Home / Privacy Policy
Privacy Policy
FedSonar is operated by Cristian Andrade.
1. The short version
- We collect as little as we can: mainly your email, your plan and your lead preferences.
- No passwords. You sign in with an email link.
- No card details. Lemon Squeezy handles payments.
- No ad tracking. No analytics planned. We don't sell your data.
- Paid files and pages carry marks that trace leaks to an account. See section 5.
- Texts are optional. If you add a phone number, we use it only for sign-in codes and watch alerts. See section 13.
- You can see, export, correct and delete your data anytime.
2. Who we are
FedSonar is run by Farsonar, based in Vancouver, BC, Canada. In this policy, "we" means FedSonar.
- Address: FedSonar, 329 Howe St, Unit #200, Vancouver, BC V6C 3N2, Canada
- Privacy contact: hello@fedsonar.com
- Person responsible for privacy: FedSonar Privacy Officer, hello@fedsonar.com
FedSonar is not affiliated with the US government. We use public US government data from SAM.gov and USASpending.gov.
3. What we collect and why
Account and plan
| What | Why |
|---|---|
| Email address | Sign-in links, your account, receipts and notices, and alerts you ask for |
| Your name | Only if you choose to enter one |
| Plan (Free, Lead Pack, Pro) | To give you the right access |
| Lemon Squeezy customer id and subscription status | To link your payment to your access |
| Order and refund records (order id, refund count) | Access, and blocking repeat refunds |
Your preferences
| What | Why |
|---|---|
| Categories, NAICS codes, set-asides, states | To show and send leads that fit you |
| Saved searches | To run your searches and alerts |
Sign-in and security
| What | Why |
|---|---|
| Sign-in tokens (stored only in scrambled, hashed form) | To sign you in by email link |
| Session records | To keep you signed in, and enforce the 3-session limit |
| A coarse device hash | To spot a new device and ask for a fresh sign-in. Built from basic browser details (browser type, platform, time zone). We store only the hash, not the raw details. |
| IP address (for abuse checks) | Rate limits, spam and attack prevention. Kept 7 days. |
| Terms acceptance log (version and time) | Proof that you accepted our Terms |
| Download log | Your download history, and checks for sharing or scraping |
| Abuse signals and evidence | To look into sharing, scraping or leaks |
Text messages (only if you opt in)
| What | Why |
|---|---|
| Mobile phone number | To send sign-in codes you request and watch alerts you turn on |
| SMS consent record: time, page version, the exact consent wording you saw, and the number | Proof that you agreed to texts |
| STOP / opt-out record (time and number) | So we never text you again after you reply STOP |
Our server logs don't contain emails, sign-in tokens or full IP addresses. They record a hashed user id and the page or feature used.
What we don't collect
- No passwords. There are none.
- No card or bank details. Those stay with Lemon Squeezy.
- No ad or tracking profiles.
- No IP history beyond the 7-day abuse window.
Newsletter
If you sign up for the free weekly issue, your email goes to beehiiv, our newsletter service.
We don't track whether you open the newsletter or click its links (open and click tracking is turned off).
4. Contact details in government notices
SAM.gov notices often include the name, email or phone of a government contracting officer.
- We show these details only as part of that notice, the same way SAM.gov does.
- We don't build a contact database, and we don't sell, search, or market to these contacts.
- Once a notice closes, we hide its contact details.
5. Leak tracing marks (please read)
To protect paid content, paid files and pages carry marks that can trace a leak back to an account.
- Paid CSV files have:
- a visible license column that says the file is licensed to your order (shown as a code, not your name or email), and
- per-buyer identifiers (fingerprints): a reference code on each row, and small differences in how our own fields are presented (such as tag order or one of several equally accurate summary wordings).
- Paid pages show a faint watermark with a short account code (for example "FS-7K3Q"). It never shows your email.
- We keep a private link between each code and your order or account.
The marks never change government facts, and every buyer gets the same leads.
Why: if a paid file or screenshot is posted or resold, we can find which account it came from and enforce our Terms. Our legitimate interest is protecting the service our paying users rely on.
We also search the public web and X each week for copies of FedSonar files or text.
6. Abuse monitoring
- Each day, software scores account activity for signs of sharing or scraping. Examples: more than 2 devices in use at the same time, unusual download or search volume, and bot-like patterns.
- An IP or country change on its own never counts against you.
- Account suspensions and bans are never automatic. Our operations team triages every flag, and a person, the owner of FedSonar, must approve before any suspension or ban.
- Unusually high download activity is flagged for review. There is no hard cap.
- Internal alerts use the account code and a hashed id. Your email is shown only when a reviewer opens the case.
One block is automatic: after 2 or more refunds on one account or email, new $7 Lead Pack purchases are blocked automatically, and our team gets an alert to review it. Other limits that apply automatically are speed limits, the 3-session limit, and removing access after a refund. None of these ban your account.
7. Legal reasons for using your data
Canada (PIPEDA). We collect, use and share personal information with your consent, for the purposes in this policy. Using the service means you consent to the uses needed to run it. You can withdraw consent, but we may then be unable to provide the service.
If you're in the EU, UK or a similar place, our legal bases are:
- Contract: running your account, sign-in, purchases and alerts.
- Legitimate interests: security, preventing abuse and scraping, leak tracing marks, and enforcing our Terms.
- Legal obligation: keeping records the law requires.
