How Session View handles rider data.
This page describes what the system does today. Where a control is planned but not yet in place, it is not listed here — a security page is only useful if everything on it is true.
Access control
Every record belongs to a coach account, and ownership is resolved as part of the database query rather than checked afterwards. A record belonging to another coach is not distinguishable from one that does not exist. Athletes see their own data and nothing else.
Credentials and sessions
Passwords are hashed with Argon2id and are never stored or logged in any recoverable form. A session is an opaque random token held in a cookie; only its SHA-256 is stored, so read access to the database does not yield a usable session. Coaches never set an athlete's password — an invited athlete holds an unusable random hash until they choose one.
Data processing agreement
A data processing agreement is available on request, covering processing purposes, sub-processors, transfers and deletion. Write to us and we will send the current version.
Who you are contracting with
Session View is a product of Watt Labs Ltd (trading as Cadence Labs). Registered in England & Wales, company registration no. 17384389. ICO registration no. ZC221784.