Privacy Policy

Last updated: August 12, 2026

This policy explains what personal data the sona.fast website collects, how it is used, and the choices you have. It is operated by Sparky (“we”, “us”). You can reach us at hello@sona.fast.

What we collect

• Your email address and the date you signed up, if and when you submit the managed-hosting waitlist form. We don’t ask for your name or anything else.
• Technical/connection data handled by our hosting provider, such as your IP address, browser/user-agent, and request time. This is processed to deliver the site, secure it, and prevent abuse. We don’t use analytics or advertising trackers.

Cookies

The public site sets no analytics or advertising cookies. Our network provider (Cloudflare) may set a strictly-necessary security cookie (for example, bot management) to protect the site. A short-lived, strictly-necessary cookie is also set during supporter-key sign-in to protect that round-trip; it clears as soon as the round-trip finishes, however it ends, and expires on its own within ten minutes.

How we use your email

Only to contact you about Sona managed hosting: the emails that set up your signup (a confirm link, and a short welcome once you confirm), and then one further email: a notification when the service becomes available, or a note if we decide not to offer it. If we are diagnosing a problem with the waitlist itself, your address can appear in the records we look at, including in the development tools described under Service providers. We do not “sell” or “share” your personal information as those terms are defined under the CCPA/CPRA (we do no cross-context behavioral advertising).

Supporter key minting

If you choose to mint a Sona supporter key, you sign in with GitHub so we can confirm you have an active sponsorship. This flow does not create an account, ask for a password, or collect your email.

• What we collect: your GitHub login (username) and the date and time of each mint. Because you can re-mint while your sponsorship is active, we may record more than one mint timestamp.
• Why: only to issue the key and to keep a minimal issuance log that helps prevent abuse — nothing else.
• Retention: the issuance log lives in our infrastructure logs (Cloudflare) and is retained for up to 30 days, then discarded.

To request access to, or deletion of, this data, email hello@sona.fast.

Service providers

We rely on a small number of third parties who process data on our behalf or as part of serving the site. Those that run as part of the site are:

We build and maintain this site with AI development tools. They do not run as part of the site, so nothing you do here is sent to them as you browse. When we diagnose a problem, the operational data we share with development or code-review tools can include server logs and, where the problem involves the waitlist or supporter-key flows, the records involved. Those logs can contain request data such as IP addresses, page URLs, and browser user-agent strings.

Those tools are Anthropic’s Claude, which writes and debugs code under our direction, and CodeRabbit, a code review service that reads proposed changes, along with the model providers those services route to. The site has been built this way since it launched; our AI disclosure page has the details.

All of these providers are located in, or transfer data to, the United States and other countries. They operate under their own privacy terms. Our web fonts are served from sona.fast itself, so no outside font provider sees your visit.

Legal bases (GDPR)

Where the GDPR applies: we process your waitlist email on the basis of your consent (which you can withdraw at any time), and we process technical/security data on the basis of our legitimate interest in operating and protecting the site.

How long we keep it

We keep your waitlist email until you unsubscribe or ask us to delete it, or until the managed-hosting waitlist is no longer needed, whichever comes first. If you unsubscribe, we stop emailing you and keep your address flagged do-not-contact solely to honor that opt-out (a suppression entry), unless you ask us to delete it entirely. Provider security logs are retained per that provider’s standard retention. Data we share with development or code-review tools while diagnosing a problem is kept by us only as part of the underlying logs and records described above; those vendors keep it under their own terms.

Your rights

• Unsubscribe at any time using the link in any email we send. This stops all email; we keep your address only as a do-not-contact suppression entry to honor the opt-out. To remove it entirely, ask us to delete it.
• Request access to, correction of, or deletion of your data by emailing hello@sona.fast.
• Depending on where you live (e.g. the EEA/UK under GDPR, or California under the CCPA/CPRA), you may have additional rights, including the right to object to processing and to lodge a complaint with your local data-protection authority.
• We will not discriminate against you for exercising any of these rights. Because we do not “sell” or “share” your personal information, there is nothing to opt out of.

Children

The site is not directed to children under 16, and we don’t knowingly collect their data.

Changes

We may update this policy; we’ll revise the “last updated” date above, and material changes will be reflected here before they take effect.

Contact

Privacy questions or requests: hello@sona.fast.