Home / Privacy Policy
Privacy Policy
1. The short version
- We collect as little as we can: mainly your email, your plan and your lead preferences.
- No passwords. You sign in with a code we email you.
- No card details. Stripe (sold through Link) handles payments.
- Limited ad measurement. We count visits without cookies, we keep anonymous daily page-visit counts, and Google Ads cookies measure whether our ads work (section 12). If you sign up after clicking an ad, we keep the ad's source labels with your account (section 3). We never send Google your name or email. We don't sell your data.
- Paid files and pages carry marks that trace leaks to an account. See section 5.
- Texts are optional. If you add a phone number, we use it only for watch alerts you turn on. See section 13.
- Marketing emails only with your consent. If you never chose, you're not signed up. See "Marketing emails" in section 3.
- You can see, export, correct and delete your data anytime.
2. Who we are
FedSonar is operated by Cristian Andrade, a sole proprietor doing business as FedSonar, based in Vancouver, BC, Canada. In this policy, "we" means FedSonar.
- Address: FedSonar, 329 Howe St, Unit #200, Vancouver, BC V6C 3N2, Canada
- Privacy contact: hello@fedsonar.com
- Person responsible for privacy: Cristian Andrade, hello@fedsonar.com
FedSonar is not affiliated with the US government. We use public US government data from SAM.gov, USASpending.gov and Grants.gov.
3. What we collect and why
Account and plan
| What | Why |
|---|---|
| Email address | Sign-in codes, your account, receipts and notices, and alerts you ask for |
| Your name and company name (optional) | Only if you give them to us. We don't ask for them when you sign up |
| Plan (Free, Lead Pack, Pro) | To give you the right access |
| Stripe customer id and subscription status | To link your payment to your access |
| Order and refund records (order id, refund count) | Access, and blocking repeat refunds |
Visit counts and ad source
| What | Why |
|---|---|
| Daily visit counts: a tally per day of page views by page group (for example home, search, pricing, sign-up), by country (a coarse label from Cloudflare), whether the address carried a Google ad click id, and whether the visit was our own team testing. Visits from the EEA, the UK and Switzerland are counted too, without any ad source data. The tally is counts only: no IP address, browser details, cookie or identifier is stored with it. To stop abuse, a temporary limit counter is kept for up to about an hour under a keyed hash of your IP address (a one-way code made with a secret key, not the address itself) and then deleted | To see which pages and ads work |
| Ad source (only if you arrive on an address that carries them): the Google ad click id (gclid) and the campaign labels utm_source, utm_medium, utm_campaign, utm_term and utm_content. We check they are short and plain, keep them in your browser tab until you sign up (never in a cookie), then save them once on your account and add them to your Stripe Checkout as order labels. We try not to collect them in the EEA, the UK or Switzerland: our website skips them when your browser's time zone looks European, and our server saves nothing when Cloudflare's country for your connection is in those places or can't be told. These checks can be wrong, for example with a VPN or unusual settings | To measure which ads lead to sign-ups and purchases |
Your preferences
| What | Why |
|---|---|
| Categories, NAICS codes, set-asides, states | To show and send leads that fit you |
| Saved leads (Pro): the notices you save, their stage, your Notify me setting and alert channel | To track saved leads and send the alerts you turn on |
| Saved searches | To run your searches and alerts |
| Reminder log (which due-soon reminders were sent, 7 days and 48 hours before the deadline, and which question-deadline reminders were sent, 3 days and 1 day before questions are due) | So each reminder is sent once |
Sign-in and security
| What | Why |
|---|---|
| Sign-in tokens (stored only in scrambled, hashed form) | To sign you in with an email code |
| Session records | To keep you signed in and enforce the 3-session limit |
| A coarse device hash | To spot a new device and ask for a fresh sign-in. Built only from your browser's user-agent (browser family, platform, and mobile or desktop). We store only the hash, not the user-agent. |
| IP address (for abuse checks) | Rate limits, spam and attack prevention. Kept 7 days. |
| Terms acceptance log (version and time) | Proof that you accepted our Terms |
| Download log | Your download history, and checks for sharing or scraping |
| Abuse signals and evidence | To look into sharing, scraping or leaks |
Text messages (only if you opt in)
| What | Why |
|---|---|
| Mobile phone number | To send watch alerts you turn on |
| SMS consent record: time, page version, the exact consent wording you saw, and the number | Proof that you agreed to texts |
| STOP / opt-out record (time and number) | So we never text you again after you reply STOP |
Our server logs don't contain emails, sign-in tokens or full IP addresses. They record a hashed user id and the page or feature used.
What we don't collect
- No passwords. There are none.
- No card or bank details. Those stay with Stripe and Link.
- No ad or tracking profiles.
- No IP history beyond the 7-day abuse window.
