Sonar privacy policy
Sonar is a macOS app for App Store Connect analytics made by Michal Černý. This policy explains what data Sonar uses, what leaves your Mac, why, and what you can do about it.
In short
- Your App Store Connect data, API keys and app IDs stay on your Mac. Sonar downloads them directly from Apple and never sends them to me or anyone else.
- Usage statistics and crash reports (Google Firebase) are sent only if you allow them. Sonar asks once; you can change your choice anytime in Settings.
- Purchases go through Apple. RevenueCat tells the app whether you have Sonar Pro, under a random customer ID.
- No advertising, no tracking across apps or websites, no data sold.
1. Who is responsible
The controller is Michal Černý, sole trader registered in the Czech Trade Licensing Register, company ID (IČO) 07325312, Dukelská třída 632, 504 01 Nový Bydžov, Czech Republic, email sonar@cernym.com.
2. What stays on your Mac
- App Store Connect connection details you enter: issuer ID, key ID and the private key, stored in your Mac's Keychain.
- Short-lived App Store Connect tokens generated from them.
- Reports, app lists and other data downloaded from App Store Connect, cached locally so Sonar can show charts and comparisons.
- Your preferences, such as the selected app, chart boards and date ranges.
Sonar talks to Apple's App Store Connect API directly from your Mac. I never receive a copy of this data. Deleting Sonar and its connection in Settings removes it from your Mac.
3. What is sent, why and on what legal basis
Usage statistics (Google Analytics for Firebase) - only with your consent. Which screens and features you use (for example opening a chart, changing a date range, switching settings), app and macOS version, device model, language, approximate location derived from your IP address (country or city level) and a random app installation identifier. Never App Store Connect data, API keys, key file names, app names or app IDs. Purpose: to learn which features are used and what to improve. Legal basis: your consent (Art. 6(1)(a) GDPR). Recipient: Google Ireland Limited and Google LLC as my processor. Retention: event-level data according to the Google Analytics retention setting (at most 14 months), aggregated reports without identifiers remain.
Crash reports (Firebase Crashlytics) - only with your consent. A record of the crash or error (where in the app it happened), device model, macOS and app version, device state at the time and a random installation identifier. Purpose: to find and fix bugs. Legal basis: your consent (Art. 6(1)(a) GDPR). Recipient: Google Ireland Limited and Google LLC as my processor. Retention: 90 days.
Sonar Pro and purchases (Apple, RevenueCat). Payments are handled by Apple; I don't receive your name, Apple Account or payment details. RevenueCat, Inc. processes a random customer ID created by the app, App Store purchase data (product, price, currency, purchase and renewal dates, subscription status, storefront country), app and OS version and IP address, so that Sonar can unlock and restore Pro. Legal basis: performance of a contract (Art. 6(1)(b) GDPR). Recipients: RevenueCat, Inc. (USA) as my processor; Apple as an independent controller of payments. Retention: for as long as I run the app, because purchases are restored from these records; I will delete your record on request.
Support emails. If you write to me, I receive your email address and message, and the RevenueCat customer ID that Sonar pre-fills in the support email so I can look up your purchase (you can delete it before sending). Purpose: to answer you. Legal basis: legitimate interest in answering users and, for purchase issues, performance of a contract (Art. 6(1)(f) and (b) GDPR). Retention: 12 months after your issue is resolved.
4. Transfers outside the EU
Google LLC is certified under the EU-U.S. Data Privacy Framework (Commission Decision (EU) 2023/1795). RevenueCat, Inc. transfers data to the USA under the Standard Contractual Clauses (Commission Decision (EU) 2021/914) in its data processing agreement. I will send you a copy of the clauses on request.
5. Tracking and advertising
Sonar shows no ads, does not track you across apps or websites, does not use your data for advertising and does not sell or share it with data brokers.
6. Your choices and rights
- Statistics and crash reports: Settings → General → Privacy → Share usage statistics / Send crash reports. Withdrawing consent stops sending immediately and does not affect earlier processing.
- You have the right to access, rectification, erasure, restriction, portability and to object (Art. 15-21 GDPR). Statistics and crash reports are tied only to a random installation ID that Sonar does not show, so I cannot find them for a specific person (Art. 11 GDPR); they are deleted when the retention period ends.
- Purchase records and emails: write to sonar@cernym.com with your RevenueCat customer ID or the email you used, and I will reply within one month, free of charge.
- You can lodge a complaint with the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Prague 7, uoou.gov.cz, or with the supervisory authority in your EU country.
7. Version 1.0.0
Sonar 1.0.0 sent usage statistics and crash reports from the first launch without asking, and some events included a key file name or an app ID. Version 1.0.1 fixes this: nothing is sent before you allow it, and no event contains key file names or app IDs. Please update.
8. Changes
I update this policy when Sonar or the law changes. The effective date is at the top.
Contact
Michal Černý, sonar@cernym.com, Dukelská třída 632, 504 01 Nový Bydžov, Czech Republic.
Back to Sonar