Joolweb Sessions Pro

Security and Permissions

Sessions Pro uses WordPress native APIs and follows standard security practices:

• WordPress native user APIs : client accounts are managed with wp_create_user() , wp_update_user() , and wp_delete_user() .
• Capability checks : sensitive operations are restricted to authorized users only (for example create_clients , edit_clients , delete_clients , manage_options ).
• Nonce verification : AJAX and form submissions use WordPress nonces ( check_ajax_referer() / wp_verify_nonce() ).
• Input validation and sanitization : request data is sanitized and validated server-side before processing.
• Escaping on output : values are escaped at render time with context-appropriate esc_* / wp_kses_* functions.
• No card storage on site : when online payments are enabled (separate extension), card details are handled by the payment provider and are not stored in WordPress.
• Privacy tools : personal data export and erasure hooks are registered for WordPress Tools → Export Personal Data and Erase Personal Data.

Privacy and optional telemetry

Sessions Pro does not send any data to external servers by default.

Administrators may optionally enable anonymous usage statistics under Sessions Pro → Settings → Privacy (or at the end of the setup wizard). Nothing is sent without an explicit opt-in; declining or turning this off does not affect plugin features.

When enabled, the plugin sends aggregated, non-personal data to the editor API at sessionspro-app.com (HTTPS), typically once per week and when you first opt in:

• Pseudonymous installation ID (UUID)
• Plugin, WordPress and PHP versions, site locale
• Free or premium edition
• Usage ranges (client, session and program counts by bucket)
• Feature flags (e.g. setup wizard completed, reminders enabled)

Never sent: client or coach names, emails, phone numbers, session or note content, exact payment amounts, or your site URL in plain text.

You can disable telemetry at any time in the same settings screen; an opt-out signal is sent and associated reports are removed on the editor side. Data is used to measure versions in production, estimate active installations and improve the product.

Editor privacy policy (telemetry, contact form, purchases): https://sessionspro-app.com/privacy

Client account creation is a core feature of the plugin: coaches need authenticated client accounts to provide private dashboards (sessions, history, documents, profile updates) and role-based access.