Marketing emails
We don't send a newsletter. The only marketing email we may send is a one-time "What Pro would have caught" email after you buy a Lead Pack.
We send it only if:
- you turned marketing emails on yourself in account settings (we record that choice and when you made it), or
- you bought a paid Lead Pack in the last 2 years (implied consent under Canada's anti-spam law, CASL). A $0 staff order or a refunded pack doesn't count.
If you never made a choice, you're not signed up. Turning marketing emails off, or any one-click unsubscribe, stops marketing emails even if you bought a pack. This doesn't affect service emails: sign-in codes, receipts, security notices, the alerts, due-soon reminders and question-deadline reminders you turned on, and the saved-leads deletion warning (section 10).
We don't track whether you open our emails or click their links (open and click tracking is turned off).
4. Contact details in government notices
SAM.gov notices often include the name, email or phone of a government contracting officer.
- We show these details only as part of that notice, the same way SAM.gov does.
- We don't build a contact database, and we don't sell, search, or market to these contacts.
- Once a notice closes, we hide its contact details.
5. Leak tracing marks (please read)
To protect paid content, paid files and pages carry marks that can trace a leak back to an account.
- Paid CSV files have:
- a visible license column that says the file is licensed to your order (shown as a code, not your name or email), and
- per-buyer identifiers (fingerprints): a reference code on each row, and small differences in how our own fields are presented (such as tag order or one of several equally accurate summary wordings).
- Paid pages show a faint watermark with a short account code (for example "FS-7K3Q"). It never shows your email.
- We keep a private link between each code and your order or account.
The marks never change government facts, and every buyer gets the same leads.
Why: if a paid file or screenshot is posted or resold, we can find which account it came from and enforce our Terms. Our legitimate interest is protecting the service our paying users rely on.
We also search the public web and X each week for copies of FedSonar files or text.
6. Abuse monitoring
- Each day, software scores account activity for signs of sharing or scraping. Examples: more than 2 devices in use at the same time, unusual download or search volume, and bot-like patterns.
- An IP or country change on its own never counts against you.
- Account suspensions and bans are never automatic. Our operations team triages every flag, and a person, the owner of FedSonar, must approve before any suspension or ban.
- Unusually high download activity is flagged for review. There is no hard cap.
- Internal alerts use the account code and a hashed id. Your email is shown only when a reviewer opens the case.
One block is automatic: after 2 or more refunds on one account or email, new $7 Lead Pack purchases are blocked automatically, and our team gets an alert to review it. Other limits that apply automatically are speed limits, the 3-session limit, and removing access after a refund. None of these ban your account.
7. Legal reasons for using your data
Canada (PIPEDA). We collect, use and share personal information with your consent, for the purposes in this policy. Using the service means you consent to the uses needed to run it. You can withdraw consent, but we may then be unable to provide the service.
If you're in the EU, UK or a similar place, our legal bases are:
- Contract: running your account, sign-in, purchases and alerts.
- Legitimate interests: security, preventing abuse and scraping, leak tracing marks, and enforcing our Terms.
- Legal obligation: keeping records the law requires.
- Consent: marketing emails (in Canada, express or implied consent under CASL; see section 3). You can unsubscribe anytime.
If you're in California or another US state with a privacy law, you have rights to know, access, delete and correct your data. We don't sell or "share" personal information for cross-context behavioural advertising.
8. Who we share data with (processors)
We use these services to run FedSonar. They process data for us, under their own terms.
| Service | What it does | Data it handles |
|---|---|---|
| Cloudflare | Hosting, database, file storage, security, Turnstile (bot check), Web Analytics (visit counts) | All account data; IP addresses for security |
| Stripe (Managed Payments, sold through Link) | Checkout, payments, sales tax/VAT/GST, fraud checks, disputes, receipts and invoices, and purchase support (merchant of record); the billing portal | Email, name, billing address and payment details you give it; what you bought and refund or dispute status |
| Spacemail | Our hello@fedsonar.com inbox | Emails you send us |
| Twilio | Sends text messages (watch alerts) and receives STOP/HELP replies | Your phone number and the text of each message |
| Resend (resend.com) | Sends sign-in codes, receipt-related notices and alert emails | Your email address and the message contents |
Stripe is the merchant of record for your purchase (shown as "Sold through Link"). Stripe and Link are responsible for the payment data they collect, and their own privacy policies apply to it. We get back only what we need to give you access: your Stripe customer id, what you bought, and whether a payment was refunded or disputed.
We don't sell your data. We share it only (and never your SMS opt-in data for marketing, see section 13):
- with the processors above,
- if the law requires it (for example a valid court order), or
- if the business is sold or reorganized, under this policy.
9. Where your data is stored (international transfers)
We're based in Canada. Our processors may store or process data in the United States and other countries where they operate. Data there may be accessible to that country's authorities under its laws.
