Home / Privacy Policy
Privacy Policy
1. The short version
- We collect as little as we can: mainly your email, your plan and your lead preferences.
- No passwords. You sign in with a code we email you.
- No card details. Stripe (sold through Link) handles payments.
- Limited ad measurement. We count visits without cookies, and Google Ads cookies measure whether our ads work (section 12). We never send Google your name or email. We don't sell your data.
- Paid files and pages carry marks that trace leaks to an account. See section 5.
- Texts are optional. If you add a phone number, we use it only for watch alerts you turn on. See section 13.
- Marketing emails only with your consent. If you never chose, you're not signed up. See "Marketing emails" in section 3.
- You can see, export, correct and delete your data anytime.
2. Who we are
FedSonar is operated by Cristian Andrade, a sole proprietor doing business as FedSonar, based in Vancouver, BC, Canada. In this policy, "we" means FedSonar.
- Address: FedSonar, 329 Howe St, Unit #200, Vancouver, BC V6C 3N2, Canada
- Privacy contact: hello@fedsonar.com
- Person responsible for privacy: Cristian Andrade, hello@fedsonar.com
FedSonar is not affiliated with the US government. We use public US government data from SAM.gov and USASpending.gov.
3. What we collect and why
Account and plan
| What | Why |
|---|---|
| Email address | Sign-in codes, your account, receipts and notices, and alerts you ask for |
| Your name and company name | We collect these when you sign up, to set up your account and address emails to you |
| Plan (Free, Lead Pack, Pro) | To give you the right access |
| Stripe customer id and subscription status | To link your payment to your access |
| Order and refund records (order id, refund count) | Access, and blocking repeat refunds |
Your preferences
| What | Why |
|---|---|
| Categories, NAICS codes, set-asides, states | To show and send leads that fit you |
| Saved leads (Pro): the notices you save, their stage, your Notify me setting and alert channel | To track saved leads and send the alerts you turn on |
| Saved searches | To run your searches and alerts |
| Due-soon reminder log (which 7-day and 48-hour reminders were sent) | So each reminder is sent once |
Sign-in and security
| What | Why |
|---|---|
| Sign-in tokens (stored only in scrambled, hashed form) | To sign you in with an email code |
| Session records | To keep you signed in and enforce the 3-session limit |
| A coarse device hash | To spot a new device and ask for a fresh sign-in. Built only from your browser's user-agent (browser family, platform, and mobile or desktop). We store only the hash, not the user-agent. |
| IP address (for abuse checks) | Rate limits, spam and attack prevention. Kept 7 days. |
| Terms acceptance log (version and time) | Proof that you accepted our Terms |
| Download log | Your download history, and checks for sharing or scraping |
| Abuse signals and evidence | To look into sharing, scraping or leaks |
Text messages (only if you opt in)
| What | Why |
|---|---|
| Mobile phone number | To send watch alerts you turn on |
| SMS consent record: time, page version, the exact consent wording you saw, and the number | Proof that you agreed to texts |
| STOP / opt-out record (time and number) | So we never text you again after you reply STOP |
Our server logs don't contain emails, sign-in tokens or full IP addresses. They record a hashed user id and the page or feature used.
What we don't collect
- No passwords. There are none.
- No card or bank details. Those stay with Stripe and Link.
- No ad or tracking profiles.
- No IP history beyond the 7-day abuse window.
Newsletter and marketing emails
If you sign up for the free weekly issue, your email goes to beehiiv, our newsletter service.
We send marketing emails (the newsletter, and the one-time "What Pro would have caught" email after a Lead Pack) only if:
- you turned the newsletter on yourself in account settings (we record that choice and when you made it), or
- you bought a paid Lead Pack in the last 2 years (implied consent under Canada's anti-spam law, CASL). A $0 staff order or a refunded pack doesn't count.
If you never made a choice, you're not signed up. Turning the newsletter off, or any one-click unsubscribe, stops marketing emails even if you bought a pack. This doesn't affect service emails: sign-in codes, receipts, security notices, the alerts and due-soon reminders you turned on, and the saved-leads deletion warning (section 10).
