Privacy Policy

1. Controller (Art. 13 GDPR)

The controller responsible for the processing of your personal data is:

2. Data Protection Officer

We are not legally required to appoint a Data Protection Officer. For any data-protection enquiries please contact us directly at privacy@sonaa.co.

3. Data We Collect

3.1 Account data

When you create a Sonaa account we collect your name (optional), email address, and a hash of a sign-in key that your browser derives from your password (your password itself never reaches us). This account can be used to access Sonaa Week and other Sonaa products.

3.2 User-generated content

Tasks, events, notes, and any other content you create inside Sonaa Week are stored on our servers. Depending on the encryption mode you choose (see Section 7), this content is either encrypted by our server before it is stored or end-to-end encrypted before it leaves your device.

3.3 Session and technical data

We store session tokens in HttpOnly, Secure cookies. Each session record contains your IP address and browser user-agent. This data is used solely to maintain and protect your authenticated session and is deleted when the session expires (after 90 days of inactivity).

3.4 Server logs

Our hosting infrastructure automatically records standard access logs (IP address, timestamp, HTTP method, requested URL, status code). These logs are retained for 30 days for security and troubleshooting purposes and then deleted.

3.5 Rate limiting

To protect the service against abuse, we transiently process your IP address for rate limiting on authentication endpoints. This data is held in memory only and is not persisted to our database.

3.6 Calendar import

You can import calendar files (.ics files, or a Google Calendar export as a .zip). The file is read and converted in your browser; the file itself is never uploaded. Only the events you choose to import become tasks, and they are then stored like any other content you create (see 3.2), including the event title, date, time and description. Calendar events can contain information about other people, such as names or email addresses in an invitation's description. Please only import calendars you are entitled to use.

3.7 Waitlist

While registration is limited, you can join a waitlist by entering your email address. We store only that address and, once you are let in, the time we invited you. When we invite you, we send you one email with a link to register. Joining the list sends no email. The entry is kept until you are invited and register, and is deleted on request at any time: write to privacy@sonaa.co.

3.9 Help and feedback messages

If you send us a question or feedback through the form in the app, we receive your email address and the text you wrote as an email in our inbox, delivered by our email provider (see Section 6). We use it only to answer you and to improve Sonaa, and delete it once it is no longer needed for that.

4. Legal Basis for Processing (Art. 6 GDPR)

• Art. 6(1)(b) GDPR – Performance of a contract: processing your account data and user-generated content is necessary to provide the Sonaa Week service you signed up for.
• Art. 6(1)(b) GDPR – Steps prior to entering into a contract, at your request: keeping your email address on the waitlist and inviting you.
• Art. 6(1)(f) GDPR – Legitimate interests: answering the questions and feedback you send us.
• Art. 6(1)(f) GDPR – Legitimate interests: session and server-log data are processed to protect the security and integrity of the service.
• Art. 6(1)(c) GDPR – Legal obligation: we may retain data to comply with applicable legal obligations (e.g. tax or commercial law retention requirements).

5. Data Retention

• Account data: retained for the lifetime of your account.
• User-generated content: retained until you delete it or your account.
• Session data: deleted automatically after 90 days.
• Server logs: deleted after 30 days.
• Waitlist entries: kept until you are invited and register, or until you ask us to remove you.
• After account deletion all personal data is permanently erased within 30 days, except where retention is required by law.

6. Data Transfers and Third Parties

We do not sell, trade, or rent your personal data to third parties. We may share data with the following categories of processors, all bound by data-processing agreements (Art. 28 GDPR):

• Hetzner Online GmbH (hosting / infrastructure provider): our servers and database are hosted on Hetzner Online GmbH infrastructure located in Germany (EU). Hetzner Online GmbH is bound by a Data Processing Agreement under Art. 28 GDPR.
• Cloudflare (network and security provider): requests to our web app and API pass through Cloudflare's network, which shields our servers from attacks and overload. Cloudflare ends the encrypted connection before passing a request on to us, so it technically processes everything in that request while it is in transit: your IP address, your session cookie, your sign-in key and the content you sync (for end-to-end encrypted accounts, task titles, notes and subtasks only as ciphertext). It does not store this content. Cloudflare is operated by Cloudflare, Inc., San Francisco, USA, and is bound by a Data Processing Agreement under Art. 28 GDPR. Requests are handled in the data center nearest to you, and data may also be processed in the United States. The company is certified under the EU-U.S. Data Privacy Framework (adequacy decision, Art. 45 GDPR); the agreement also includes the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR).
• Resend (transactional email provider): we use Resend to deliver account-related emails (verification codes, password resets, account deletion confirmations). Resend receives your email address, the content of these emails and the technical metadata needed to deliver them, solely for this purpose, and is bound by a Data Processing Agreement under Art. 28 GDPR. Resend is operated by Plus Five Five, Inc. in San Francisco, USA, so this data is transferred to and processed in the United States. The company is certified under the EU-U.S. Data Privacy Framework, for which the European Commission has adopted an adequacy decision (Art. 45 GDPR). In addition, the agreement includes the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR), which apply should that adequacy decision cease to cover the transfer. We do not use open or link tracking in these emails.

