Privacy Policy

Last updated: September 30, 2026

This policy explains what personal data the sona.fast website collects, how it is used, and the choices you have. It is operated by Sparky (“we”, “us”). You can reach us at hello@sona.fast.

This policy covers the sona.fast marketing site only. Sona is open-source software that other people self-host on their own infrastructure; those independent sites are run by their own operators, who are responsible for their own privacy practices. We don’t control or have access to them.

What we collect

Technical/connection data handled by our hosting provider, such as your IP address, browser/user-agent, and request time. This is processed to deliver the site, secure it, and prevent abuse. We don’t use analytics or advertising trackers.

Cookies

The public site sets no analytics or advertising cookies. Our network provider (Cloudflare) may set a strictly-necessary security cookie (for example, bot management) to protect the site. A short-lived, strictly-necessary cookie is also set during supporter-key sign-in to protect that round-trip; it clears as soon as the round-trip finishes, however it ends, and expires on its own within ten minutes.

The managed-hosting waitlist

The site doesn’t collect email addresses. It used to offer a waitlist for a managed-hosting service. We decided not to offer that service, so everyone on the list gets one final email saying so, and then we delete the list, including every address, signup date, and unsubscribe record. We do not “sell” or “share” your personal information as those terms are defined under the CCPA/CPRA (we do no cross-context behavioral advertising).

Supporter key minting

If you choose to mint a Sona supporter key, you sign in with GitHub so we can confirm you have an active sponsorship. This flow does not create an account, ask for a password, or collect your email.

What we collect: your GitHub login (username) and the date and time of each mint. Because you can re-mint while your sponsorship is active, we may record more than one mint timestamp.
Why: only to issue the key and to keep a minimal issuance log that helps prevent abuse — nothing else.
Retention: the issuance log lives in our infrastructure logs (Cloudflare) and is retained for up to 30 days, then discarded.

To request access to, or deletion of, this data, email hello@sona.fast.

Service providers

We rely on a small number of third parties who process data on our behalf or as part of serving the site. Those that run as part of the site are:

Service providers that process data as you browse, what we use them for, and the data involved
Provider	Purpose	Data involved
Cloudflare	Hosting, DNS, CDN, and security for the site.	IP address, connection metadata.
GitHub	Verifies your sponsorship when you mint a supporter key.	Your GitHub login, via a sign-in you initiate.

We build and maintain this site with AI development tools. They do not run as part of the site, so nothing you do here is sent to them as you browse. When we diagnose a problem, the operational data we share with development or code-review tools can include server logs and, where the problem involves the supporter-key flow, the records involved. Those logs can contain request data such as IP addresses, page URLs, and browser user-agent strings.

Those tools are Anthropic’s Claude, which writes and debugs code under our direction, and CodeRabbit, a code review service that reads proposed changes, along with the model providers those services route to. The site has been built this way since it launched; our AI disclosure page has the details.

All of these providers are located in, or transfer data to, the United States and other countries. They operate under their own privacy terms. Our web fonts are served from sona.fast itself, so no outside font provider sees your visit.

Legal bases (GDPR)

Where the GDPR applies: we process technical/security data on the basis of our legitimate interest in operating and protecting the site.

How long we keep it

Provider security logs are retained per that provider’s standard retention. Data we share with development or code-review tools while diagnosing a problem is kept by us only as part of the underlying logs and records described above; those vendors keep it under their own terms.

Your rights

Request access to, correction of, or deletion of your data by emailing hello@sona.fast.
Depending on where you live (e.g. the EEA/UK under GDPR, or California under the CCPA/CPRA), you may have additional rights, including the right to object to processing and to lodge a complaint with your local data-protection authority.
We will not discriminate against you for exercising any of these rights. Because we do not “sell” or “share” your personal information, there is nothing to opt out of.

Children

The site is not directed to children under 16, and we don’t knowingly collect their data.

Changes

We may update this policy; we’ll revise the “last updated” date above, and material changes will be reflected here before they take effect.

Contact

Privacy questions or requests: hello@sona.fast.