We don't track whether you open the newsletter or click its links (open and click tracking is turned off).
4. Contact details in government notices
SAM.gov notices often include the name, email or phone of a government contracting officer.
- We show these details only as part of that notice, the same way SAM.gov does.
- We don't build a contact database, and we don't sell, search, or market to these contacts.
- Once a notice closes, we hide its contact details.
5. Leak tracing marks (please read)
To protect paid content, paid files and pages carry marks that can trace a leak back to an account.
- Paid CSV files have:
- a visible license column that says the file is licensed to your order (shown as a code, not your name or email), and
- per-buyer identifiers (fingerprints): a reference code on each row, and small differences in how our own fields are presented (such as tag order or one of several equally accurate summary wordings).
- Paid pages show a faint watermark with a short account code (for example "FS-7K3Q"). It never shows your email.
- We keep a private link between each code and your order or account.
The marks never change government facts, and every buyer gets the same leads.
Why: if a paid file or screenshot is posted or resold, we can find which account it came from and enforce our Terms. Our legitimate interest is protecting the service our paying users rely on.
We also search the public web and X each week for copies of FedSonar files or text.
6. Abuse monitoring
- Each day, software scores account activity for signs of sharing or scraping. Examples: more than 2 devices in use at the same time, unusual download or search volume, and bot-like patterns.
- An IP or country change on its own never counts against you.
- Account suspensions and bans are never automatic. Our operations team triages every flag, and a person, the owner of FedSonar, must approve before any suspension or ban.
- Unusually high download activity is flagged for review. There is no hard cap.
- Internal alerts use the account code and a hashed id. Your email is shown only when a reviewer opens the case.
One block is automatic: after 2 or more refunds on one account or email, new $7 Lead Pack purchases are blocked automatically, and our team gets an alert to review it. Other limits that apply automatically are speed limits, the 3-session limit, and removing access after a refund. None of these ban your account.
7. Legal reasons for using your data
Canada (PIPEDA). We collect, use and share personal information with your consent, for the purposes in this policy. Using the service means you consent to the uses needed to run it. You can withdraw consent, but we may then be unable to provide the service.
If you're in the EU, UK or a similar place, our legal bases are:
- Contract: running your account, sign-in, purchases and alerts.
- Legitimate interests: security, preventing abuse and scraping, leak tracing marks, and enforcing our Terms.
- Legal obligation: keeping records the law requires.
- Consent: the free newsletter and other marketing emails (in Canada, express or implied consent under CASL; see section 3). You can unsubscribe anytime.
If you're in California or another US state with a privacy law, you have rights to know, access, delete and correct your data. We don't sell or "share" personal information for cross-context behavioural advertising.
8. Who we share data with (processors)
We use these services to run FedSonar. They process data for us, under their own terms.
| Service | What it does | Data it handles |
|---|---|---|
| Cloudflare | Hosting, database, file storage, security, Turnstile (bot check), Web Analytics (visit counts) | All account data; IP addresses for security |
| Stripe (Managed Payments, sold through Link) | Checkout, payments, sales tax/VAT/GST, fraud checks, disputes, receipts and invoices, and purchase support (merchant of record); the billing portal | Email, name, billing address and payment details you give it; what you bought and refund or dispute status |
| beehiiv | Free weekly newsletter | Newsletter subscriber email |
| Spacemail | Our hello@fedsonar.com inbox | Emails you send us |
| Twilio | Sends text messages (watch alerts) and receives STOP/HELP replies | Your phone number and the text of each message |
| Resend (resend.com) | Sends sign-in codes, receipt-related notices and alert emails | Your email address and the message contents |
Stripe is the merchant of record for your purchase (shown as "Sold through Link"). Stripe and Link are responsible for the payment data they collect, and their own privacy policies apply to it. We get back only what we need to give you access: your Stripe customer id, what you bought, and whether a payment was refunded or disputed.
We don't sell your data. We share it only (and never your SMS opt-in data for marketing, see section 13):
- with the processors above,
- if the law requires it (for example a valid court order), or
- if the business is sold or reorganized, under this policy.
