Privacy Policy

Español

Last updated: October 11, 2026

This Privacy Policy explains how Sonli (hereinafter “Sonli”, “we”, “our”, or “the application”) collects, uses, shares and protects the personal information of people who use our mobile application and related services (the “Service”).

By using Sonli you accept the practices described in this document. If you do not agree with any part of it, please stop using the Service.

1. Data Controller

Sonli is operated by Juan Pablo Huaco del Carpio, based in Argentina, acting as the data controller for the personal data collected through the Service.

For any inquiry related to this policy or to the processing of your personal data, please write to privacidad@sonli.app.

2. Data we collect

2.1 Account data

You can access Sonli in two ways: through Google Sign-In, or with an email and password account created inside the app.

If you sign in with Google, Google shares the following basic profile information with us:

  • Email address
  • Full name
  • Profile picture (public URL)
  • Unique Google identifier (Google ID)

We do not access or store your Google password. Authentication is handled through the OAuth 2.0 standard.

If you create an email and password account, we store your email address, the name you provide, and your password hashed with bcrypt, using a salt unique to each account. We do not store the password in plain text and we cannot read it: when you sign in we only compare against that hash. In this case we receive no data from Google.

2.2 Data you generate by using the Service

  • Songs (title, artist, key, tempo, duration, tags, notes, lyrics and chords)
  • Attachments to songs (PDFs, audio, links, text)
  • Setlists, rehearsal sessions and live events (title, date, location, description)
  • Information about your musical organization (name, description, logo, members, roles)
  • Invitations you send or receive, along with their responses (RSVP)
  • Notifications and their read status
  • A profile picture you upload from the app, hosted on our server
  • Usage preferences (for example font size and chord chart display options, or the organization you open by default)

2.3 Technical and device data

  • Push notification token (FCM on Android, APNS on iOS): our API has an endpoint that stores it, but the app does not register one today and we send no push notifications
  • Operating system, device model and application version, which Sentry attaches to the error reports sent by the Android and iOS apps. They only leave the device if a Sentry project is configured, and today none is (see section 5)
  • IP address and approximate date/time of requests to the server (access logs)
  • Error and exception logs to improve the quality of the Service

2.4 Website access form

If you request beta access on sonli.app, we receive what you enter in the form: your name, your email, your church's name, city and country, team size and, if you fill them in, your WhatsApp number and a comment about how your team organizes today. We use it only to review the request and contact you personally. It reaches us as an email, which we delete when you ask us to or when the beta no longer needs it.

2.5 Data we do NOT collect

  • Your Google password: Google Sign-In uses OAuth 2.0 and your password never reaches our servers
  • Your Sonli password in plain text: we store only its bcrypt hash, which cannot be reversed
  • Your device contact list
  • Your precise geographic location (GPS)
  • Financial information or credit card data
  • Audio or video from your microphone or camera, unless you voluntarily attach such media to a song
  • Your browsing on other sites or applications: we do not track what you do outside Sonli. Within the sonli.app website we do measure page visits and performance in aggregate, as described in section 5

3. How we use your data

We use the data collected to:

  • Create and maintain your user account
  • Allow you to manage your library of songs, setlists and sessions
  • Synchronize your data across your devices and our servers
  • Manage organization membership, invitations and roles
  • Show you your organization’s notifications inside the app: invitations, sessions and relevant changes. You read them in the in-app notification center; we send no push notifications today
  • Improve the stability, security and performance of the Service
  • Detect, prevent and respond to abuse, fraud or technical issues
  • Comply with applicable legal obligations

4. Legal basis for processing

The processing of your personal data is based on:

  • Your consent, given when you accept this policy and sign in to the application.
  • Performance of the Service: certain data is required for the application to work (for example, we cannot show you your songs without storing them).
  • Legitimate interest: to maintain the security of the Service, prevent abuse and improve technical quality.
  • Legal obligation: when a competent authority lawfully requires the information.

