Signed-in devices
Every browser you've signed in on holds a session cookie for your Ally cabinet. This page lists them all with the last active timestamp. Revoke any device to force it back to the sign-in screen on its next request.
| Device | Location | Last active | Status | |
|---|---|---|---|---|
| Firefox 128 · macOS | London, UK | 4 min ago | This device | — |
| Chrome 129 · Windows 11 | London, UK | Yesterday · 21:14 | Active | Revoke |
| Safari 18 · iPhone | London, UK | Sep 12 · 08:02 | Active | Revoke |
| Edge 131 · Windows 10 | Manchester, UK | Aug 22 · 14:48 | Idle | Revoke |
See something you don't recognise?
Revoke every session with the "Revoke all others" button, then enable 2FA and change your email if it was compromised. Notify the DPO at dpo@allyhub.org — we investigate suspicious sign-in patterns within one working day.
How sessions work
An Ally session is a first-party cookie called aa_sid tied to a server-side session record. The record stores the account ID, the token issued time, an opaque device fingerprint, and the last-active timestamp. Sessions with 30-day "remember me" have a 30-day sliding window (each request refreshes the expiry); without "remember me" the session dies when you close the browser.
Revoking a session marks the server record as invalid; the client cookie is still on the device but the next request rejects it and returns to sign-in. No data is deleted; only access is cut.