Privacy

The short version

Sonnet is a student hub made by one person, Eric Wei. What you put in it is private to your account unless you share a flashcard deck. It isn't sold, shared with advertisers or shown to your school. You can download everything or delete your account yourself in Settings → Data.

What Sonnet stores

• Your account: your email, your name if you give one, and a password hash (or your Google sign-in) kept by Supabase Auth.
• Your academic data: courses, assignments, exams, class times, grades, notes and links you add, your term dates and your Home layout.
• Files you upload: PDFs, documents, slides and photos, plus the text read out of them so Sonnet AI can use it.
• Sonnet AI: your chats, saved flashcard decks, and a usage log (what kind of request, the model, token counts and cost) used to apply weekly allowances and understand costs.
• Shared decks: if you share a flashcard deck, anyone with its link can read the deck's title and cards, signed in or not, until you delete the deck or your account.
• Focus timer: your focus sessions, so the heatmap and streak work.
• Canvas, if you connect it: your Canvas address and access token (the token is encrypted before it is stored) and, if you add it, your Canvas calendar link. Sonnet only reads from Canvas. You can disconnect in Sync, and you can revoke the token in Canvas any time.
• Your calendar feed: a secret link you can give to Google Calendar. Replace it in Sync and the old one stops working.
• Abuse limits: a short-lived count of how often you use costly features per hour.

In your browser, Sonnet keeps a sign-in session cookie and a few settings in local storage (for example the focus timer, whether you have seen the tour, and a quick note). There are no advertising or tracking cookies.

Who handles it

• Supabase stores the database, sign-in and uploaded files.
• Vercel hosts the app, so requests pass through it and it keeps ordinary server logs.
• OpenRouter and the AI model providers it routes to receive what you send to Sonnet AI. See the next section.
• Your email provider carries the sign-in and confirmation emails Supabase sends you.
• Google, only if you use Continue with Google, or add Sonnet's calendar feed to Google Calendar yourself.

These services run on their own terms and privacy policies. Sonnet doesn't sell your data.

What the AI sees

When you ask Sonnet AI something, Sonnet sends your message and the parts of your data it needs to answer (for example course names, deadlines, class times, grades, and text from a syllabus or material you ask about) to OpenRouter, which passes it to a model provider. Photos and files you attach to a message go too. If web search is used, the search query leaves Sonnet as well.

Sonnet uses a mix of free and paid models, and the mix changes. Providers set their own rules for logging prompts, and providers of free models may keep prompts and use them to improve their models. If that matters to you, don't put anything in your chats or materials that you wouldn't want a model provider to see. Sonnet AI is only called when you use it; nothing is sent in the background.

Your control

• Download: Settings → Data → Download my data gives you a JSON file of everything stored about you, except secrets. Uploaded files are listed in it, not included.
• Reset: clears your courses, files, chats and term dates but keeps your login.
• Delete: permanently deletes your login, files and every record. It happens immediately. Copies in provider backups, if any, are removed on the provider's own schedule. Logs kept by Vercel and AI providers follow their own retention.

Security

Data is encrypted in transit. Each account can read only its own rows, enforced in the database itself, and uploaded files sit in a private folder per account. No system is perfectly secure; if something affecting you goes wrong, Sonnet will tell you.

Students and schools

Sonnet is a tool you choose to use on your own. It isn't run by or connected to your school, and it doesn't share what you store with your school. Follow your school's rules about what you may upload and about Canvas access tokens.

Changes and contact

If this changes in a way that matters, Sonnet will say so in the app before it takes effect. Questions or requests: [contact email, to be added].