# Sessions (https://www.getfounderhq.com/docs/analytics/concepts/sessions)

A session is one visit. FounderHQ groups a contact's events into
sessions so you can read a timeline as "what happened in this sitting",
not as a flat list.

## When a session starts and ends

The SDK creates the session ID on the device. It is a UUIDv7, so
sessions sort by time. A new session starts when:

- the visitor has been inactive for 30 minutes, or
- the current session has run for 24 hours.

Each new session opens with a `$session_start` event. Everything
captured after it carries the same session ID until the next rotation.

## Web sessions cross your subdomains

The session ID lives in a first-party cookie (`fhq_ses`) on your
registrable domain. A person who moves from `www.example.com` to
`app.example.com` keeps one session and one attribution chain. Set
`cookie_domain` to override the domain, or `cross_subdomain: false` to
stop sharing.

Two more IDs make web sessions readable:

- `$window_id` — one per browser tab. A person with three tabs open has
  one session and three window IDs.
- `$pageview_id` — one per page. `$pageleave` reports how long that page
  was open, how long it was active, and how far the person scrolled.

## Mobile sessions

Mobile SDKs use the same rules and the same 30-minute idle rotation.
The session ID and the queued events are stored on the device, so a
restart does not lose them. Each screen gets a `$screen_id`.

## Reading and controlling the session

```ts
const sessionId = founderhq.getSessionId();
```

Use it when you need to correlate a support ticket or a server log with
a visit. It returns `null` when collection is not granted.

Turn automatic session capture off with `capture_sessions: false` at
init, or from the key's remote settings in the app. Events still carry
a session ID; you only stop the `$session_start` event.

## Where sessions show up

- A contact's activity groups into sessions, with the entry page, exit
  page, pageview count, and whether the visit converted.
- [Attribution](/analytics/concepts/attribution) counts a `$session_start`,
  `$pageview`, or `$screen` as a possible touch.
- Bot visits get sessions of their own and never join your session
  metrics. See [Bot traffic policy](/analytics/concepts/bot-traffic-policy).

## Related

- [Web SDK](/analytics/sdks/web)
- [Session properties](/analytics/protocol-reference/event-taxonomy)