Sessions & identity

How Sumidata tracks a visitor across pages, tabs, and login events - and how identity gets stitched to the accounts you already know.

01Three-tier identity model

Three identifiers work together - each with its own lifetime and storage.

02Automatic user isolation

Safe user switching on shared devices - sessions and replays stay separate between accounts.

When identify() is called with a different user ID than the current session, the SDK automatically closes the current session and starts a fresh one bound to the new identity.

// User A logs in
Sumidata.push('identify', ['alice@example.com'])
// Session abc-123, linked to Alice

// Later, User B logs in on the same device
Sumidata.push('identify', ['bob@example.com'])
// → session abc-123 flushed, new session xyz-789 bound to Bob
// → Alice's and Bob's sessions stay separate

Campaign touchpoints recorded on the device are not split by account: identifying Bob copies all of them, Alice's included, to Bob.

03OAuth & redirect resilience

Checkout and OAuth flows redirect the user off your domain. The SDK rehydrates on return.

Before redirecting out, the SDK backs up the session to localStorage. On return:

• If the same project loads within 30 minutes of the visitor's last activity - and the session is under 4 hours old - it continues as if no redirect happened.
• Otherwise, a new session is started - but the user-level identity persists so attribution is maintained.