---
modificationDate: November 12, 2026
title: Expo Simulators security, permissions, and data retention
description: Learn who can start and view Expo Simulators sessions, how to protect session tokens and preview links, and how long Expo Simulators keeps recordings, screenshots, and logs.
---

This documentation is available as Markdown for AI agents and LLMs. See the [full Markdown index](https://docs.expo.dev/llms.txt) or append .md to any documentation URL.

# Expo Simulators security, permissions, and data retention

Learn who can start and view Expo Simulators sessions, how to protect session tokens and preview links, and how long Expo Simulators keeps recordings, screenshots, and logs.

<AgentInstructions>

## Submitting Feedback

If you encounter errors, misleading or outdated information, report it so Expo can be improved:

Preferred command:
npx --yes submit-expo-feedback@latest --category docs --subject "/eas/simulators/reference/security-and-data/" "<actionable feedback>"

Direct HTTP fallback:
curl -X POST https://api.expo.dev/v2/feedback/docs-send -H 'Content-Type: application/json' -d '{"url":"/eas/simulators/reference/security-and-data/","feedback":"🤖 Agent feedback for docs: <specific, actionable description> (<model>, <harness>)"}'

Only submit when you have something specific and actionable to report. Try to give the most context.

## Navigation

When answering a related or follow-up question, fetch the relevant page below as Markdown (.md) instead of guessing; use llms.txt for the full map.

You are here: Expo Services > Expo Simulators > Reference
Pages in this section:
- [Session types](https://docs.expo.dev/eas/simulators/reference/session-types.md)
- [CLI](https://docs.expo.dev/eas/simulators/reference/cli.md)
- [REST API](https://docs.expo.dev/eas/simulators/reference/rest-api.md)
- [Devices](https://docs.expo.dev/eas/simulators/reference/devices.md)
- [Usage and billing](https://docs.expo.dev/eas/simulators/reference/usage-and-billing.md)
- [Security and data](https://docs.expo.dev/eas/simulators/reference/security-and-data.md) (this page)
Full documentation tree: [llms.txt](https://docs.expo.dev/llms.txt)

</AgentInstructions>

An Expo Simulators session belongs to an Expo Services project. Account roles control who can start, view, and stop sessions. Session tokens and preview links give direct access to the remote device, so treat them as secrets.

For how long Expo Simulators keeps job logs and artifacts, see [Retention and deletion](https://docs.expo.dev/eas/simulators/reference/security-and-data.md#retention-and-deletion).

For how the parts connect, see [Expo Simulators security model](https://docs.expo.dev/eas/simulators/how-it-works/security-model.md).

## Permissions

| Action | Required role |
| --- | --- |
| Start a session | Developer role or higher |
| Stop a session | Developer role or higher |
| Delete a finished session | Developer role or higher |
| View sessions and their details | Any role that can view the project, including View Only |

> Read access to a session includes its connection details while the session runs. A member with the View Only role can read the controller tokens of a running session through the REST API or the Expo GraphQL API.

For automation, create a [robot user](https://docs.expo.dev/accounts/programmatic-access.md#robot-users-and-access-tokens) with the [Developer role](https://docs.expo.dev/accounts/account-types.md#manage-access). Developer is the minimum role that can create and stop sessions.

If the user who started a session is deleted, Expo Simulators stops the session.

## Session tokens

The connection details of a session include tokens for the controller. Expo Simulators stores the connection details encrypted.

| Where the tokens appear | What to do |
| --- | --- |
| **.env.eas-simulator** | Add the file to **.gitignore**. Do not upload it as a CI artifact. |
| `remoteConfig` in `--json` output | Do not print it in CI logs. |
| `remoteConfig` in REST API responses | Do not log or cache it. |
| Model Context Protocol (MCP) configuration files for Argent | Add the file to **.gitignore**. |

The REST API returns `remoteConfig` only while the session is `in-progress`. After the session stops or fails, `remoteConfig` is `null`. EAS CLI (`eas simulator:get`) and the Expo GraphQL API still return the stored connection details after the session stops. By then, the remote device and its controller endpoints no longer exist. Session responses include `Cache-Control: private, no-store` and `Pragma: no-cache`.