10. How long we keep data
When you delete your account, everything is fully deleted within 7 days, except a minimal record kept for the period shown below and then deleted:
| Minimal record kept after deletion | What it holds | How long |
|---|---|---|
| Terms acceptance log | Terms version, date and time, hashed account id (and the date the account was deleted) | 6 years |
| Repeat-refund flag | A hashed email and the refund count only | 2 years from the refund |
| SMS consent and STOP record | Time, page version, consent wording, hashed number | 5 years |
| Marketing consent record | Your choice (opt-in or opt-out), when you made it, and a hashed account id. Kept only if you made a choice. | 2 years |
Abuse signals and alerts about your account are deleted with it. Each period above runs from when the account is fully deleted (the refund flag's from the refund), and the record is deleted automatically when it ends.
| Data | How long |
|---|---|
| Account, plan, preferences | While your account is open. Deleted within 7 days of your deletion request. |
| Saved leads, their stages, saved searches and the reminder log | While you have Pro. If Pro ends, they're locked and kept 90 days, then deleted. We send one warning email 7 days before (on day 83), and they're never deleted sooner than 7 days after that email. If your address can't receive our email (for example it bounced or was blocked), the deletion still goes ahead on schedule, without the warning. Rejoining Pro before then cancels the deletion and everything comes back. If you delete your account, they're deleted right away, with no 90-day wait. |
| Marketing consent record (your choice and when) | While your account is open, and kept as proof of consent for 2 years after it ends (the CASL implied-consent window; Clio, Oct 18, for now). |
| Mobile phone number | Until you remove it, or within 7 days of account deletion |
| Email sign-in codes | Deleted when used. An unused code can't be used after 10 minutes and is deleted about a day later. |
| Sessions | Up to 30 days. Ended after 7 days idle, on sign-out, or on account deletion. The record of an ended session (with its device hash) is deleted 90 days after the sign-in. |
| Coarse device hash | 90 days |
| IP addresses (abuse checks) | 7 days |
| Abuse signals and alerts | 90 days, then deleted, or sooner when you delete your account |
| Download log | 1 year |
| Daily visit counts | About 13 months, then deleted. They hold no personal data |
| Anti-abuse limit for the visit counter (a keyed hash of your IP address) | Up to about 1 hour, then deleted |
| Ad source labels | While your account is open. Deleted within 7 days of your deletion request. Stripe keeps its own copy of order labels under its own policy |
| Emails to hello@fedsonar.com | 2 years |
| Backups | Deleted data is removed from backups within 30 days |
Stripe and Link keep their own payment and tax records under their own policies.
11. Your rights
You can:
- Access your data: see what we hold about you.
- Export your data: download it from your account page. It includes any saved-leads deletion clock, but never a secret, code or key.
- Correct your data: update it in your account, or ask us.
- Delete your account: from your account page or by email. We delete everything within 7 days, except the minimal record in section 10.
- Unsubscribe from emails: every alert and marketing email has a one-click unsubscribe. The one warning before locked saved leads are deleted (section 10) is a service email, so it's sent even if you unsubscribed.
- Stop texts: reply STOP to any text, or remove your number in account settings.
- Withdraw consent or object to some uses.
- Complain to a privacy regulator. In Canada, that's the Office of the Privacy Commissioner of Canada.
To ask, email hello@fedsonar.com. We may need to confirm it's you, usually by email sign-in. We'll reply within 30 days.
Changing your email address needs a fresh sign-in, and we send a notice to your old address.
12. Cookies
We use essential cookies: a session cookie that keeps you signed in and a short-lived security cookie that protects forms. They're strictly necessary for the service to work, and they aren't used for anything else.
Advertising measurement (Google Ads). When you arrive from a Google ad, Google Ads may set cookies (such as _gcl_au) and receives the page address, an ad click id and, when you sign up or buy, a conversion event with the order value and Stripe order id. We don't send Google your name or email. Visitors in the EEA, the UK and Switzerland get these cookies denied by default. Google's use is described at policies.google.com/technologies/ads; you can opt out at adssettings.google.com or by blocking cookies in your browser. Apart from Google Ads, we don't use any advertising or tracking cookies.
We use Cloudflare Web Analytics to count visits. It is cookieless and collects only the page address, referrer and basic browser details, which Cloudflare reports to us as aggregate visitor statistics; it does not track you across sites.
Ad source labels (only if you arrive on an address that carries them) are kept in your browser's session storage (cleared when you close the tab), not in cookies. Our team marks its own test browsers with a small local-storage flag so our visits are not counted as yours; visitors do not get it. If your browser's time zone looks European (the EEA, the UK or Switzerland), our script does not read or write anything on your device and only sends the anonymous visit count. That check is a guess from the time zone and can be wrong, for example with a VPN or unusual settings. The visit count itself stores nothing on your device.
