Sonder (the "App") is developed and operated by an independent developer. We are the data controller for the information described here, and we are responsible for it under the laws that apply to us. You can reach us at support@sonder.app.
Sonder's default mode is fully on-device. Translations of text, photos, and speech — and the culture assistant's explanations — are produced by models that run on your device using Apple's system translation and speech frameworks. In this mode, your content never leaves your device, and we receive none of it. Nothing in this privacy policy restricts what happens entirely on your device.
If you choose to enable cloud processing, you are asked for explicit consent the first time, and you can change your mind at any time in Settings. When cloud processing is on, the content you submit for translation — the photo or image you capture or select, the text you type, the audio you record, and the target language — is sent to our server so we can produce the translation and explanation you asked for. We call this Submitted Content.
We use Submitted Content for one purpose only: to produce the translation you requested. Our server holds it in memory while the request is being processed and does not write it to persistent storage. Once the result has been returned, the copy on our server is discarded.
When you use real-time ("conversation") voice translation, the app first requests a short-lived token from our server, then connects directly to a third-party AI speech service to stream your audio for translation. In this mode your audio is sent to that third-party service, not through our server. Withdrawing cloud consent disconnects any active session immediately.
To operate the cloud service, enforce the free usage limit, and protect against abuse, our server and our infrastructure provider record limited technical data with each cloud request:
| What | Why | Retention |
|---|---|---|
| A random device identifier generated by the App | Counting how many free requests this device has made; applying a cached result. | Rolling daily counters are deleted after 24 hours. The identifier itself stays on your device and is regenerated if you reinstall the App. |
| The IP address your request came from, and standard request metadata (time, endpoint, approximate region, error codes) | Delivering the response, rate limiting, diagnosing faults, and blocking abuse. | Up to 30 days as infrastructure log data, then deleted. |
| App and iOS version, device model, and interface language | Compatibility, crash diagnosis, and serving the correct interface language. | Up to 30 days. |
| A one-way hash of the submitted content | Recognising a repeat request so we can return a cached result instead of calling the AI provider again — this is what makes repeat lookups instant. | Cached results are deleted after 24 hours. The hash cannot be reversed to reconstruct your content. |
These technical logs exist only for cloud requests. In offline mode, no such data is transmitted. The device identifier is not an advertising identifier and is not used to build a profile of you. We do not collect your precise location, your contacts, your photo library beyond the specific image you choose, your health data, or your advertising identifier. We do not run third-party analytics or advertising SDKs.
Subscriptions and other in-app purchases are processed by Apple. We never see or store your payment card details. We receive only a confirmation that a purchase is active, tied to your Apple account, so the App can unlock the features you paid for. Apple's handling of that transaction is governed by Apple's Privacy Policy.
Translation history, saved phrases, settings, and your language preferences are stored locally on your device. They are not uploaded to us. Deleting the App removes them.
You can withdraw any of these permissions at any time in iOS Settings; the corresponding feature will simply stop working.
Where the GDPR applies, we rely on the following legal bases:
We work with a small number of third-party categories. For each of them, we require the recipient to provide the same or equal protection of your information as described in this policy, and to use it only to deliver the service you asked for:
| Recipient | What it receives | Purpose |
|---|---|---|
| Third-party AI model / speech providers | Submitted Content — the photo, text, or transcribed speech, plus the target language; for live voice, the audio stream itself. | Performing the actual translation and explanation. These providers act as our data processors and may process this content outside your country. |
| Cloud infrastructure and hosting providers | IP address and standard request metadata; transient access to Submitted Content while a request is routed. | Hosting and operating the API that the App talks to. |
| Apple | Purchase records, and any content you send us by email or in a review. | Processing in-app purchases; distributing the App. |
We may also disclose information if we are legally required to do so, or where necessary to protect the rights, safety, or property of any person. We do not sell your personal information, and we do not share it for cross-context behavioural advertising.
Traffic between the App and our server is encrypted with TLS. Access to our production systems is restricted to the developer, and API credentials are held as encrypted secrets rather than in the App binary where they would be extractable. Translation caches are keyed by a one-way hash rather than by your content. No system is perfectly secure, but we have deliberately kept the amount of data we hold small — the strongest protection available is not retaining what we do not need.
Depending on where you live, you may have the right to know what information we hold about you, to access it, to correct it, to delete it, to restrict or object to its processing, to receive it in a portable format, and to complain to your local supervisory authority. Under California law you also have the right to opt out of the sale or sharing of personal information — and, as stated above, we do not sell or share it in the first place.
Sonder is suitable for users of all ages and does not require an account. In its default offline mode no personal data is transmitted at all. If you are under the minimum age of digital consent in your country, please use the App with the permission of a parent or guardian. We do not knowingly collect personal data from children; if a parent or guardian believes a child submitted content through cloud processing, contact us and we will delete it. We comply with COPPA and the GDPR.
If we change how the App handles information, we will update this page and revise the date at the top. For a material change — for example, if we ever began storing Submitted Content — we would give clear notice inside the App before the change took effect, and where required we would ask for your consent first.
Questions, requests, or complaints about privacy: support@sonder.app.