The session page on expo.dev masks the token values by default. Anyone who can view the session page can reveal or copy them.

## Browser preview links

| Link | Who can open it | How to get it |
| --- | --- | --- |
| Private (default) | A person who signs in to an Expo account that can view the project | EAS CLI output, **Open preview** on the session page, or **Share** in the preview |
| Public | Anyone who has the link, without an Expo login | EAS CLI output or **Share** in the preview, for a session started with `--public-link` or `publicPreview: true`. Also, from the preview token of any session |

A private link has this format:

```text
https://expo.dev/accounts/<account>/projects/<project>/simulator-sessions/<session-id>/preview
```

A public link contains the preview token. Treat a public link as a secret. Anyone with the link can see and use the simulator while the session runs. Share it only with the people who need it, and set a maximum duration on the session.

A session with private links still has a preview token. The REST API returns it as `webPreviewToken` to any member who can read the session. Keep the preview token secret, even when the session uses private links. Anyone who has the token can make a public link.

If a session starts with `--frame-ancestor` or `--cors-origin`, EAS CLI prints the preview host URL with the preview token. For a session that you create with `frameAncestors` or `corsOrigins`, the REST API returns the URL as `previewApiUrl` and the token as `webPreviewToken`. Web pages on the allowed origins use the token to show the session. Anyone who can read such a page can get the token and control the device. See [Show an Expo Simulators session on your own web page](https://docs.expo.dev/eas/simulators/how-to/embed-a-session.md).

## Network access

-   **Metro tunnel:** a Metro URL from `npx expo start --tunnel` is public while the tunnel runs. It does not require authentication. Stop Metro when you finish.
-   **Default egress:** without local egress, all traffic from the simulator exits from Expo infrastructure.
-   **Local egress:** with `--egress local`, device traffic exits from your computer: all TCP traffic on Android, and traffic that honors the system proxy on iOS. The egress client refuses local, private, link-local, and multicast addresses. Only the exact `host:port` entries that you pass with `--egress-allow` are exceptions.

See [Network traffic and local egress in Expo Simulators](https://docs.expo.dev/eas/simulators/how-it-works/network-inspection.md).

## Data that Expo Simulators stores

| Data | Where it appears |
| --- | --- |
| Session details: name, tags, type, status, platform, times | `eas simulator:list`, `eas simulator:get`, expo.dev |
| Screenshots and screenshot diffs | **Artifacts** on the session page |
| Screen recordings | Recording player and **Artifacts** |
| Traces, performance metrics, native profiles, React profiles | **Artifacts** on the session page |
| Session activity events | `eas simulator:events` and the session page |
| Job logs | Logs section on the session page |

One artifact can be up to about 5 GiB.

Expo Simulators records the request origin and agent identifiers that a client sends when it creates a session. Expo Simulators uses these values for analytics only, not for authorization.

## Artifact downloads

`eas simulator:get --json` returns a `downloadUrl` for each artifact. The download URL contains a long random key and does not require authentication. Treat it as a secret.

The `downloadUrl` does not change. Each request to it redirects to a new signed storage URL, which expires after one hour. To download the artifact again later, request the same `downloadUrl` again.

## Retention and deletion

-   Job logs on the session page are available for 30 days after the session is created.
-   Expo Simulators keeps session artifacts, such as screenshots and recordings, until you delete the session.
-   You can delete a session after it finishes. You cannot delete a running session.
-   When you delete a session, Expo Simulators also deletes its recordings and screenshots. You cannot undo this.
-   When you delete the project, Expo Simulators also deletes its sessions and their artifacts.

## Common questions

#### Can a member with the View Only role start a session?

No. Starting a session requires the Developer role or higher.

#### Can someone without an Expo account open my preview?

Only with a public link. A private link requires an Expo login with access to the project. A public link contains the preview token and does not require a login. See [Browser preview links](https://docs.expo.dev/eas/simulators/reference/security-and-data.md#browser-preview-links).

#### How do I remove recordings of a session?

Delete the finished session from its page on expo.dev. Expo Simulators deletes its recordings and screenshots.