Privacy Policy

What Sonar is

Sonar is a content platform for founders, operators and executives. It drafts, schedules, and measures LinkedIn and X content on your behalf, using information you provide and accounts you explicitly connect. Use of the service is governed by the Terms of Service.

The Sonar for LinkedIn browser extension

The extension reads the analytics numbers already visible to you on your own LinkedIn analytics pages (post impressions, engagements, profile views, search appearances, followers, and audience demographics) while you browse them in your own logged-in session, and sends those numbers to your own Sonar workspace. It reads nothing else, visits nothing on your behalf, and performs no actions on your account.

• Data collected: your own analytics numbers, and the pairing token you paste during setup.
• Where it goes: only to the Sonar workspace the token belongs to. Never to anyone else.
• Local storage: the pairing token and last-sync time, stored by your browser.
• No sale, no third-party transfer, no advertising use, no credit or lending use.
• Removal: uninstall the extension and, if you wish, regenerate the token in Sonar to revoke the old one.

What we collect

• Account: your name and email, and how you signed in (email and password, or LinkedIn or X). Passwords are handled by our authentication provider and never stored by us in readable form.
• What you create: the posts, drafts, notes, documents, recordings, and answers you enter, and the intelligence Sonar builds from them.
• Connected accounts: when you explicitly connect LinkedIn, X, Google (Calendar and Meet), Slack, Microsoft 365 (Outlook and Teams), Zoom, Notion, Fireflies, Granola, or Wispr Flow, we store the access tokens needed to provide the feature you enabled, and the data you asked Sonar to read from them. Some sources also accept an API key you paste instead; either way the credential stays server-side, is used only to read your meeting content, and is deleted when you disconnect. Two of these have a boundary you choose at connect time: with Slack you pick up to five specific conversations and Sonar reads only those, including direct messages if you pick them; with Notion you pick the pages you grant, and Sonar sees nothing else in your workspace.
• Public content: to build your competitive watchlist and weekly brief, Sonar reads publicly available posts and articles. It does not scrape private LinkedIn data or use your login to do so.
• Payment: if you subscribe, our payment processor collects your card details directly. Sonar never sees or stores your full card number.
• Usage: product analytics and, as described below, masked session replay.

How we use it

We use your information only to provide and improve Sonar: to learn your writing voice, draft and schedule content, surface what is happening in your niche, and measure how your content performs. We also email you about your account and your use of Sonar: when your drafts are ready, when your access is about to end, and the occasional nudge if you have not finished setting up. A short monthly note on what is new in Sonar goes only to people who switch it on in Settings. Every one of these emails can be turned off from the unsubscribe link in it, except the ones about your account and billing. We do not sell personal data. The only advertising use is the ad measurement described under Cookies, which runs only if you allow it.

AI processing

Sonar generates content using a third-party AI provider (Anthropic's Claude). To draft in your voice, the relevant parts of your content and settings are sent to that provider to produce a response. Under our provider's API terms, your inputs and outputs are not used to train their models. Content is processed to serve your request, not to build a public model. Data received from Google Workspace APIs is never used, transferred, or sold to create, train, or improve any foundational or generalized AI or machine learning model, in line with the Limited Use requirements described under Google user data below.

Google user data

If you connect Google, Sonar requests only read-only access, and only to what the feature you switched on requires:

• Google Calendar (calendar.events.readonly): Sonar reads the titles, times, and attendee names of your own calendar events from the last seven days, once a week, to suggest post-worthy moments from your real working week. This is the narrowest Calendar scope that permits reading events; Sonar does not request access to manage calendars or to list the calendars on your account.
• Google Meet (meetings.space.readonly): if you separately switch on Meet transcripts, Sonar reads transcripts of your own recent Meet conferences for the same purpose, and to learn how you phrase things from sentences you yourself spoke.

