Privacy Policy

Effective Date: August 7, 2026

Thank you for using Sonnet. We respect your privacy and are committed to protecting it. This Privacy Policy explains what information Sonnet and the third-party services it relies on collect, and how that information is used. See also our Terms of Service.

1. Your JSON Files Stay on Your Device

Sonnet does not collect, upload, or transmit the content of your JSON files. All files you open or edit are processed locally on your device and are never sent to our servers or to any third party. We do not require you to create an account.

2. Permissions

To function properly, the app may request permission to access your device's storage (to open and save JSON files). This access is used strictly for the purpose of file editing and is not used to mine or transmit the contents of your files.

3. Third-Party Services

Sonnet uses the following third-party services, which may collect information as described below. These services are operated by their respective providers under their own privacy policies.

• Firebase Analytics (Google): collects app usage and event data (e.g. which features are used, screens viewed) to help us understand how the app is used and improve it. This data is associated with a device/app-instance identifier, not your name or email.
  Firebase Privacy and Security
• Firebase Crashlytics (Google): collects crash reports, including device information (model, OS version) and stack traces, to help us diagnose and fix bugs.
  Firebase Privacy and Security
• RevenueCat: if you purchase Sonnet Pro, RevenueCat processes your purchase and entitlement status (e.g. whether Sonnet Pro is active) so the app can unlock the corresponding features. RevenueCat does not receive the content of your JSON files.
  RevenueCat Privacy Policy
• Google Play Billing: if you purchase Sonnet Pro, the purchase itself (including your payment method and billing details) is handled entirely by Google Play. Sonnet and its developer never see or store your payment information.
  Google Privacy Policy

Google (for Firebase Analytics and Crashlytics) and RevenueCat each act as independent data processors under their own standard Data Processing Agreements, which apply automatically to all customers using their services — we do not need a separately negotiated DPA with either.

4. Legal Basis for Processing (EEA/UK Users)

If you are located in the European Economic Area, the UK, or another jurisdiction requiring a stated legal basis, we (and our processors) rely on:

• Legitimate interests — for Firebase Analytics and Crashlytics, to understand app usage and diagnose crashes so we can maintain and improve the App;
• Performance of a contract — for RevenueCat and Google Play Billing, to process your Sonnet Pro purchase and grant the corresponding entitlement.

We do not rely on consent as the legal basis for analytics or crash reporting; where local law requires opt-in consent for non-essential analytics (e.g. under ePrivacy rules), we will provide a consent mechanism before those services activate.

5. International Data Transfers

The third-party services listed above (Google/Firebase, RevenueCat) may process and store data on servers located outside your country, including in the United States. Google and RevenueCat each rely on the EU Standard Contractual Clauses (and, for Google, certification under the EU-U.S. Data Privacy Framework) as the legal mechanism for these transfers. By using the App, you acknowledge this transfer.

6. Data Retention

We retain data collected by our third-party services for only as long as necessary:

• Firebase Analytics: event and user-level data is retained for 14 months from collection, matching Firebase's default retention setting;
• Firebase Crashlytics: crash reports are retained for 90 days;
• RevenueCat / purchase records: your entitlement status is retained for as long as you have the App installed and, after that, for up to 7 years to satisfy standard financial and tax record-keeping obligations.

7. Your Rights

Depending on where you live, you have rights over the data collected about you by the third-party services described above.

If you are in the EEA, UK, or a similar jurisdiction (GDPR), you have the right to:

• Access the data held about you;
• Correct inaccurate data;
• Request erasure of your data ("right to be forgotten");
• Restrict or object to certain processing;
• Receive your data in a portable format;
• Lodge a complaint with your local data protection supervisory authority.

If you are a California resident (CCPA/CPRA), you have the right to:

• Know what personal information is collected, used, and disclosed;
• Request deletion of your personal information;
• Correct inaccurate personal information;
• Non-discrimination for exercising any of these rights.

If you are in Brazil (LGPD — Lei Geral de Proteção de Dados), you have the right to:

• Confirm whether we (or our processors) hold data about you, and access it;
• Correct incomplete, inaccurate, or outdated data;
• Request anonymization, blocking, or deletion of unnecessary or excessive data, or data processed without a valid legal basis;
• Receive your data in a portable format;
• Be informed of the public and private entities with which we share your data (see Third-Party Services above);
• Revoke consent, where consent is the legal basis relied on, and request deletion of data processed on that basis;
• Lodge a complaint with the Autoridade Nacional de Proteção de Dados (ANPD).

We do not sell or share personal information for cross-context behavioral advertising, so there is no "opt-out of sale/share" to exercise.

To exercise any of these rights, contact us at the email below; we aim to respond within 30 days (15 days for LGPD access requests, extendable once with justification). You may also exercise rights over a specific processor's own data directly with that processor (links in the Third-Party Services section above). As a solo developer with only occasional, low-risk processing of the kind described in this policy, we rely on the Article 27 GDPR exemption from appointing a dedicated EU representative.

8. Children's Privacy

Sonnet is a general-audience app, not directed at children, and we do not knowingly collect personal information from children under 13 (or the minimum age of digital consent in your country, where higher). Our Google Play Data Safety declaration reflects this. If we learn that a child has provided us with personal information through Firebase Analytics or Crashlytics, we will take steps to delete it; contact us at the email below if you believe this has occurred.

9. Security

Because your JSON file content never leaves your device, there is no file content for us to secure in transit or at rest. Data collected by the third-party services above is protected by their own security measures; no method of transmission or storage is 100% secure.

10. Changes to This Policy

We may update this Privacy Policy from time to time as the app's features or the third-party services it uses change. Material changes will be reflected here with an updated effective date. You are advised to review this page periodically.

11. Contact Us