Document Session Sharing data retention, deletion, and access - #511
Conversation
Adds a "Data retention and access" section to the Agent Session Sharing page covering: - Shared session data expires automatically about one week after creation (matches the in-app expiry message). - Stopping a share ends live access immediately; there is no separate per-session delete control today, unlike shared Blocks, which support an immediate unshare/delete. - Access is grant-based (owner, invitees, optionally the team, optionally anyone with the link), viewers must sign in, and workspace admins can restrict invites/link sharing. - Sharing a session does not by itself send it to a model; shared sessions are excluded from Warp Drive AI indexing, and an agent only sees shared content when AI features are actively used in that session. - Secret Redaction is not applied to Session Sharing (cross-linked with a caution callout). Also cross-links secret-redaction.mdx and privacy.mdx to the new section instead of duplicating the content. Fixes QUALITY-1606. Co-Authored-By: Warp Agent <agent@warp.dev>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
- Don't imply stopping a share leaves data in place until expiry; state only that data is removed no later than the one-week expiry (holds true whether purge happens on stop or at expiry). - Don't assert a default for "anyone with the link" access; describe it as an available setting instead. - Give the Secret Redaction caution its own "Secrets in shared sessions" heading instead of nesting it under "AI and shared sessions", and repoint the secret-redaction.mdx cross-link at the new anchor. - Drop the unverified "right away" timing claim from the shared Blocks contrast note, and link to block-sharing.mdx instead of block-basics.mdx since the claim is about unsharing. Co-Authored-By: Warp Agent <agent@warp.dev>
|
I'm starting a first review of this pull request. You can view the conversation on Warp. I completed the review and no human review was requested for this pull request. Comment Powered by Oz |
|
I'm re-reviewing this pull request in response to a review request. You can view the conversation on Warp. I completed the review and no human review was requested for this pull request. Comment Powered by Oz |
![oz-for-oss[bot]](https://avatars.githubusercontent.com/in/3450139?s=60&v=4){kind=small}
There was a problem hiding this comment.
Overview
This PR updates the Agent Session Sharing docs and related privacy/security cross-links to explain shared-session retention, deletion, access, Secret Redaction behavior, and AI handling. The added structure is useful, but two privacy/data-lifecycle claims overstate what the surrounding docs and cited evidence support.
Concerns
- The new section states that shared session data is removed no later than the one-week expiry, but the cited in-app copy only establishes that expired links cannot be opened.
- The account-deletion sentence promises immediate removal even though the linked Privacy page says deletion jobs run every 24 hours.
Verdict
Found: 1 critical, 1 important, 0 suggestions
Request changes
Comment /oz-review on this pull request to retrigger a review (up to 3 times on the same pull request).
Powered by Oz
There was a problem hiding this comment.
Overview
This PR adds retention, deletion, access, secret-redaction, and AI-processing guidance to Agent Session Sharing and links to it from privacy/security pages. The new section is useful, but two privacy/data-retention claims overstate deletion timing or semantics and should be corrected before merge.
Concerns
- The Session Sharing page should not promise stored session data is removed at the one-week expiry unless backend retention behavior has been confirmed; the in-app expired-link string only proves access expires.
- Account deletion should not be described as immediate because the existing privacy page says deletion jobs run every 24 hours.
Security
- Found privacy/data-handling wording that overpromises deletion guarantees for shared terminal content.
Verdict
Found: 0 critical, 2 important, 0 suggestions
Request changes
Comment /oz-review on this pull request to retrigger a review (up to 3 times on the same pull request).
Powered by Oz
Co-authored-by: oz-for-oss[bot] <277970191+oz-for-oss[bot]@users.noreply.github.com>
Co-authored-by: oz-for-oss[bot] <277970191+oz-for-oss[bot]@users.noreply.github.com>
2 participants
Summary
A customer asked (via Front, relayed in #feedback-agent) what happens to terminal data after a Session Sharing link is created: whether it's stored on Warp's servers, how to clear it without deleting their whole account, and who (human or AI) can access it. This PR documents the answers on the canonical Session Sharing page.
Related: QUALITY-1606
Changes
agents/local-agents/session-sharing.mdx(canonical Session Sharing page — see "Canonical page" note below) — adds a new Data retention and access section covering::::cautionnoting Secret Redaction is not applied to Session Sharing, with a "treat it like sharing your screen" framing.support-and-community/privacy-and-security/secret-redaction.mdx- updated the existing Session Sharing cross-reference to link directly to the canonical page (and the new section) instead of the redirect-stub page.support-and-community/privacy-and-security/privacy.mdx- added a one-line cross-reference from "Transparency and control" to the new retention/access section.Canonical page
There are two "session sharing" pages.
agents/local-agents/session-sharing.mdx("Agent Session Sharing") is canonical — it's the actual content page, and every other reference (theknowledge-and-collaboration/session-sharing/stub,vercel.jsonredirects,security-overview.mdx,roles-and-permissions.mdx) ultimately points readers there.knowledge-and-collaboration/session-sharing/index.mdxis intentionally a thin landing stub that says the content "has moved" and links onward, so I left it untouched.Verification
npm run build- passed (364 pages built, no errors).npm run typecheck(astro check) - passed (0 errors, 0 warnings; pre-existing hints only, unrelated to this change).npm run lint(Trunk) - not run; Trunk isn't installed in this environment (also not vendored in the repo perAGENTS.md).SESSION_EXPIRED_TEXTinwarpdotdev/warp(app/src/ai/agent_management/view.rs):"Sessions expire after one week and cannot be opened.".Pre-merge checklist for a human reviewer
The following could not be independently verified from the docs/client/server repos available to me and are not asserted as claims in the docs. Please confirm before merging; if any turn out to be wrong, update the new "Data retention and access" section accordingly:
Follow-ups
None identified beyond the checklist above.