from another. To be removed from every list we manage, email us at hello@opensession.co.
After you unsubscribe, we may still reply to messages you send us.

Your privacy rights

Depending on where you live, you may have the right to:

Access: know what personal information we hold about you, and get a copy of it;
Correction: ask us to correct inaccurate personal information;
Deletion: ask us to delete your personal information;
Portability: receive the personal information you gave us in a commonly used, machine-readable format;
Objection and restriction: object to processing based on our legitimate interests, or ask us to limit how we use your personal information. You can always object to marketing emails;
Withdraw consent: where we rely on your consent, withdraw it at any time;
Opt out of sale, sharing or targeted advertising: see section 6;
Appeal: appeal a decision we make about your request.

We will not discriminate against you for exercising any of these rights.

If you ask us to delete information, we will also ask the service providers that hold it for us to delete it, where needed. Information that Substack, Cal.com or another company holds for its own purposes is covered by that company's own policy. We may keep information that the law requires us to keep.

The EEA, the UK and Switzerland

You can also complain to your data protection authority. In the UK, that is the Information Commissioner's Office. In Switzerland, it is the Federal Data Protection and Information Commissioner. We would welcome the chance to address your concern first.

California and other US states

The rights above include the rights that US state privacy laws describe, such as the rights to know, access, correct and delete personal information, and to opt out of its sale, sharing or use for targeted advertising.

California law asks us to describe the categories of personal information we collect. We collect:

identifiers, such as your name, email address, IP address and cookie identifiers;
professional information, such as your company, if you share it;
internet or network activity, such as the pages you view, how you interact with the site, and the sign-ups and free-resource requests you make on it;
approximate location, worked out from your IP address (we do not collect precise geolocation);
anything you choose to include in a message to us.

We collect this information from the sources in section 2, use it for the purposes in section 3, and keep it as section 8 describes. We disclose it for business purposes to the service providers in section 5. Identifiers and internet activity may be made available to Google in the way section 6 describes, which some laws may treat as selling or sharing. We do not ask for sensitive personal information, and we do not use it to infer characteristics about you.

How to make a request

How to ask. Email hello@opensession.co with "Privacy request" in the subject line (California residents can use "CCPA Request"), and tell us what you would like us to do and which email address or other details your request concerns.
Verification. We may need to confirm your identity before we act on a request, usually by confirming that you control the email address involved. We use the information you give us for verification only for that purpose.
Authorized agents. Someone you authorize can make a request for you with your signed permission. We may ask you to confirm your identity with us directly.
Timing. We respond within the time required by the law that applies to you. If we need more time, we will tell you.
Appeals. If we decline your request, we will tell you why. Where you have a right to appeal, you can do so by replying to our decision. If we deny your appeal, you can contact your state attorney general.

10. Children

The site is intended for adults. It is not directed to children, and we do not knowingly collect personal information from anyone under 18. If you are under 18, please do not send us personal information through the site. If you believe a child has given us personal information, contact us and we will delete it. We have no actual knowledge of selling or sharing the personal information of anyone under 16.

11. International transfers

We are based in the United States. We and our service providers process personal information in the United States and in other countries. Data protection laws there may differ from, and may be less protective than, the laws where you live. Contact us if you would like more information about how your information is handled when it is transferred.

12. Security

We use reasonable measures designed to protect personal information. For example, the site is served only over encrypted connections (HTTPS), it has no visitor accounts, and visitors' browsers cannot read or change our contact database: the site writes to it only from its servers, using a secret key, and only authorized members of our team can view it. No method of sending or storing information is completely secure, so we cannot guarantee the security of your information. If you think you have found a security problem on the site, please tell us at hello@opensession.co.

13. Links to other websites and services

The site may link to websites and services run by others, including:

our newsletter and the original versions of our posts on Substack and Medium;
our profiles on GitHub, Figma, Instagram, LinkedIn and Substack;
our booking page on Cal.com;
free resources hosted on Figma, GitHub and other platforms;
the websites of clients and other organizations we mention;
AI assistants. Some pages may include links that open a post in an AI assistant, such as Claude, ChatGPT, Gemini or Grok. If you use one, your browser opens that service with a prompt that contains only the post's title and web address, and may also copy the prompt to your clipboard. We send the service no information about you.

Some of our links include tags that tell the destination you came from our site. These websites and services have their own terms and privacy policies, which we do not control. When you use them, they may collect information about you, including through their own cookies.

14. Artificial intelligence

We do not use personal information collected through the site, such as contact form messages and subscribers' email addresses, to train artificial intelligence or machine-learning models.

15. BOS

BOS [Brand Operating System] is covered by its own Privacy Policy (bos.live/legal/privacy) and Terms of Service (bos.live/legal/terms), not by this policy. If you sign up for our emails on this site, this policy applies to that sign-up, even when our emails are about BOS.

16. Changes to this policy

We may update this policy from time to time. The date at the top shows when it last changed.

Material changes. If we make a material change, we will post a notice on this page at least 30 days before the change takes effect. A material change is one that uses personal information for a new purpose, shares it with a new kind of recipient, or reduces your rights or choices. Starting to use a feature or service provider that this policy already describes is not a material change.
Changes required sooner. If the law requires a change, or we need to act quickly to address a security risk, a change may take effect sooner.
Information we already hold. If a change would let us use personal information we already hold in a materially different way, we will ask for your consent first where the law requires it.

17. Contact us

For questions, requests or complaints about privacy, contact Open Session Inc., San Diego, California, United States, at hello@opensession.co.