Privacy policy

What we collect

• Account details: your email address, and your name and profile picture if you sign in with Google. We don't use passwords.
• Portfolio information you add: positions you enter by hand or import from a CSV file (assets, quantities, cost basis, transactions), and the account names you give them.
• Wallet addresses you connect: public blockchain addresses (and names such as ENS names). We read their balances and transaction history from public blockchain data. An address can only be read; Sonar never asks for private keys or seed phrases and can't move funds.
• Brokerage and exchange connections: if you connect a brokerage or crypto exchange, we use Plaid to do it. You sign in on Plaid's screens and we never see your username or password there. Plaid sends us your investment accounts' names and types, holdings, cost basis and investment transactions, and an access token we store encrypted.
• Billing: if you subscribe, Stripe processes your payment. We receive your plan, its status and renewal date, and a Stripe customer ID. We never see or store your full card number.
• Usage and device data: pages visited, approximate location (country or city level), browser and device type, and referring site, collected through Google Analytics and our hosting provider's logs.
• Messages you send us, for example to support.

How we use it

• To run Sonar: show your portfolio, prices, performance and the market and social data for the assets you hold.
• To sign you in and keep your account secure, including sending one-time sign-in codes by email.
• To process subscriptions and send receipts and service messages (for example about billing or changes to these policies).
• To understand how the product is used, fix problems and improve it.
• To prevent abuse and comply with legal obligations.

We don't use your portfolio to give investment advice, and we don't sell or rent your personal information or share it with advertisers.

Emails we send

• Account and security emails: sign-in codes, two-step verification changes, and notices when an API key is created or an app is connected to your account. These can't be turned off while you have an account.
• Alerts you set up, by email when they fire. They follow your settings on the Alerts page.
• A short onboarding series after you sign up, with tips for getting set up. Turn it off with the link in any of those emails or in Settings → Emails.

We only send emails about Sonar. We never send marketing for other companies.

Who we share it with

We use service providers that process data on our behalf, under contracts that limit their use of it:

• Supabase: database and sign-in.
• Vercel: hosting.
• Stripe: payments.
• Resend: sign-in and service emails.
• Google: Google Analytics (usage measurement) and, if you choose it, Google sign-in.
• Plaid: connects the brokerage and exchange accounts you choose and sends us their investment data. By connecting, you agree that Plaid may collect and use your information under the Plaid End User Privacy Policy.
• Anthropic: writes the short summaries in alerts from market, social and news data about an asset, and drafts catalog entries for assets we don't recognize yet from public facts about them (name, ticker, contract address, website). We don't send your name, email, portfolio or account details.
• Market and blockchain data providers (LunarCrush, Blockscout, Alchemy, Ankr, Helius, mempool.space, Blockchair, Hiro, AvaCloud, Aptos Labs, Sui, StarkNet public nodes (PublicNode, Cartridge), Cosmos public nodes (PublicNode, Polkachu, cosmos.directory), Polkadot and Bittensor public nodes (Parity, OnFinality, OpenTensor), litecoinspace.org, Haskoin, Dash Insight, Dogechain, CipherScan, WhatsOnChain, BlockCypher, UniSat, Kaspa REST API, XRP Ledger public servers, TronGrid, Stellar Horizon, Koios, Hedera mirror node, FastNEAR, NearBlocks, VeChain nodes, DFINITY ledger APIs, CoinGecko, DEX Screener, SEC EDGAR, TON Center, Nodely (Algorand), MultiversX API, Glif (Filecoin), EVM public nodes (PublicNode, Mantle, Sonic, Cronos, BNB Chain), StellarExpert, Google BigQuery (network-wide counts only), Frankfurter (European Central Bank exchange rates; currency codes only)): we send them asset identifiers and the public wallet addresses you connect, to fetch prices, social data and onchain balances. We don't send them your email or name.

We don't sell your personal information, and we don't share it with partners for their own marketing or advertising.

We may also disclose information if required by law, to protect our rights or users' safety, or as part of a merger or acquisition, in which case this policy continues to apply to your information.

AI assistants and the API

You can connect Sonar to an AI assistant such as Claude or ChatGPT (the connector, with sign-in or an API key), or use the API and the command-line tool. This is how that works:

• What the assistant receives: only what a tool returns when it's called: prices and market and social data for assets you hold and, if your plan includes it, your holdings, values and P&L. The assistant's provider handles that under its own privacy policy.
• What we receive from the assistant: the tool requests themselves, such as an asset search or a position you ask it to add. We don't receive your conversation, chat history or anything else in the assistant.
• What we keep: positions added through the assistant, like any you add yourself; daily request counts; and for each connected app, its name and website and when you connected and last used it. Sign-in tokens and API keys are stored only as hashes. Access tokens expire after an hour and refresh tokens after 30 days; expired or disconnected ones are deleted within 30 days. We don't log the content of tool requests or results.
• Your controls: see and disconnect apps, and revoke API keys, on the API and AI tools page; access stops right away. Deleting your account removes all of it.

Cookies and similar technologies

• Essential cookies keep you signed in. The product doesn't work without them.
• Preferences: your light or dark theme choice is stored in your browser.
• Analytics cookies from Google Analytics measure visits. You can block them in your browser settings or with Google's opt-out browser add-on without affecting the product.

How long we keep it

We keep your account and portfolio information while your account is open. When you delete your account (Settings → Delete my account), we delete your profile, portfolio, connected wallets and history from our database right away, and from backups within 30 days. We keep only what we must for legal, tax or accounting reasons (for example, payment records held by Stripe). Server logs are kept for a limited period for security and debugging.

Your choices and rights

• You can view and edit your portfolio, and remove connected wallets, exchanges and brokerages, at any time in the app. Removing a brokerage or exchange also ends Plaid's access to it.
• You can cancel a subscription at any time from Settings.
• You can delete your account at any time in Settings → Delete my account.
• You can ask us for a copy of your data, or to correct it, by emailing support@sonarfolio.com.

Depending on where you live (for example in the EU, UK or California), you may have additional rights, such as to object to or restrict certain processing, to data portability, or to complain to a data protection authority. We will respond to requests within the time the law requires. We don't sell or “share” personal information as those terms are defined under California law.

Security

Data is encrypted in transit, access to each user's data is restricted at the database level, and Sonar is read-only: it never requests trading or withdrawal permissions. No system is perfectly secure, but we work to protect your information and will notify you of a breach where the law requires.

International transfers

We and our providers process data in the United States and other countries. Where the law requires, we rely on appropriate safeguards, such as standard contractual clauses, for these transfers.

Children

Sonar is not intended for anyone under 18, and we don't knowingly collect information from children. If you believe a child has given us information, contact us and we will delete it.

Changes to this policy

We may update this policy. We will change the date above and, for material changes, tell you by email or in the app before they take effect.

Contact

Questions or requests: support@sonarfolio.com. See also our Terms of Service.

By mail: