Last updated: October 11, 2026
Other users do not see your email, profile, or trace history. This is public anonymity, not technical unlinkability: Sonder associates traces and witness marks with your account internally to enforce ownership, prevent abuse, support export, and honor deletion.
Trace text is processed for safety before publication. Private AI reflection is off by default. If you enable it and deliberately ask for a reflection, up to ten recent published traces are sent to Groq. Reflection is never generated automatically, and you can turn the feature off at any time.
Convex stores application and authentication data. Hosting, email, and AI providers process only the data needed for their functions. Data is protected in transit and through provider storage controls, but traces are not end-to-end encrypted because the service must process them for display and moderation.
Your journal uses end-to-end encryption. Your device locks each entry before saving it, and only your journal passphrase or saved recovery key can open it. Sonder and its storage provider do not receive those secrets and cannot read encrypted entries. Journal text is never moderated, reviewed, or sent to an AI service. Search and export happen on your device after you unlock it. As you type, your device keeps an encrypted recovery copy and syncs your entry automatically. This copy helps protect unfinished writing if the connection drops; it contains no readable text or journal key.
Your journal passphrase is separate from your account password. Resetting your account password does not unlock your journal. If you lose both your journal passphrase and recovery key, we cannot recover your entries. We still store information needed to run your journal, such as which account owns an entry and when it was saved or removed. We retain a random save identifier after deletion so a delayed save cannot bring a removed entry back. It contains no journal text or key.
Entries written before encryption was introduced remain readable on our servers until you unlock your journal and your device encrypts them. This conversion preserves your entries and their removal dates. It cannot erase earlier readable copies that may remain in provider backups. Encryption also depends on the app and device you use: compromised devices or malicious changes to the app could expose words while you are writing or reading them.
We use PostHog in its EU region to measure visits to public pages, clicks to enter Sonder, and website performance. Analytics uses cookieless mode, without analytics cookies or browser storage, account identification, session recordings, heatmaps, or automatic form and interaction capture. PostHog receives basic browser and device categories, public page paths, referrer domains, and performance measurements. PostHog uses the request IP address and browser user agent to generate a daily hash for estimating visitors, then removes these fields before storing events. This hash is not a permanent account identifier. Network requests still reach PostHog's infrastructure.
Authentication and private app pages are excluded. We strip URL query strings and fragments and do not send email addresses, passwords, verification codes, contact messages, traces, journal entries, or journal keys. We respect Do Not Track and Global Privacy Control browser signals. This measurement helps us improve public information and site speed; it is not used for behavioral advertising.
Your private archive can export your traces and witness marks as JSON. Export and initiating trace removal require you to confirm your current password. Removing a trace hides it immediately from every user-facing surface. It can be restored for seven days, after which the trace and associated marks are permanently purged in bounded background batches.
Your journal exports a readable JSON file on your device. Keep that download private. Export and removal of a journal entry each require you to confirm your current password, and a removal proof is bound to that one entry. Removed entries are hidden immediately, can be restored for seven days, and are then permanently purged in bounded background batches.
You can permanently delete your entire journal from its journal screen, even if you have lost the journal passphrase. Your account password confirms this action. All entries, including removed entries, and saved encryption settings are deleted in background batches. This action has no restore window.
You can delete your entire account from Account. Export your journal and traces first if you want copies. After fresh password confirmation, access is blocked on every device immediately. Background cleanup removes journals, saved encryption settings, traces, witness marks, sign-in credentials, sessions, verification codes, and account preferences. Encrypted journal recovery copies on the browser where you delete are cleared. We cannot erase downloads or offline copies on other devices, and earlier provider backups follow the provider's retention period.
Contact messages are not linked to accounts and remain under their 180-day retention period; contact rate-limit events expire after 24 hours. Use the contact page for any remaining privacy requests.
We do not sell personal information. Data may be disclosed to contracted service providers, when legally required, or when necessary to protect the service and its users. We minimize the information involved wherever possible. Email sent to a sonderlife.space address is processed by Resend and forwarded to the private support inbox.
Essential cookies and browser storage support authentication, security, and remembered interface guidance. Sonder does not send engagement notifications. Account verification and recovery email is sent only when required or requested.
Sonder is not intended for children under 13. It is not therapy or a crisis service and is not continuously monitored. In immediate danger, contact local emergency or professional crisis services.
Email support@sonderlife.space or use the contact page for privacy, access, export, or account-deletion questions.