5. Who we share your data with

We do not sell your personal data. We share it only with the following service providers, strictly to the extent required to operate the Service:

  • Google LLC: for Google Sign-In authentication, when you choose that access method.
  • Railway Corporation: provides the server infrastructure where our backend and database are hosted.
  • Expo (650 Industries, Inc.): provides the platform we use to build, distribute and update the mobile application.
  • Vercel Inc.: hosts our website (sonli.app). Vercel Analytics and Vercel Speed Insights, which run on the site, receive the page you visited, the site you came from, the country, the browser and the device type, along with the loading speed metrics of each page. They use no cookies, build no advertising profile and receive no data from your account.
  • Sentry (Functional Software, Inc.): receives error reports from two places. From the Android and iOS apps, crashes with the message, the stack trace, the operating system, the device model and the application version. From the server, unhandled exceptions with the request route and a request identifier. In both cases session tokens are replaced with “[redacted]” before the event leaves, and the default sending of personal data is turned off. No project key (DSN) is configured today, neither in the app nor on the server: without that key the reporting is never initialized and no event is sent. The web version of the app does not load it.
  • Resend: delivers the email that notifies us of each access request made through the website form, with the details you entered (section 2.4). That is the only thing we hand it: Resend is not involved in the application and receives no data from your account.

We may also share your data within your own musical organization: other members will be able to see your name, photo, role and the resources (songs, setlists, sessions) that you contribute to the organization.

We may disclose personal data if required to do so by a court order, applicable law, or a lawful request by a competent authority.

6. International data transfers

Our providers (Google, Railway, Expo, Vercel, Sentry, Resend) may store and process data on servers located in the United States or other countries outside Argentina and the European Union. By using Sonli, you expressly consent to such international transfers pursuant to article 12 of Argentina’s Personal Data Protection Law N° 25,326.

7. Data retention

We retain your personal data for as long as your account is active. If you request the deletion of your account, we erase your identifiable personal data within a maximum of 30 days, except for data we are required to retain due to legal obligations or to resolve disputes (in such cases only for the strictly necessary period).

Data generated by your activity within an organization (shared songs, setlists, sessions) may remain in that organization after you delete your personal account, since it belongs to the shared space of the group.

8. Security

We apply reasonable technical and organizational measures to protect your data, including:

  • Encryption in transit via HTTPS/TLS for all communications with our servers.
  • In the native apps, session tokens are stored in the operating system keychain (Keychain on iOS, Keystore on Android). The browser has no such keychain: there the tokens go to the site’s localStorage, which JavaScript running on the page can read.
  • Token-based authentication using short-lived JWTs.
  • Passwords for email accounts are stored as a bcrypt hash, with a distinct salt per account and never in plain text.
  • Restricted database access limited to authorized personnel.
  • Per-organization isolation (multi-tenancy): your data is not accessible to users from other organizations.

Despite these measures, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security, but we commit to notifying you without undue delay in the event of an incident that affects your personal data.

9. Your rights

Pursuant to Argentina’s Personal Data Protection Law N° 25,326 (and, where applicable, the European Union’s General Data Protection Regulation — GDPR), you have the right to:

  • Access: request a copy of your personal data.
  • Rectification: correct inaccurate or incomplete data.
  • Erasure: delete your account and the associated personal data.
  • Objection: object to specific processing activities involving your data.
  • Portability: receive your data in a structured, machine-readable format.
  • Withdrawal of consent: revoke your consent at any time, without affecting the lawfulness of processing carried out before withdrawal.

You can exercise these rights by writing to privacidad@sonli.app or, for erasure requests, by using the “Delete my account” option within the application. In Argentina, the Agency for Access to Public Information acts as the supervisory authority, and you may file a complaint with it if you believe your rights have been violated.

10. How to delete your account

You can request the complete deletion of your account and personal data in any of the following ways:

  • From the application: in the More tab, at the bottom of the list, there is a Zona peligrosa section that starts collapsed; tap it to expand and Eliminar mi cuenta appears inside.
  • By writing to privacidad@sonli.app from the email address associated with your account.

We will process your request within a maximum of 30 days. If you are the only person holding the administrator role in an organization that has other members, the app blocks the deletion until another member holds that role. If you are the only member of the organization, there is nobody left without an administrator and the deletion goes through.

11. Minors

Sonli is not directed to children under the age of 13. We do not knowingly collect personal data from children below that age. If you become aware that a minor has provided us with personal data, please contact us so we can proceed with its deletion.

12. Cookies and similar technologies

The Sonli mobile application does not use cookies. Our website (sonli.app) may use strictly necessary technical cookies for its operation. We do not use advertising or profiling cookies.

13. Changes to this policy

We may update this Privacy Policy from time to time. When the changes are significant, we will notify you through a prominent in-app notice or by email before they take effect. The “Last updated” date at the top of this document indicates when the last revision was made.

14. Contact

For any question, comment or request related to this Privacy Policy or to the processing of your personal data, please contact us at:

privacidad@sonli.app