SONOR

Privacy Policy

Effective 5 November 2026

Sonor is a listening app: stations, an optional tone, and ambient sound. This policy explains what personal information Sonor collects, why, who it is shared with, how long it is kept, and the choices you have.

Sonor is run by Musa Katuli, an individual based in California, United States ("we", "us"). Questions and requests go to [email protected].

The short version

  • You can listen for a few minutes with no account. That listen is tied to this browser, not to your name.
  • If you create an account, we store the details needed to sign you in again.
  • Google sign-in sends us your name, your email address, and your avatar. We do not get your Google password, Gmail, or Calendar.
  • We use this information to run Sonor. We do not sell it, rent it, or use it for advertising.
  • You can ask for a copy, a correction, or deletion at any time.

What we collect

Information you give us

  • Google sign-in. Google sends Sonor your name, your email address, and your avatar (your profile picture), plus the Google account id that lets us recognise you next time. Sonor does not receive your Google password.
  • Email and password. If you create an account this way, we store your email and a one-way hash of the password. The password does not work until you open the confirmation link we email you. We never store the password itself.
  • Email link. If you ask for a link to sign in, we store your email and a short-lived token for that link. Opening the link signs you in, and creates an account if the address is new.
  • What you save. Mixes you save, soundscapes you create, feedback you send us, and settings such as whether personalised stations are on for your account.
  • Spotify, if you connect it. We store that the connection exists, your Spotify user id and display name, and the tokens Spotify gives us so the connection can stay signed in. You can disconnect it in settings.
  • Payment, if you subscribe. Card payment is handled by Stripe. We store a customer identifier and the status of the subscription. We do not store your full card number.

Information collected automatically

  • Sign-in and security. Your IP address and browser details travel with the request. We use them to keep the session, to rate-limit sign-in attempts, and to protect accounts.
  • Listening. If you are signed in, we may store which station or track you played, skipped, or liked, so a saved mix and a personalised station can work.
  • Guest listening. The few free minutes are counted in this browser (local storage), not against an email address.
  • Site statistics. Cookieless statistics scripts that we run on our own servers record page views: one loaded from s.risenshiners.com and one loaded from plausible.katuli.me. Neither is an advertising tracker, and neither sets a cookie. When you are signed in, the s.risenshiners.com script is told your account id so we can see which parts of Sonor are used; the plausible.katuli.me script is not. The plausible.katuli.me script also counts whether a visitor without an account started listening and whether they reached the free listening limit, along with the station name and nothing else.
  • Server logs. Our servers record requests, including IP address and browser, for a limited time, for security and troubleshooting.

Information from others

Google provides the name, email, and avatar when you choose Google sign-in. Spotify provides the connection details above only if you connect Spotify. Stripe provides subscription status only if you pay.

How we use it

  • To run the listen, your account, and the sign-in method you chose.
  • To send the messages you would expect: a confirmation link, a sign-in link, and replies to mail you send us.
  • To remember a mix, a station choice, or listening you asked Sonor to learn from.
  • To keep Sonor safe: preventing abuse, investigating problems, and enforcing the terms.
  • To understand how Sonor is used and to improve it.
  • To comply with the law.

Where the law requires a legal basis, we rely on providing the service you asked for, our legitimate interest in running a safe and working product, your consent (which you can withdraw), and legal obligations.

The generator

If you use the soundscape generator, the description you type and the station type you pick are sent to an AI service, through our own gateway, so it can propose a mix. We store that request with your account. We do not sell it, and we do not use it for advertising.

Who we share it with

We share personal information only as needed to run Sonor, with:

  • Google, when you choose Google sign-in. Google's own privacy policy applies to that sign-in.
  • YouTube, when a station track plays. Your browser talks to YouTube directly. We do not send YouTube your Sonor password.
  • Spotify or Apple Music, only if you connect or play them. Those services have their own policies.
  • Stripe, if you pay.
  • Cloudflare, which carries traffic to sonor.fm and sees the request, including IP address, to deliver and protect the site.
  • Google Fonts, which serves some typefaces. That request includes your IP address.
  • Our statistics hosts (s.risenshiners.com and plausible.katuli.me), as described above.
  • The email service that sends confirmation and sign-in messages to the address you gave us.
  • Authorities, when the law requires it, or to protect people or Sonor.
  • A successor, if Sonor is ever transferred to another operator, who must keep this policy's promises.

We do not sell or rent personal information, and we do not share it for cross-context behavioural advertising.

Google data

Sonor uses Google only so you can sign in. Here is exactly how that works.

  • What we access: your name, your email address, and your avatar, and the account id Google uses to identify that sign-in. We do not request Gmail, Calendar, Drive, or any other Google product.
  • Why: to create your account or sign you in, and to show your name.
  • Limits: Google data is not sold, not used for advertising, and not used to train AI models.

Sonor's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

You can remove Sonor's access from your Google account's third-party access page. To have the name, email, and avatar we stored deleted, email [email protected].

Cookies and browser storage

Sonor uses only cookies it needs to work:

  • a session cookie that keeps you signed in;
  • a security cookie that protects forms;
  • a remember-me cookie if you stay signed in, including after Google sign-in.

Your browser also stores a few things on the device: how much guest listening time is left, the station you last chose today, and mix settings such as volumes. We use no advertising or cross-site tracking cookies.

How long we keep it

  • Account information, saved mixes, and soundscapes you create: while the account is open.
  • Sign-in links and confirmation links: until they expire or are used, and then only as long as needed to know they were used.
  • If you ask us to delete the account: we remove it from sign-in. Some records can remain for a limited time where we must keep them, including a backup or a record the law requires.
  • Server logs: a limited time for security and troubleshooting.

Your choices and rights

You can:

  • listen as a guest and never create an account;
  • turn the tone off, and disconnect Spotify in settings if you connected it;
  • stop using Sonor at any time;
  • ask us for a copy of your personal information, to correct it, or to erase it, by emailing [email protected].

If you live in California, you have the right to know what personal information we collect, use, and disclose, to delete it, to correct it, and not to be treated differently for using these rights. We do not sell or share personal information as those terms are defined in California law. If you live in the European Economic Area or the United Kingdom, you also have rights to object, to restrict processing, to data portability, and to complain to your local data protection authority.

We answer requests within 30 days, and may need to confirm it is really you first.

Security

We protect information with encrypted connections (HTTPS), hashed passwords, and limited access. No system is perfectly secure. Please use a strong, unique password if you create one.

Children

Sonor is not directed at children under 13, and we do not knowingly collect personal information from anyone under 13. If you believe a child has given us an account, email [email protected] and we will delete it.

Changes

If we change this policy, we will update the date at the top. If a change is significant, we will say so on this page before it takes effect.

Contact

Musa Katuli, operator of Sonor
[email protected]