Privacy policy

Reading the site needs no account. A visitor who only reads gets no cookies, and the pages carry no ads, pixels or Google Analytics.

We count page views with Umami, an analytics tool on a server run by Sonar's operator. It sets no cookies and keeps only aggregate numbers: which pages were opened, from which country and referring site, on which kind of device.

Pages are built on our server; when it fetches data from our own API, your IP address is not passed along. Fonts and story pictures are served from our own server, so your browser does not contact Google or the publishers to show them. Links to articles take you to the publishers' sites, where their rules apply.

We set cookies only when you do something that needs one, never to track or advertise: when you sign in (a session cookie for up to 30 days, plus a marker the page can read to show the account link), when you open an invite link (the invite code, 30 days), when you open a link with a promo code (the code, 7 days), and when you choose a plan before signing in (that choice, 1 hour). The team's admin console has its own session cookie of up to 12 hours.

These cookies are needed for what you asked for, so we do not ask for consent and show no banner. Signing out removes the session cookies.

For an account we store your email, your plan, your interface language, when the account was created, verified and last signed in, and, if you set one, a hash of your password (argon2id) — never the password itself. We also store your invite code and who invited you, if anyone.

Sign-in, verification and password-reset links are single-use; we store only a hash of each link, and a reset link works for 30 minutes. To stop abuse we keep a keyed hash of the network address an account was created and signed in from, and count failed sign-ins per account and per address for 15 minutes; the address itself cannot be recovered from the hash.

We use this to run your account: sign-in, your plan and its limits, receipts and reminders. The legal basis is the contract with you, and our legitimate interest in keeping the service secure.

Paid plans are paid in cryptocurrency through OxaPay, or by invoice by arrangement. To create a crypto invoice we send OxaPay your email, the amount and an order number. We store the plan, the price, the invoice and order numbers, the coin and amount paid, and the payment notification OxaPay sends back, which can include the paying wallet and the transaction. We never see or store card details.

Payment records are kept as long as tax and accounting rules require, even after an account is deleted.

If you set up alerts, we store your alert rules and a history of what was sent. To send alerts to Telegram we store your Telegram chat number and username after you connect the bot; disconnecting deletes them. Email alerts go to your account address and every one carries a link to switch them off.

A question you ask is sent to OpenAI together with Sonar's own data to write the answer. We do not store the question. We only count how many questions an account, a key or an address has asked today, to apply the daily allowance; for an address we count by its keyed hash.

We do not store API keys themselves, only a hash and the first few characters, so a lost key cannot be recovered, only replaced. With a key we keep its label, owner email, plan, dates and when it was last used.

We count requests per key, endpoint and day to show usage and apply limits; requests without a key go into one shared count with no addresses. To limit requests without a key we count calls per keyed hash of the address for the current minute and day, and delete these records after two days. The API keeps no log of individual requests with IP addresses; errors go into a size-capped technical log.

If you write to us or use a request form, we store what you send — your email, your name if given, and your message — to reply to you. We do not add you to mailing lists.

Only emails about your account and what you asked for: sign-in and verification links, password resets and change notices, payment receipts, a reminder 3 days before a paid period ends, a notice when it ends, referral rewards and the alerts you set up. No newsletters or marketing. Emails go out through our email provider's mail server.

Nobody buys your data and nobody gets it for advertising. The data sits in a database on a server we run; news texts are rated for tone, topic and country by our own model on a computer we run, and no personal data goes there. These services receive the part they need to do their job: OpenAI (news texts for topic summaries, or to rate tone when our model is unavailable, and the questions you ask Ask Sonar), OxaPay (your email and the amount, for a crypto invoice), Telegram (the alerts you send there), our email provider (the emails above) and our Umami server (aggregate page views).

OpenAI and some of these providers process data outside your country, including in the United States.

Account, key, alert and referral records are kept while the account exists and are deleted when you ask us to close it, except payment records, which we keep for as long as accounting rules require. Rate-limit counters are deleted after two days, and failed sign-in counts once you sign in successfully. Story pictures are cached for 30 days.

The team runs the service from an admin console behind a password. Its session cookie is set only for someone who signs in to it, is signed, unreadable by page scripts and lasts up to 12 hours.

You can ask us what we store about your email, account or key, to correct it, to export it, or to delete it and close the account; write from the address on the account. We reply within 30 days. If you are in the EU or the UK you can also complain to your data protection authority.

If the service starts collecting anything new, we will update this page before it goes live and change the date at the top. We will email account holders about material changes.

Sonar is operated by the team that builds it.

Send questions, data deletion requests and publisher notices to hello@sonarmood.com.