Apart from the transfers described above, your data is not transferred to countries outside the European Economic Area (EEA). Any future transfer will only take place where an adequate level of data protection is ensured (e.g. Standard Contractual Clauses pursuant to Art. 46(2)(c) GDPR).

7. Encryption of Your Data

Sonaa Week offers two encryption modes for your content:

• Standard mode: Your task content is stored in our database on Hetzner Online GmbH infrastructure in Germany (EU). It is transmitted over TLS and encrypted by our server (AES-256-GCM, with a separate key per account) before it is stored. Because our server holds these keys, we can technically access your content as the service operator. If you require stronger privacy guarantees, we recommend enabling end-to-end encryption.
• End-to-end encryption (E2E): Your data is encrypted on your device before it is sent to our servers using AES-256-GCM. Your encryption key can only be unlocked with your password (via Argon2id); our servers hold it only in that locked form. This covers the titles, notes and subtasks of your tasks; dates, times and other scheduling data, shelf and calendar names, and your account data are not end-to-end encrypted. Your password itself is never transmitted to us; your browser derives a separate sign-in key from it. End-to-end encryption therefore prevents access to your stored content, but cannot rule out access by someone who compromises our servers and alters the app delivered to your browser. See our Security page for full technical details.

8. Billing and Subscription Data

Sonaa is currently free of charge and no payment data is processed. If you have been given a complimentary plan, we store only the plan, its status and its end date with your account; this is deleted together with your account. The legal basis is Art. 6(1)(b) GDPR (performance of a contract).

9. Cookies and Browser Storage

We use only storage that is strictly necessary to provide the Service:

• Session cookie: an HttpOnly, Secure, SameSite cookie that keeps you signed in.
• Local database (IndexedDB): Sonaa Week keeps a copy of your tasks in your browser so it works without waiting for the network, together with changes that have not reached our servers yet. For end-to-end encrypted accounts it also holds your encryption key, stored so that it cannot be read out of the browser.
• Local storage: small preferences such as your color scheme, and your account's encryption mode.
• Sidebar width cookie: if you resize the sidebar in Settings or in the docs, a cookie remembers its width so the page does not jump when it loads. It holds a number and nothing about you.
• Offline copy (Cache Storage): once you are signed in, your browser keeps a copy of the app's pages and files so your week opens without a connection. It holds the app itself, not your tasks.

Signing out deletes all of this from your browser, except the sidebar width cookie. No tracking or analytics cookies are set. Because we use only strictly necessary storage, no cookie banner or consent is required under Art. 5(3) of the ePrivacy Directive.

10. Your Rights (Art. 15–22 GDPR)

You have the following rights regarding your personal data:

• Right of access (Art. 15): request a copy of the data we hold about you.
• Right to rectification (Art. 16): correct inaccurate data.
• Right to erasure (Art. 17): request deletion of your data ("right to be forgotten"). You can also delete your account directly in the app settings.
• Right to restriction (Art. 18): request that we limit processing of your data.
• Right to data portability (Art. 20): receive your data in a machine-readable format. You can export your tasks yourself under Settings › Export (JSON, XML or iCal). For your account data, write to us and we send you an export by email.
• Right to object (Art. 21): object to processing based on legitimate interests.
• Right to withdraw consent: where processing is based on consent, you may withdraw it at any time.

To exercise any of these rights, contact us at privacy@sonaa.co. We will respond within 30 days.

11. Right to Lodge a Complaint (Art. 77 GDPR)

You have the right to lodge a complaint with a supervisory authority, in particular in the EU member state of your habitual residence, place of work, or the place of the alleged infringement. The supervisory authority responsible for our registered office is:

12. Automated Decision-Making

We do not use automated decision-making or profiling within the meaning of Art. 22 GDPR.

13. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated to you via email or a prominent notice in the app. The date at the top of this page reflects the latest revision.