9. Where your data is stored (international transfers)
We're based in Canada. Our processors may store or process data in the United States and other countries where they operate. Data there may be accessible to that country's authorities under its laws.
10. How long we keep data
When you delete your account, everything is fully deleted within 7 days, except a minimal record kept for the period shown below and then deleted:
| Minimal record kept after deletion | What it holds | How long |
|---|---|---|
| Terms acceptance log | Terms version, date and time, hashed account id (and the date the account was deleted) | 6 years |
| Repeat-refund flag | A hashed email and the refund count only | 2 years from the refund |
| SMS consent and STOP record | Time, page version, consent wording, hashed number | 5 years |
| Marketing consent record | Your choice (opt-in or opt-out), when you made it, and a hashed account id. Kept only if you made a choice. | 2 years |
Abuse signals and alerts about your account are deleted with it. Each period above runs from when the account is fully deleted (the refund flag's from the refund), and the record is deleted automatically when it ends.
| Data | How long |
|---|---|
| Account, plan, preferences | While your account is open. Deleted within 7 days of your deletion request. |
| Saved leads, their stages, saved searches and the reminder log | While you have Pro. If Pro ends, they're locked and kept 90 days, then deleted. We send one warning email 7 days before (on day 83), and they're never deleted sooner than 7 days after that email. If your address can't receive our email (for example it bounced or was blocked), the deletion still goes ahead on schedule, without the warning. Rejoining Pro before then cancels the deletion and everything comes back. If you delete your account, they're deleted right away, with no 90-day wait. |
| Marketing consent record (your choice and when) | While your account is open, and kept as proof of consent for 2 years after it ends (the CASL implied-consent window; Clio, Oct 18, for now). |
| Mobile phone number | Until you remove it, or within 7 days of account deletion |
| Email sign-in codes | Deleted when used. An unused code can't be used after 10 minutes and is deleted about a day later. |
| Sessions | Up to 30 days. Ended after 7 days idle, on sign-out, or on account deletion. The record of an ended session (with its device hash) is deleted 90 days after the sign-in. |
| Coarse device hash | 90 days |
| IP addresses (abuse checks) | 7 days |
| Abuse signals and alerts | 90 days, then deleted, or sooner when you delete your account |
| Download log | 1 year |
| Newsletter subscription (beehiiv) | Until you unsubscribe or delete your account |
| Emails to hello@fedsonar.com | 2 years |
| Backups | Deleted data is removed from backups within 30 days |
Stripe and Link keep their own payment and tax records under their own policies.
11. Your rights
You can:
- Access your data: see what we hold about you.
- Export your data: download it from your account page. It includes any saved-leads deletion clock, but never a secret, code or key.
- Correct your data: update it in your account, or ask us.
- Delete your account: from your account page or by email. We delete everything within 7 days, including removing you from our beehiiv newsletter list, except the minimal record in section 10.
- Unsubscribe from emails: every alert and newsletter has a one-click unsubscribe. The one warning before locked saved leads are deleted (section 10) is a service email, so it's sent even if you unsubscribed.
- Stop texts: reply STOP to any text, or remove your number in account settings.
- Withdraw consent or object to some uses.
- Complain to a privacy regulator. In Canada, that's the Office of the Privacy Commissioner of Canada.
To ask, email hello@fedsonar.com. We may need to confirm it's you, usually by email sign-in. We'll reply within 30 days.
Changing your email address needs a fresh sign-in, and we send a notice to your old address.
12. Cookies
We use essential cookies: a session cookie that keeps you signed in and a short-lived security cookie that protects forms. They're strictly necessary for the service to work, and they aren't used for anything else.
Advertising measurement (Google Ads). When you arrive from a Google ad, Google Ads may set cookies (such as _gcl_au) and receives the page address, an ad click id and, when you sign up or buy, a conversion event with the order value and Stripe order id. We don't send Google your name or email. Visitors in the EEA, the UK and Switzerland get these cookies denied by default. Google's use is described at policies.google.com/technologies/ads; you can opt out at adssettings.google.com or by blocking cookies in your browser. Apart from Google Ads, we don't use any advertising or tracking cookies.
