# Sessions and Package CDRs

If your consent flow is a single page, you can skip this. Captures are grouped automatically and there is nothing to configure.

Grouping exists for the flows that are not a single page. Co-registration sites collect personal details on one screen, offers on the next, and consent on a third. Each screen produces its own CDR, and individually none of them tells the whole story: one shows a phone number with no disclosure, another shows a disclosure with no phone number. Read together they are a complete record of what the person saw and did.

## What a session is

A session is one person's visit in one browser tab. The SDK creates a session id on first capture and reuses it for every capture from that tab.

Sessions are stored in `sessionStorage`, which has two consequences worth knowing:

- **They are tab-scoped, with one useful subtlety.** A tab the person opens independently, such as a typed URL, a bookmark, or a second window, is a separate session. A tab your page opens *for* them, through a `target="_blank"` link or `window.open`, inherits a copy of the session, so its captures group with the original.
- **They do not survive the tab closing.** There is no cookie and no cross-visit identifier. A session exists to group one visit's captures, not to track a person across visits.

A session also ages out. It rolls over after **30 minutes** without a capture, and after **4 hours** regardless of activity.

## What a Package CDR is

A Package CDR is the set of CDRs from one session, presented as one composite record with a capture timeline and consolidated signer telemetry. Its identifier is `packageId`, derived from the session id, and it comes back on every capture inside `packageData`.

A Package CDR is a grouping, not a separate kind of evidence. Each CDR inside it remains an independent record that can be read, shared, and downloaded on its own.

## What to store

Store the `cdrId` from every capture. That is enough to fetch a record, collect it, and share it.

Store `packageData` if you are building something package-aware, such as presenting a whole flow to a buyer. The API reports `packageId` on a record only when the package holds more than one record, so its presence is itself the signal that the record is part of a multi-record flow.

## Sharing a flow

Moving records into a buyer's own account works one record at a time, because share tokens are per CDR. When a buyer receives several CDRs from one session, those records group into a package on their side automatically.

Separately, you can create a read-only share link for a whole package from the dashboard. That shows a buyer the complete flow in one place without giving them their own copy of each record.

## Next

- [Access and collection](https://app.expressconsent.com/docs/concepts/access): Which organization can download a CDR, which one is charged for it, and how access moves when evidence is shared.
- [Glossary](https://app.expressconsent.com/docs/glossary): The terms used across these docs and the API field names they correspond to.