We do not keep the raw content.Calendar text and meeting transcripts, from every connected source, are processed in memory to extract short, story-shaped summaries, and the raw text is discarded. What we store is those derived summaries, plus a short receipt of what was read: the titles of the meetings, notes, or pages processed in the last sync, so you can check our work. Nothing else from the source body is kept. You can see that receipt on each source's row in Settings under Connected sources, and delete the moments Sonar surfaces to you from the card itself on Home. Disconnecting a source deletes both its stored access token and its receipt, and deleting your account removes every stored moment along with the rest of your workspace, immediately. Turning a source off inside Sonar keeps the moments already mined, which you can delete at any time in Settings under Intelligence, Moments. Removing Sonar from Zoom's own side (Zoom App Marketplace, Manage, Added Apps, Remove) goes further: Zoom notifies us and we delete the Zoom tokens, the receipt, and every moment derived from your Zoom transcripts.

Who we share it with. We do not sell Google user data, and we do not transfer it to advertisers, data brokers, or any third party for their own purposes. It is disclosed only to the infrastructure providers that operate Sonar on our instructions: Supabase (database and storage, where derived summaries are held), Vercel (application hosting), and Anthropic (AI processing, where relevant text is sent transiently to generate your drafts and is not retained for model training under their API terms). We may also disclose data if legally required, or to you.

Limited Use. Sonar's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. In particular, we do not use, transfer, or sell Google user data, whether raw, aggregated, or derived, to create, train, or improve any foundational or generalized artificial intelligence or machine learning model. Google user data is used only to provide the features you switched on inside Sonar.

Revoking access. You can disconnect Google at any time in Settings under Connected sources. Disconnecting revokes our access token with Google immediately, and you can also remove access from your Google account permissions page.

How we protect your data

Sensitive data, including anything read from a connected account, is protected by these measures:

• Encrypted in transit and at rest: all traffic runs over HTTPS/TLS, and our database and file storage are encrypted at rest by our infrastructure provider.
• Isolated per workspace: every table enforces database-level row security, so data is readable only by members of the workspace that owns it. This is enforced by the database itself, not only by application code.
• Connection tokens are server-only: the tokens for connected accounts are stored in a table that browser-side credentials are explicitly denied access to, and are never sent to the browser. Disconnecting always deletes our copy, and for the providers that offer a revocation endpoint (Google, Slack, Zoom, X, Notion, Granola, Fireflies) we also revoke the grant at the provider. Microsoft, LinkedIn, Fathom and Wispr Flow offer no such endpoint on the tiers we use, so for those you can additionally remove Sonar from your own account settings at the provider.
• Minimised by design: every source we read is granted read-only access, and we request the narrowest scope that runs the feature you switched on. The one exception is publishing: if you connect LinkedIn or X to let Sonar post for you, that connection carries permission to publish as you, and only that. Raw calendar and transcript content is processed transiently, and only the short derived summaries the product needs are stored.
• Restricted access: administrative access to production systems is limited to the people who operate Sonar, protected by two-factor authentication, and used only to run and support the service.

Service providers

We rely on a small set of vetted providers to run Sonar, each handling only what their function requires: database and authentication, hosting, AI generation, payment processing, email delivery, product analytics, and public-content research. They act on our instructions and are not permitted to use your data for their own purposes.

Product analytics and session replay

To understand how Sonar is used and to improve it, we use privacy-first product analytics, including session replay. Replays are recorded with all text and form inputs masked, so we can see how the interface is navigated but never the content you write, draft, or connect. We do not sell this data or use it for advertising, and analytics can be limited through your browser's standard controls.

Cookies

Three kinds, and nothing else. Strictly necessary: the cookie that keeps you signed in, the one that remembers your theme, and the one that records your answer to the cookie banner so we do not ask again. These are set without asking, because the service cannot work without them. Analytics: one cookie from our analytics provider, which counts page views and shows where people give up. In the EU, the UK and Switzerland it is set only after you accept it on the banner, and refusing means it is never set at all. Elsewhere it is on by default. Either way, Cookie settings in the footer turns it off and withdraws an acceptance at any time. Advertising measurement: the Meta Pixel, the LinkedIn Insight Tag and the Google Ads tag, which tell Meta, LinkedIn and Google when someone who saw one of our ads visits the site, starts to sign up, or finishes setting up an account, so we can see which ads work and show them to people likely to find Sonar useful. These set Meta's, LinkedIn's and Google's own cookies. In the EU, the UK and Switzerland this is its own choice on the banner, off until you tick it, and accepting analytics alone does not turn it on. Elsewhere it is on by default. When it is on and you finish setting up your account, or later subscribe, our server also tells Meta that this happened, with your email address scrambled (hashed) so Meta can match it to an ad without receiving the address itself. Cookie settings turns this off too, along with analytics.