- Cookies set by our security check (Cloudflare Turnstile) and our payment provider (the Stripe Checkout page and Link): strictly necessary, used only for bot protection and taking payment.
We don't show a cookie banner. Google Ads cookies are off by default for visitors in the EEA, the UK and Switzerland, and anyone can opt out as described above.
13. Text messages (SMS)
Texts are optional. You opt in by adding your mobile number and ticking an unticked consent box in account settings or when you set up a watch alert.
- What we send: "Watch this notice" alerts when a notice you watch changes. We never send sign-in codes by text.
- How often: alerts vary, up to 5 alert texts a day. US mobile numbers only at launch; Canadian numbers come in v1.1.
- Message and data rates may apply. Reply STOP to cancel, HELP for help, or email hello@fedsonar.com.
- We do not sell or share your SMS opt-in data or personal information with third parties for marketing purposes.
- The sharing in section 8 does not include SMS opt-in data or consent. Your number goes only to Twilio, which sends our texts for us, and only to deliver those texts.
- We keep a record of your consent (time, page version, the consent wording and your number) and of any STOP, so we can prove consent and never text you after you opt out. See section 10.
- Full program terms: SMS Terms in our Terms of Service (section 25).
14. Children
FedSonar is a business service and is not for anyone under 18. We don't knowingly collect data from children. If you think a child has given us data, email hello@fedsonar.com and we'll delete it.
15. How we keep data safe
- HTTPS everywhere.
- No passwords to steal. Email sign-in codes are single-use, expire in 10 minutes, and are stored only as hashes.
- Secure, signed session cookies.
- Account data is reached only through our server, never directly from the browser.
- Logs leave out emails, tokens and full IP addresses.
- Keys and secrets are kept in encrypted storage, not in our code.
- Rate limits and bot checks on sign-in and sign-up.
No system is perfectly secure, but we work to protect your data.
16. If there's a data breach
If a breach creates a real risk of significant harm to you, we'll:
- tell you as soon as we can, with what happened and what you can do,
- report it to the Privacy Commissioner of Canada and any other regulator as the law requires, and
- keep a record of the breach.
17. Changes to this policy
We may update this policy. If a change is important:
- we'll email you at least 14 days before it takes effect, and
- we may ask you to accept the new version with a click, as with our Terms (Terms section 22).
If you don't agree, you can stop using FedSonar and delete your account before the change takes effect.
The version number and date at the top always show the current policy. Past versions are kept in a public archive.
Version 1.4.3 (October 24, 2026): we describe our anonymous daily visit counts (which include visits from Europe, counted without any ad source data), the short-lived anti-abuse limit behind them, and the ad source labels we keep when you sign up from an ad, with how we try to skip them in the EEA, the UK and Switzerland (sections 1, 3, 10 and 12); we no longer ask for your name or company at sign-up (section 3); and we removed the newsletter and beehiiv text (sections 3, 7, 8, 10 and 11), because we don't send a newsletter or use beehiiv. No other changes.
Version 1.4.1 (October 23, 2026): added question-deadline reminders: if you turn on Notify me for a saved lead, we can also email you 3 days and 1 day before questions are due, and we keep a log of which of these reminders were sent (section 3). We also added Grants.gov as a data source (section 2). No other changes. Read version 1.4.1.
Version 1.4 (October 21, 2026): we added Google Ads conversion measurement and its cookies (section 12, and the summary at the top). The Terms move to 1.4 with it, and you'll be asked to accept them once at your next sign-in. No other changes. Read version 1.4.
Version 1.3 (October 21, 2026): Stripe (sold through Link) replaces Lemon Squeezy as merchant of record and payment processor. We store your Stripe customer id instead of a Lemon Squeezy one. The $7 Lead Pack credit and its discount codes are removed. Read version 1.3.
Version 1.2.3 (October 18, 2026): two-step sign-in is off for everyone, so we removed what this policy said about it (authenticator secrets, backup codes, passkeys and the two-step sign-in log, and its exception to our IP rule). We also now list both of our essential cookies: a session cookie and a short-lived security cookie that protects forms. No other changes. Updated October 19, 2026: we added cookieless Cloudflare Web Analytics (visit counts only; section 12 and the processors table).
Version 1.2.2 (October 18, 2026): sign-in wording only: you sign in with a code we email you, not a link. No other changes.
Version 1.2.1 (October 18, 2026): added that we collect your name and company name at sign-up. No other changes.
18. Contact
Privacy contact: Cristian Andrade, hello@fedsonar.com
FedSonar, 329 Howe St, Unit #200, Vancouver, BC V6C 3N2, Canada. Operated by Cristian Andrade, a sole proprietor doing business as FedSonar.