We use Cloudflare Web Analytics to count visits. It is cookieless and collects only the page address, referrer and basic browser details, which Cloudflare reports to us as aggregate visitor statistics; it does not track you across sites.
- Cookies set by our security check (Cloudflare Turnstile) and our payment provider (the Stripe Checkout page and Link): strictly necessary, used only for bot protection and taking payment.
We don't show a cookie banner. Google Ads cookies are off by default for visitors in the EEA, the UK and Switzerland, and anyone can opt out as described above.
13. Text messages (SMS)
Texts are optional. You opt in by adding your mobile number and ticking an unticked consent box in account settings or when you set up a watch alert.
- What we send: "Watch this notice" alerts when a notice you watch changes. We never send sign-in codes by text.
- How often: alerts vary, up to 5 alert texts a day. US mobile numbers only at launch; Canadian numbers come in v1.1.
- Message and data rates may apply. Reply STOP to cancel, HELP for help, or email hello@fedsonar.com.
- We do not sell or share your SMS opt-in data or personal information with third parties for marketing purposes.
- The sharing in section 8 does not include SMS opt-in data or consent. Your number goes only to Twilio, which sends our texts for us, and only to deliver those texts.
- We keep a record of your consent (time, page version, the consent wording and your number) and of any STOP, so we can prove consent and never text you after you opt out. See section 10.
- Full program terms: SMS Terms in our Terms of Service (section 25).
14. Children
FedSonar is a business service and is not for anyone under 18. We don't knowingly collect data from children. If you think a child has given us data, email hello@fedsonar.com and we'll delete it.
15. How we keep data safe
- HTTPS everywhere.
- No passwords to steal. Email sign-in codes are single-use, expire in 10 minutes, and are stored only as hashes.
- Secure, signed session cookies.
- Account data is reached only through our server, never directly from the browser.
- Logs leave out emails, tokens and full IP addresses.
- Keys and secrets are kept in encrypted storage, not in our code.
- Rate limits and bot checks on sign-in and sign-up.
No system is perfectly secure, but we work to protect your data.
16. If there's a data breach
If a breach creates a real risk of significant harm to you, we'll:
- tell you as soon as we can, with what happened and what you can do,
- report it to the Privacy Commissioner of Canada and any other regulator as the law requires, and
- keep a record of the breach.
17. Changes to this policy
We may update this policy. If a change is important:
- we'll email you at least 14 days before it takes effect, and
- we may ask you to accept the new version with a click, as with our Terms (Terms section 22).
If you don't agree, you can stop using FedSonar and delete your account before the change takes effect.
The version number and date at the top always show the current policy. Past versions are kept in a public archive.
Version 1.4 (October 21, 2026): we added Google Ads conversion measurement and its cookies (section 12, and the summary at the top). The Terms move to 1.4 with it, and you'll be asked to accept them once at your next sign-in. No other changes.
Version 1.3 (October 21, 2026): Stripe (sold through Link) replaces Lemon Squeezy as merchant of record and payment processor. We store your Stripe customer id instead of a Lemon Squeezy one. The $7 Lead Pack credit and its discount codes are removed.
Version 1.2.3 (October 18, 2026): two-step sign-in is off for everyone, so we removed what this policy said about it (authenticator secrets, backup codes, passkeys and the two-step sign-in log, and its exception to our IP rule). We also now list both of our essential cookies: a session cookie and a short-lived security cookie that protects forms. No other changes. Updated October 19, 2026: we added cookieless Cloudflare Web Analytics (visit counts only; section 12 and the processors table).
Version 1.2.2 (October 18, 2026): sign-in wording only: you sign in with a code we email you, not a link. No other changes.
Version 1.2.1 (October 18, 2026): added that we collect your name and company name at sign-up. No other changes.
18. Contact
Privacy contact: Cristian Andrade, hello@fedsonar.com
FedSonar, 329 Howe St, Unit #200, Vancouver, BC V6C 3N2, Canada. Operated by Cristian Andrade, a sole proprietor doing business as FedSonar.