Privacy Policy

Welcome to Sona. Sona is developed and operated by Lythorix Technologies LLC ("we," "us," or "our"). This Privacy Policy explains how we collect, use, store, share, and protect your information when you use the Sona app and web service (collectively, the "Service").

By using the Service, you acknowledge that you have read and agree to this Policy. If you do not agree, please do not use the Service.

1. Information We Collect

1.1 Device and Account Identifiers

The Service operates primarily on a per-device basis and does not require registration to use:

• The iOS app uses the system-provided device identifier (identifierForVendor) to recognize your device;
• The web version generates a random identifier stored in your browser's localStorage;
• If you choose to link WhatsApp (phone verification) or register an email account, we migrate or associate your device's credits, subscription, and chat memory with a normalized identity derived from your phone number or email hash, so you can retrieve your data across multiple devices.

1.2 Account and Contact Information

If you create an email account, we collect your email address and password (stored as a hash — we cannot see your plaintext password). If you link WhatsApp, we collect your phone number and send a one-time verification code via Meta's WhatsApp Business Platform to confirm ownership of the number.

1.3 Chat Content and Interaction Records

When you interact with characters in Sona via text or voice, we process:

• Text messages you input and voice call transcripts;
• Summarized conversation memory and retrieval-based memory (used so characters remember key points from prior interactions);
• Content you voluntarily provide in "Custom Memory" and "Persona Addendum" fields (subscriber features);
• Custom character nicknames you set and custom avatar images you upload (subscriber features; images are re-encoded before storage on our servers).

This content is used to generate AI responses, maintain conversational context, and for safety review as described in Section 3.

Voice-call recordings and transcripts. For new voice calls, we configure ElevenLabs not to retain call audio recordings. ElevenLabs may process voice and transcript data in real time to provide the call. Conversation transcripts retained by ElevenLabs are configured for a 30-day retention period, after which they are handled under the provider's retention controls. We may further enable deletion of transcript and personally identifiable information (PII) through our provider controls. This setting does not by itself delete chat memories, account data, or transaction records held in Sona's own systems.

1.4 Subscription and Transaction Information

All paid features on iOS (subscription plans, credit packs) are completed through Apple's App Store / StoreKit. We do not directly collect your full payment card information — this is handled by Apple. We only receive transaction IDs, product identifiers, and subscription expiration dates from Apple, used to grant the corresponding credits and plan entitlements.

1.5 System and Device Information

To maintain service stability, troubleshoot issues, and prevent abuse, we may log basic technical information such as device model, OS version, app version, IP address, and request timestamps.

1.6 System Permissions

Voice call features require microphone access; custom avatar features require photo library access. We only request these permissions when you actually use the corresponding feature, and you may revoke them at any time in system settings — doing so only affects the corresponding feature.

2. AI Service Disclosures

Sona's core functionality is powered by third-party AI models (see Section 4). You should understand that:

• AI-generated content may be inaccurate, inconsistent, or not match your expectations;
• Every character in the Service is a fictional AI persona without genuine consciousness or emotion — if you ask directly during a conversation, the character will honestly acknowledge its AI nature, which is a core product principle;
• AI responses are for entertainment, companionship, and creative reference only, and do not constitute professional medical, legal, financial, or psychological advice;
• We perform automated safety classification on both your input and AI-generated output (including but not limited to crisis-event detection and protections related to minors), and may intercept, log, or surface support resources when necessary. This content governance exists for user safety, not to monitor your general usage.

3. How We Use Your Information

• Providing, maintaining, and improving AI chat, voice calls, and character interaction features;
• Processing account registration, login, identity verification, and cross-device data sync;
• Processing subscriptions, credit grants, and transaction records;
• Performing content safety review to protect users and prevent abuse of the Service;
• Responding to questions, feedback, or complaints submitted through our support channels;
• Using information as required by law or necessary to protect our rights or those of you or others.

We do not use your personal information for purposes not described in this Policy, and we do not sell your personal information.

4. How Information Is Shared With Third Parties

To provide the Service, we transmit necessary information to the following third-party service providers, each limited to what is necessary for the corresponding function:

• Google (Gemini API) and Alibaba Cloud DashScope (Qwen models): process your text chat content to generate AI responses;
• ElevenLabs: processes voice call speech synthesis and conversation content to provide character voice experiences. New call audio recordings are not retained by our ElevenLabs Agent configuration; ElevenLabs transcript retention is configured for 30 days;
• Cloudflare: serves as our edge computing and data-processing infrastructure (Workers, KV storage, vector search), relaying requests between you and the AI models;
• Meta (WhatsApp Business Platform): used only if you choose to link WhatsApp, for sending verification codes and (if you use that channel) relaying messages;
• Resend: used to send transactional emails such as account verification and password reset emails;
• Apple (App Store / StoreKit): processes all payments and subscription transactions on iOS;
• Our server hosting provider: stores structured data such as accounts, credits, and character settings.

Beyond the sharing described above that is necessary to provide the Service, we do not sell, rent, or use your personal information for third-party marketing purposes unrelated to the Service. We may also disclose information to the extent necessary to comply with law, protect our rights, or prevent fraud and abuse.

5. Data Storage and Retention

We retain your information only for as long as necessary to provide the Service. New ElevenLabs voice-call audio recordings are not retained. ElevenLabs voice-call transcripts are configured for a 30-day retention period; where enabled in our provider controls, transcripts and PII are deleted at the end of that period. Sona's own chat memories, account data, security logs, and transaction records have separate retention needs and are not automatically deleted by this voice-provider setting. You may request deletion of your account and related data at any time through our support channel; we will process such requests within a reasonable time, except as otherwise required by law.

6. Your Rights

You may contact us using the information below to request:

• Access to or a copy of your personal information;
• Correction of inaccurate information;
• Deletion of your account and related information;
• Withdrawal of previously given consent;
• Answers to questions or complaints about this Policy.

7. Protection of Minors

Sona is intended for use only by individuals 18 years of age or older. We do not knowingly collect personal information from individuals under 18. If we discover an account belonging to a user under 18, we will delete the associated account and data through a reasonable process. The Service includes automated content review mechanisms designed to detect and block any inappropriate requests related to minors.

8. Data Security

We take reasonable technical and organizational measures to protect your information, including encryption in transit, access controls, and server-side security review. However, no method of transmission over the internet or electronic storage is completely secure, and we cannot guarantee absolute security.

9. Changes to This Policy

We may revise this Policy from time to time. Revised versions will update the effective date at the top of this page; if changes are material, we will notify you through an in-app announcement or other reasonable means.

10. Governing Law

This Policy is governed by, and shall be construed in accordance with, the laws of the State of New Mexico, United States, without regard to its conflict-of-laws principles.

11. Contact Us

If you have any questions, comments, or complaints about this Policy, please contact us:

• Product: Sona
• Operated by: Lythorix Technologies LLC (State of New Mexico, USA)
• Email: [email protected]