Devices and IP addresses

The devices a person is signed in on, and the IP addresses Gemmein records.

Devices

Each person can see and end their own sessions. Put the list in your app's account screen, with a Sign out everywhere button. You see the same list on the person's page in the dashboard (Customers → the person → Signed-in devices) and can sign one device out there.

const devices = await g.auth.devices()
// [{ id: "sess_...", device: "Chrome on macOS", place: "United Kingdom",
//    signedInAt, lastActiveAt, expiresAt, current: true, test: false }], newest first

await g.auth.signOutDevice(id)           // this device: signs the app out and fires onSignedOut
await g.auth.signOutDevice(id, { code }) // another device, after a confirm code (below)
await g.auth.signOutEverywhere()         // every device, this one included

device is a browser and system label, and place the approximate country; either is null when it couldn't be read. devices() carries no IP address; you see each device's IP address on the person's page in the dashboard (see IP addresses). current marks the device asking, and test a session your server started with testSession().

What happens if…

If…	What happens	What you do
A person signs out another device and last signed in more than 10 minutes ago	`403 confirm_required`, and Gemmein emails the person a confirm code	Show a code field, then call `signOutDevice(id, { code })`. A wrong code is `400 invalid_code`; calling without a code sends a new one
The id is not one of the person's signed-in devices	`404 device_not_found`: it is already signed out, belongs to someone else, or doesn't exist. Nobody can list or sign out another person's devices	Refresh the list
The value passed isn't a device id	`400 invalid_device`	Pass the `id` from `devices()`; it starts with `sess_`
The person is signed out	`devices()` and `signOutDevice()` answer `401 session_required`; `signOutEverywhere()` treats it as already done	Show the sign-in screen
Someone signs in from a device or country the person hasn't used before	Gemmein emails the person "New sign-in to <app> from <browser> in <country>", with a single-use link, valid for 24 hours, that signs out everywhere. It isn't sent on their first sign-in. In Development, each app environment sends at most 20 of these in 24 hours	Nothing. You can turn the notice off on the Emails page
The place is wrong or `null`	It is the network's approximate country; a VPN or a phone network can place it elsewhere	Show "Unknown place" for `null`
A session ends: signed out, signed out everywhere, signed out by you, the oldest of eleven, or its 30 days run out	Its device record (label, country and IP addresses) is deleted, and it leaves the list at once. The sign-in and sign-out events stay in Logs, and the sign-in event keeps the device label and country	Nothing

IP addresses

Gemmein records the full IP address on every security event of a person and of your own account: a sign-in code asked for or entered (allowed or refused), a session started, a sign-out (one device or everywhere), a rate-limited or refused sign-in attempt, a suspended person's attempt, a confirm code, a data export or deletion, a checkout a person starts, a browser approval asked for from the CLI, and a secret key made or revoked. Each device keeps the address it signed in from and the last one seen on it. Ordinary reads and writes add no address to any event record. The address is read from the connection at Gemmein's edge, never from a header your app sends.

You see it on the person's page (Signed-in devices: each device's IP address and country) and in Logs (each security event's IP address, with a Copy button). The person's own devices() and the new-sign-in email name the country only.

Separately, Gemmein uses the IP address of every request to the service, your members' included, to protect it: its firewall and rate limits block attacks and abuse. Gemmein does this as an independent controller, for security only, never to profile or track anyone. Its firewall and request logs keep full addresses for 30 days, and its load balancer logs for 90 days (see the privacy policy).

What happens if…

If…	What happens	What you do
An address is 30 days old	It is removed. The event stays in Logs without it (Logs keep events 90 days, then a 12-month archive). A device still signed in keeps its last-seen address while it is used	Nothing
A session ends	Its device record, addresses included, is deleted at once. Its sign-in and sign-out events keep their addresses until the 30 days are up, and the sign-in event keeps the device label and country	Nothing
The person exports their data	`sessions` carries each device's addresses, and `signIns` each security event's time and IP address, for the addresses still inside 30 days	Nothing
The person is deleted	Their sessions go, and the IP addresses on the events they made are removed. The events stay, without the address	Nothing
A request has no readable address	The event is recorded without one	Nothing

A privacy notice template

As the controller of your members' data, your own privacy notice is yours to write. If it helps, you can adapt this:

Sign-in security. [App name] runs on Gemmein, which provides sign-in and data storage on our behalf. When you sign in, we record the browser and device type you use, your approximate country, the most recent IP address of each signed-in session, and your IP address when a security event happens (such as a sign-in, sign-out, failed attempt, data request or checkout). These IP addresses are deleted when you sign out, or automatically after 30 days. Your sign-in history (device type and country, without IP addresses) is kept for up to 12 months. [We use this to keep accounts secure and investigate suspicious activity.] We’ll email you when a new device signs in, and you can see and sign out of your devices in your account settings. Gemmein Limited (UK) processes this data as our service provider. Gemmein also uses IP addresses itself, only to protect its service from attacks and abuse, and keeps them in its security logs for up to 90 days.

Was this page helpful?

Last updated 14 October 2026