Cookie settings

Who is responsible for your data

The controller is V Group (FZE), trading as Distilled, a company registered in the United Arab Emirates. For anything in this policy, including a request about your own data, write to hello@meetsonar.co. We have no establishment in the EU or the UK.

Why we are allowed to use it

Where the GDPR or the UK GDPR applies, each thing we do rests on one of these grounds.

• To run the service you signed up for. Your account, your workspace, the drafts, and reading the sources you connected. Performance of our contract with you.
• Analytics cookies and advertising measurement. Consent, each asked for separately before anything is set and withdrawable from the footer at any time.
• Keeping the service safe and working. Security, fraud prevention, and fixing faults. Our legitimate interests, weighed against your rights.
• Publicly posted material about other people. Our legitimate interests in competitive research, described in the next section, where those interests are not overridden by the rights of the person concerned.
• Records we are required to keep. Tax and accounting obligations. A legal obligation.

People who never signed up

This is the part most policies leave out, so it is stated plainly. When you add someone to your watchlist, or when Sonar looks at what is performing in your niche, it reads posts those people published publicly on LinkedIn or X and stores the post text, the author's name, their public profile picture and the public engagement counts. That is personal data about someone who is not our user, and we hold it so your workspace can show you what your market is publishing.

We never scrape anything behind a login, we never collect private profile details or contact details, and we never build a profile of a private individual beyond what they chose to publish. If you are one of those people and you want your posts removed from our systems, write to hello@meetsonar.co and we will remove them and stop collecting them. You can ask this without giving a reason.

Separately, and for a different reason: the people in your own meetings, messages and calendar are deliberately never named in a draft. Sonar writes the role instead of the person, and that rule is enforced in the software rather than left to the writer.

Where your data goes

Sonar runs on providers outside the country you are probably reading this in. Our database sits in Singapore; hosting, AI processing, payments and analytics run in the United States and the European Union. If you are in the EU, the UK or Switzerland, that means your data is transferred outside your region. Where that transfer needs a safeguard, we rely on the European Commission's Standard Contractual Clauses, or the UK Addendum to them, in our agreements with those providers. The current list of providers is on the sub-processors page, and it is kept current rather than written once.

Your rights over your data

Wherever you are, you can ask us to show you what we hold, correct it, export it, or delete it, and most of that you can do yourself inside Sonar without asking anyone. If the GDPR or the UK GDPR applies to you, you also have the right to object to processing we base on legitimate interests, to ask us to restrict it, and to withdraw a consent you gave, which is as simple as the banner that asked for it. Withdrawing consent does not undo what was done while it was in force.

We answer verified requests within one month. If you think we have handled your data badly, please tell us first so we can fix it, and know that you can also complain to your national data protection authority, or to the Information Commissioner's Office in the UK, without going through us.

Retention and deletion

We keep your data for as long as your workspace is active. You can disconnect any connected account in Settings at any time, which deletes its stored tokens. You may request deletion of your workspace and its data at any time; on a verified request we remove it, except where we are required to retain limited records (for example, for tax or fraud-prevention purposes).

Your choices

You can access, correct, export, or delete your workspace data, and disconnect any integration, from within Sonar or by contacting support. Depending on where you live, you may have additional rights over your personal data; we honor those rights for verified requests.

Children

Sonar is a professional tool intended for adults and is not directed to anyone under 18. We do not knowingly collect data from children.

Changes to this policy

We may update this policy as Sonar evolves. When we make a material change, we will update the effective date above and, where appropriate, notify you in the product.

Contact

Questions or deletion requests: hello@meetsonar.co. We respond within a reasonable period and honor verified deletion requests for your workspace data. Hours and response times are on the support page.