Privacy Policy

Last updated 7 September 2026

The short version. Your calendar is backed up to your own account so that losing your phone doesn't mean losing your year. That backup is readable by you and nobody else — not your friends, not other users. What friends can see is a different and much smaller thing: the shape of your time, seven numbers a day. They never see what anything was called.

Who we are

Sonder Calendar is built and operated by Owen Lombardi. You can reach us at hello@sondercalendar.com.

Your calendar and your backup

What you write in Sonder — event names, places, your learned routines, your goals — lives on your phone. It is also backed up to your account, so that if you lose your phone, break it, or delete the app, your calendar comes back when you sign in again.

That backup is private to you. It sits in a row locked to your account, and the database itself refuses to hand it to anyone else. No friend feature reads it. There is no sharing setting that can expose it. It exists so that you can get your own calendar back, and for nothing else.

What we store in your account

An account is required to use Sonder. We store:

• Your email address, username and display name
• Your public profile — an optional short bio, an optional school, and one color chosen from the seven. You type these yourself on the Edit profile screen, and anyone signed in who opens your profile can read them. Leave them empty and there is nothing to see.
• Your calendar backup — events, places, routines and goals. Readable only by you.
• Daily category totals — seven numbers per day, being the minutes you logged in each color. No names, no places, no notes.
• Your friend list and pending friend requests
• A count of how many voice requests you have made each day, to enforce usage limits
• Your subscription status, if you subscribe
• A notification token — if you allow notifications, we store the identifier Apple gives your phone so that we can deliver them. It identifies the device, not you, and it is removed when you sign out.
• Who has opened your profile — when another signed-in person views your profile we record that they did, and when. You can always see how many people have; seeing their names is part of the paid tier. We keep it so the count means something, and for nothing else.
• Hours spent together — when you send a friend an event and they accept it, we record the date and the number of minutes against both of you. It is how "top friends" is counted. It never includes what the event was called.
• Blocks and reports — who you have blocked, and any report you send us, including the reason you wrote.
• A joint calendar, if you start one — a separate calendar shared with exactly one other person. Everything on it, including event names, times and places, is readable by both of you and by nobody else. It does not touch your own calendar, which stays private; the two are stored apart and neither can be read through the other. Either of you can leave it, and blocking closes it.

Those first two are kept deliberately apart. Friends you have accepted can see your daily color totals and nothing else — not what an event was called, not where it was. Your backup is in a separate place that no friend, accepted or otherwise, can read.

The early access list

If you enter your email address on sondercalendar.com, we store that address and the date you entered it. Nothing else — no name, no tracking, no advertising profile, and no cookie is set. It is kept apart from the app's accounts and cannot be read through the app or its API.

We use it for one thing: to tell you when you can get Sonder. Ask us at hello@sondercalendar.com and we will delete your address.

Voice and speech

When you speak to Sonder, your phone converts your speech to text using Apple's built-in speech recognition. That text is then sent to OpenRouter, which routes it to OpenAI's GPT-5.6 Luna model to be turned into calendar events, and the result comes back to your phone.

• We do not record or store audio. Ever.
• We do not store the text of what you said.
• The request passes through our server only to attach an API key. Nothing is written down.

Two companies handle that text on the way through, each under their own privacy policy: OpenRouter, which routes the request, and OpenAI, which runs the model.

Sonder used Anthropic's Claude API for this until 7 September 2026. It no longer does, and no new requests are sent there.

What we do not do

• We do not sell your data. There is no version of this app where we do.
• We do not show ads.
• We do not use third-party analytics or advertising trackers.
• We do not read your device's calendar, contacts, photos or location.

Permissions the app asks for

• Microphone — so you can speak your day. Only while you are holding a recording.
• Speech recognition — to turn what you said into text, on your device.
• Notifications — for event reminders, and to tell you when someone invites you to an event or sends a friend request. Optional, and every kind can be turned off separately.
• Photos — only if you choose to save a day card. We never browse your library.

Services we rely on

• Supabase — stores accounts, your private calendar backup, friend lists and daily color totals.
• Cloudflare — runs our server and this website.
• OpenRouter — routes what you said to the model that reads it.
• OpenAI — the model that turns your words into events.
• Apple — the App Store, speech recognition on your device, and the Apple Push Notification service, which delivers notifications to your phone.

Your choices

• Delete your account at any time from Settings. Your backup and your color totals are deleted along with it, permanently. The database is set up to remove them automatically — they cannot be left behind.
• Delete the app and the copy on your phone goes with it, but your backup stays in your account. Sign in on a new phone and your calendar returns. If you want the backup gone too, delete your account.
• Ask us anything about your data at hello@sondercalendar.com and we will answer within 30 days.

Depending on where you live, you may have additional rights to access, correct, export or delete your personal information. Email us and we will honour those requests.

Children

Sonder is not directed at children under 13, and we do not knowingly collect information from them. If you believe a child has created an account, email us and we will remove it.

Security

Accounts are protected by Supabase authentication, and our database enforces row-level security — meaning the database itself refuses to return one person's rows to another. Your calendar backup and your shareable color totals are kept in separate tables with separate rules, so that widening what friends can see could never widen what they can read of your backup. No system is perfectly secure, but the less we store, the less there is to lose.

Changes

If this policy changes in a way that materially affects you, we will tell you in the app before the change takes effect. The date at the top always reflects the current version.