Privacy Policy
This Privacy Policy explains what Rioa, LLC ("Rioa", "we", "us") collects when you use the Sonr desktop application, the getsonr.com website, and the Sonr license service (together, "Sonr"), how we use it, and the choices you have. Sonr is designed to keep your data on your own computer wherever possible.
1. Summary
- Sonr runs on your Mac. Your watchlists, settings, trade journal, and strategy state are stored locally, not on our servers.
- When you sign in with Alpaca, your brokerage credentials never pass through Sonr. The access token Alpaca issues is handed to your Mac through our server once, encrypted, and deleted from our server within ten minutes. After that it lives only in your macOS Keychain.
- Our license service stores the minimum needed to run your subscription: your email, license key, plan, and device activations. Payments are handled by Stripe.
- We do not sell personal information, and we do not use advertising trackers.
2. Information we collect
| Category | What | Where it lives |
|---|---|---|
| Account and license | Email address, license key, plan, subscription status, device activation identifiers, purchase dates | Sonr license service (Cloudflare, United States) and Stripe |
| Payment | Card and billing details | Stripe only. Rioa never receives your full card number. |
| Brokerage connection | OAuth access token issued by Alpaca; which Alpaca environments (live, paper) it covers; a masked account number for display | Your macOS Keychain. The token transits our server encrypted for at most ten minutes during sign-in and is then deleted. |
| Brokerage data | Account balances, positions, orders, and fills retrieved from your broker to show in Sonr and to place orders | Your Mac. Not sent to Rioa. |
| App data | Watchlists, scanner settings, chart-pattern results, trade journal, strategy settings and logs | Your Mac. |
| Service logs | IP address, timestamps, request paths, and error codes for requests to the license and sign-in services | Cloudflare, retained briefly for security and debugging |
| Support | Whatever you send us when you contact support | Our email |
Sonr does not currently collect analytics or crash reports from the app. If we add them, they will be described here and you will be able to turn them off.
3. How we use information
- To issue, verify, and renew licenses and to prevent license sharing.
- To connect Sonr to your brokerage account when you ask it to, and to place orders at your direction.
- To operate, secure, and debug the Sonr services.
- To respond to support requests and send service notices such as receipts, renewal reminders, and security notices. We do not send marketing email without your consent.
- To comply with law.
4. Brokerage access in detail
Sonr connects to Alpaca using OAuth ("Sign in with Alpaca"). You enter your Alpaca login on Alpaca's website, never in Sonr. Alpaca then issues Sonr an access token with the "trading" and "data" scopes, which lets Sonr read your account information and market data and place and manage orders. Sonr cannot change your Alpaca login, bank links, or account settings. Sonr does not store your Alpaca password or API keys on our servers at any time.
You can revoke Sonr's access by clicking Disconnect in Sonr (which deletes the token from your Mac) and by removing Sonr from the connected apps in your Alpaca dashboard (which invalidates the token at Alpaca).
5. Sharing
We share information only with service providers that help us run Sonr, each bound to use it only for that purpose: Stripe (payments), Cloudflare (hosting for the license and sign-in services), Alpaca (your broker, which receives the orders you direct), and market-data providers (which receive only the symbols being requested). We may also disclose information to comply with law, to enforce our Terms, or to protect the rights and safety of Rioa, our users, or others. If Rioa is acquired, information may transfer to the successor under this policy.
6. Retention
- License records: for the life of your subscription plus the period required for tax and accounting records.
- OAuth sign-in sessions on our server: deleted when the token is collected by your Mac or after ten minutes, whichever comes first.
- Service logs: a short rolling window.
- Data on your Mac: until you delete it or uninstall Sonr.
7. Security
The license and sign-in services use HTTPS only. Tokens held briefly on our server are encrypted at rest with a key stored outside the database. On your Mac, broker tokens and API keys are stored in the macOS Keychain, and the Sonr background service only accepts requests from the Sonr app. No system is perfectly secure; please keep your Mac and Alpaca login protected.
8. Your choices and rights
You can view and delete everything Sonr stores on your Mac by deleting it from the app or removing the app's data folder. You can ask us to access, correct, delete, or export the information we hold about you, or to close your account, by emailing hello@rioa.xyz. Residents of California, the European Economic Area, the United Kingdom, and other jurisdictions with privacy laws may have additional rights, including the right to lodge a complaint with a supervisory authority; we honor those rights for everyone. We do not discriminate against you for exercising them.
9. Children
Sonr is for adults with brokerage accounts. We do not knowingly collect information from anyone under 18.
10. International users
Our services are operated from the United States. If you use Sonr from elsewhere, your information will be processed in the United States.
11. Changes
We will post updates to this policy at getsonr.com/privacy with a new effective date and will notify you in Sonr or by email of material changes.
12. Contact
Rioa, LLC · hello@rioa.xyz