Privacy, with clear boundaries.
Updated October 26, 2026.
Website audits
Sonar fetches public HTTPS pages you request, respects the observed robots rules and retains extracted metadata, links, checks and response timing. We do not forward your login cookies to audited sites. Audit data is private to the Sonar session or account that created it. Reports are kept for up to 30 days, subject to shared free storage limits.
Accounts and domain claims
Sonar accounts are independent of Pactuno login. We store your username, email, a salted scrypt password hash and account version until account deletion. Plaintext passwords are never stored. Login uses username/email and password; there is no MFA enrollment. Session-token hashes expire after 7 days; tokens are delivered in Secure, HttpOnly cookies. Email verification is separate and only required for business-domain features. Verification/reset links are random, hashed at rest, single-use and expire in 30 minutes. Transactional email is delivered through Resend when requested. Connected-domain records and exclusive organization claims remain until released or deleted. Claiming requires a verified matching business email and a public verification file.
Domain reclaim requests
Preparing a reclaim draft stores a private reference, your verified business email and the company details you provide for up to 30 days. The app does not send an email automatically or transfer ownership. Send the draft from your matching company mailbox to support@pactuno.online. Personal-email requests are not processed. Support must review authority and fresh domain control; the email subject alone is not proof.
Optional private website traffic analytics
Verified business-domain administrators can install a consent-first cookieless tracker on public pages. It records public pathnames, referrer origins, coarse device class, server time and approximate Cloudflare country/city. It does not retain raw IPs, full user agents, query strings or persistent tracking cookies. A per-site, per-day HMAC supports approximate daily visitor counts; these are not monthly unique-person counts. Reports are private to the owning account and retained up to 30 days. Do Not Track, Global Privacy Control, consent, bot filters and shared service limits affect coverage. The owner can pause tracking, delete the site and its events, or delete workspace data. No earlier traffic is inferred. See the installation guide.
Optional Google Search Console connection
Google connection is separate from Sonar login and requests read-only Search Console permission. Sonar encrypts access/refresh tokens at rest with a server-side key. Reports may contain your property’s queries, landing pages, dates, countries, devices and search metrics. Cached reports expire after one hour and are private to your Sonar account. Disconnect deletes locally stored Google tokens, pending connection state and cached reports, and attempts to revoke Google access. You can also revoke access in your Google account. Workspace deletion removes local connection data. This data is not sold or used for AI training.
Browser-local imports
Search Console CSV, backlink CSV, content drafts and access/event logs are parsed in your browser tab. Their raw contents are not uploaded or stored in your Sonar account. Displayed log source IPs are masked and query strings are redacted. Closing the tab clears imported data.
Dependency advisory checks
Supported manifests are parsed locally. Only after explicit authorization, selected package names, ecosystems and exact versions are sent to Sonar and OSV to look up known advisories. Raw manifests, source code, credentials and secrets are not required. Private security results are retained for up to 30 days, subject to capacity limits.
Limited security checks
Owner-authorized checks read public response headers and send a few fixed HEAD requests. Secret file bodies are not downloaded. Results are possible indicators, not proof of exploitability or a breach. This is not continuous attack monitoring.
Public score badges
Creating a badge publishes the website origin, technical score, page-sample count, crawl date and badge expiry. Your email, account ID and private security report are not exposed by the public verification endpoint. Badges expire after 7 days and can be invalidated by a newer completed site crawl or a released domain claim.
Request limits and infrastructure
Hashed IP-derived time buckets support short-lived rate limiting. Cloudflare processes requests and hosts the application/database. Public DNS resolution uses Cloudflare's resolver. Google PageSpeed receives a requested public URL only when you run that tool. Standard provider access logs are subject to their policies.
Export and delete
Use a report's CSV/JSON export to download your data. History includes Delete my Sonar workspace data, which deletes your crawl reports, domain claims, badges, private security results and Sonar sessions. Your separate Sonar login account remains; contact support for an account-erasure request. Existing provider backups and operational logs may follow separate retention policies.