Privacy Policy

Last updated 9 September 2026

The short version. Your calendar is backed up to your own account so that losing your phone doesn't mean losing your year. That backup is readable by you and nobody else — not your friends, not other users. What friends can see is a different and much smaller thing: the shape of your time, seven numbers a day. They never see what anything was called.

Who we are

Sonder Calendar is built and operated by Owen Lombardi. You can reach us at [email protected].

Your calendar and your backup

What you write in Sonder — event names, places, your learned routines, your goals — lives on your phone. It is also backed up to your account, so that if you lose your phone, break it, or delete the app, your calendar comes back when you sign in again.

That backup is private to you. It sits in a row locked to your account, and the database itself refuses to hand it to anyone else. No friend feature reads it. There is no sharing setting that can expose it. It exists so that you can get your own calendar back, and for nothing else.

What we store in your account

An account is required to use Sonder. We store:

• Your email address, username and display name
• Your public profile — an optional short bio, an optional school, and one color chosen from the seven. You type these yourself on the Edit profile screen, and anyone signed in who opens your profile can read them. Leave them empty and there is nothing to see.
• Your calendar backup — events, places, routines and goals. Readable only by you.
• Daily category totals — seven numbers per day, being the minutes you logged in each color. No names, no places, no notes.
• Your friend list and pending friend requests
• A count of how many voice requests you have made each day, to enforce usage limits
• Your subscription status, if you subscribe
• A notification token — if you allow notifications, we store the identifier Apple gives your phone so that we can deliver them. It identifies the device, not you, and it is removed when you sign out.
• Who has opened your profile — when another signed-in person views your profile we record that they did, and when. You can always see how many people have; seeing their names is part of the paid tier. We keep it so the count means something, and for nothing else.
• Hours spent together — when you send a friend an event and they accept it, we record the date and the number of minutes against both of you. It is how "top friends" is counted. It never includes what the event was called.
• Blocks and reports — who you have blocked, and any report you send us, including the reason you wrote.
• A joint calendar, if you start one — a separate calendar shared with exactly one other person. Everything on it, including event names, times and places, is readable by both of you and by nobody else. It does not touch your own calendar, which stays private; the two are stored apart and neither can be read through the other. Either of you can leave it, and blocking closes it.

Those first two are kept deliberately apart. Friends you have accepted can see your daily color totals and nothing else — not what an event was called, not where it was. Your backup is in a separate place that no friend, accepted or otherwise, can read.

The early access list

If you enter your email address on sondercalendar.com, we store that address and the date you entered it. Nothing else — no name, no tracking, no advertising profile, and no cookie is set. It is kept apart from the app's accounts and cannot be read through the app or its API.

We use it for one thing: to tell you when you can get Sonder. Ask us at [email protected] and we will delete your address.

Voice and speech

When you speak to Sonder, your phone converts your speech to text using Apple's built-in speech recognition. That text is then sent to OpenRouter, which routes it to OpenAI's GPT-5.6 Luna model to be turned into calendar events, and the result comes back to your phone.

• We do not record or store audio. Ever.
• We do not store the text of what you said.
• The request passes through our server only to attach an API key. Nothing is written down.

Two companies handle that text on the way through, each under their own privacy policy: OpenRouter, which routes the request, and OpenAI, which runs the model.

Sonder used Anthropic's Claude API for this until 7 September 2026. It no longer does, and no new requests are sent there.

What we do not do

• We do not sell your data. There is no version of this app where we do.
• We do not show ads.
• We do not use third-party analytics or advertising trackers.
• We do not read your contacts or your location.
• We do not read your device's calendar unless you ask us to, once, by importing it. See If you import a calendar below.

Permissions the app asks for

• Microphone — so you can speak your day. Only while you are holding a recording.
• Speech recognition — to turn what you said into text, on your device.
• Notifications — for event reminders, and to tell you when someone invites you to an event or sends a friend request. Optional, and every kind can be turned off separately.
• Photos — only if you choose to save a day card. We never browse your library.
• Calendar — only if you choose to import. Sonder reads your calendars once, never writes to them, and never syncs. Asked for at the moment you start an import, never before.

Services we rely on

• Supabase — stores accounts, your private calendar backup, friend lists and daily color totals.
• Cloudflare — runs our server and this website.
• OpenRouter — routes what you said to the model that reads it.
• OpenAI — the model that turns your words into events.
• Apple — the App Store, speech recognition on your device, the Apple Push Notification service, and payment for a Sonder membership. We never see your card; Apple handles the money and tells us only that a subscription is active.
• RevenueCat — records whether your membership is active, so the app knows what to unlock. It receives an account identifier and the purchase itself. It does not receive your calendar, your events, or anything you said.

If you import a calendar

Sonder can read the calendars already on your phone once, to bring your existing events in and color them. It reads; it never writes to them, and it never syncs. The name of each event and how long it lasts are sent to be colored — the same route your spoken words take, to OpenRouter and OpenAI. Locations are brought in but never sent anywhere. Nothing is kept by us beyond your own backup, which only you can read, and you can delete any imported event like any other.

If you become a Member

Payment goes through Apple's in-app purchase, so your card details never reach us and never touch our servers. We store one thing: whether your membership is active. That is what turns five requests a day into twenty and shows you the names behind your counts. Cancel any time from your Apple account settings — we cannot cancel it for you, and we are not told why you left.

Your choices

• Delete your account at any time from Settings. Your backup and your color totals are deleted along with it, permanently. The database is set up to remove them automatically — they cannot be left behind.
• Delete the app and the copy on your phone goes with it, but your backup stays in your account. Sign in on a new phone and your calendar returns. If you want the backup gone too, delete your account.
• Ask us anything about your data at [email protected] and we will answer within 30 days.

Depending on where you live, you may have additional rights to access, correct, export or delete your personal information. Email us and we will honour those requests.

Children

Sonder is not directed at children under 13, and we do not knowingly collect information from them. If you believe a child has created an account, email us and we will remove it.

Security

Accounts are protected by Supabase authentication, and our database enforces row-level security — meaning the database itself refuses to return one person's rows to another. Your calendar backup and your shareable color totals are kept in separate tables with separate rules, so that widening what friends can see could never widen what they can read of your backup. No system is perfectly secure, but the less we store, the less there is to lose.

Changes

If this policy changes in a way that materially affects you, we will tell you in the app before the change takes effect. The date at the top always reflects the current version.