# Privacy and session authorization | mygpt.work

> Understand how mygpt.work handles account email, short-lived login authorization, order records, email lookup, coupons, and website analytics.

Original page: https://mygpt.work/en/privacy
Language: English

## Authorization scope

The service reads the sessionToken and account email from the official ChatGPT session-endpoint JSON to identify the subscription account, verify eligibility, and process the specified order. It does not require a browser profile, cookie list, localStorage, sessionStorage, or IndexedDB. After decryption, only the sessionToken enters the temporary vault. A login session can represent an authenticated identity and should only be submitted for an account you control.

## Short-lived session handling

Session content is encrypted in the browser before submission and is not written to localStorage. The temporary session ciphertext and sealed per-session data key are retained for no more than 15 minutes and can be removed earlier when processing ends. The longer-lived service master key is restricted runtime configuration outside that limit and is not stored in the order database or durable queue.

## Order and coupon records

Order email, plan, amount, payment state, fulfillment state, timestamps, coupon activity, and referral relationships are retained separately for order lookup, exception handling, and discount validation. The 15-minute limit applies to temporary session credentials, not these business records.

## Controlled order access

The original browser receives a signed HttpOnly credential. Another browser can verify the order email for 24-hour read-only access. Email lookup cannot pay, replace authorization, or access an order from its number alone.

## External services

The specified subscription operation interacts with ChatGPT. Email delivery providers process the recipient address and message content, but messages do not contain login sessions. The website uses Google Analytics and GoatCounter for visit analytics. Browsers connect to those services and submit the visited path, referrer, and technical information about the browser, device, and language; each provider handles that information under its published privacy terms.

## Revocation boundaries

Declining to submit a session prevents new authorization. Clearing browser cookies affects local order access but does not delete server-side order records. Removing the mygpt.work copy of a session does not revoke the official ChatGPT login state.

## Related public resources

- [English overview](https://mygpt.work/en/index.md)
- [Service guide](https://mygpt.work/en/guide.md)
- [Privacy and session authorization](https://mygpt.work/en/privacy.md)
- [Service and order rules](https://mygpt.work/en/terms.md)
- [English journal](https://mygpt.work/en/blog)
- [ChatGPT supported countries and territories](https://help.openai.com/en/articles/7947663-chatgpt-supported-countries-and-territories)
- [Official ChatGPT pricing](https://chatgpt.com/pricing/)