- Consent: the free newsletter. You can unsubscribe anytime.
If you're in California or another US state with a privacy law, you have rights to know, access, delete and correct your data. We don't sell or "share" personal information for cross-context behavioural advertising.
8. Who we share data with (processors)
We use these services to run FedSonar. They process data for us, under their own terms.
| Service | What it does | Data it handles |
|---|---|---|
| Cloudflare | Hosting, database, file storage, security, Turnstile (bot check) | All account data; IP addresses for security |
| Lemon Squeezy | Checkout, payments, tax, disputes (merchant of record) | Email, name and billing details you give it, payment details |
| beehiiv | Free weekly newsletter | Newsletter subscriber email |
| Spacemail | Our hello@fedsonar.com inbox | Emails you send us |
| Twilio | Sends text messages (sign-in codes, watch alerts) and receives STOP/HELP replies | Your phone number and the text of each message |
| Resend (resend.com) | Sends sign-in links, receipt-related notices and alert emails | Your email address and the message contents |
Lemon Squeezy is the merchant of record. It is also responsible for the payment data it collects. Its own privacy policy applies to that.
We don't sell your data. We share it only (and never your SMS opt-in data for marketing, see section 13):
- with the processors above,
- if the law requires it (for example a valid court order), or
- if the business is sold or reorganized, under this policy.
9. Where your data is stored (international transfers)
We're based in Canada. Our processors may store or process data in the United States and other countries where they operate. Data there may be accessible to that country's authorities under its laws.
10. How long we keep data
When you delete your account, everything is fully deleted within 7 days, except a minimal record kept for the period shown below and then deleted:
| Minimal record kept after deletion | What it holds | How long |
|---|---|---|
| Terms acceptance log | Terms version, date and time, hashed account id | 6 years |
| Repeat-refund flag | A hashed email and the refund count only | 2 years |
| Abuse evidence | Evidence for a specific case | 90 days after the case closes |
| SMS consent and STOP record | Time, page version, consent wording, hashed number | 5 years |
| Data | How long |
|---|---|
| Account, plan, preferences, saved searches | While your account is open. Deleted within 7 days of your deletion request. |
| Mobile phone number | Until you remove it, or within 7 days of account deletion |
| Email sign-in links | Deleted when used, or after 15 minutes |
| SMS sign-in codes | Deleted when used, or after 10 minutes |
| Sessions | Up to 30 days. Ended after 7 days idle, on sign-out, or on account deletion. |
| Coarse device hash | 90 days |
| IP addresses (abuse checks) | 7 days |
| Abuse evidence | 90 days, then deleted, unless a case is open. Evidence for a case is deleted 90 days after the case closes. |
| Download log | 1 year |
| Newsletter subscription (beehiiv) | Until you unsubscribe or delete your account |
| Emails to hello@fedsonar.com | 2 years |
| Backups | Deleted data is removed from backups within 30 days |
Lemon Squeezy keeps its own payment and tax records under its own policy.
11. Your rights
You can:
- Access your data: see what we hold about you.
- Export your data: download it from your account page.
- Correct your data: update it in your account, or ask us.
- Delete your account: from your account page or by email. We delete everything within 7 days, including removing you from our beehiiv newsletter list, except the minimal record in section 10.
- Unsubscribe from emails: every alert and newsletter has a one-click unsubscribe.
- Stop texts: reply STOP to any text, or remove your number in account settings.
- Withdraw consent or object to some uses.
- Complain to a privacy regulator. In Canada, that's the Office of the Privacy Commissioner of Canada.
To ask, email hello@fedsonar.com. We may need to confirm it's you, usually by email sign-in. We'll reply within 30 days.
Changing your email address needs a fresh sign-in, and we send a notice to your old address.
12. Cookies
We use only essential cookies: one secure session cookie that keeps you signed in. It's strictly necessary for the service to work, and it isn't used for anything else.
- No tracking cookies.
- No advertising cookies.
- No analytics cookies and no tracking pixels on our site. If that ever changes, we'll update this policy first.
- Cookies set by our security check (Cloudflare Turnstile) and our payment provider (the Lemon Squeezy checkout): strictly necessary, used only for bot protection and taking payment.
Because we use only strictly necessary cookies, we don't show a cookie banner.
13. Text messages (SMS)
Texts are optional. You opt in by adding your mobile number and ticking an unticked consent box in account settings or when you set up a watch alert.
- What we send: one-time sign-in codes when you ask for one, and "Watch this notice" alerts when a notice you watch changes.
- How often: sign-in codes only when you request one. Alerts vary, up to 5 alert texts a day. US mobile numbers only at launch; Canadian numbers come in v1.1.
- Message and data rates may apply. Reply STOP to cancel, HELP for help, or email hello@fedsonar.com.
- We do not sell or share your SMS opt-in data or personal information with third parties for marketing purposes.
- The sharing in section 8 does not include SMS opt-in data or consent. Your number goes only to Twilio, which sends our texts for us, and only to deliver those texts.
- We keep a record of your consent (time, page version, the consent wording and your number) and of any STOP, so we can prove consent and never text you after you opt out. See section 10.
- Full program terms: SMS Terms in our Terms of Service (section 25).
14. Children
FedSonar is a business service and is not for anyone under 18. We don't knowingly collect data from children. If you think a child has given us data, email hello@fedsonar.com and we'll delete it.
15. How we keep data safe
- HTTPS everywhere.
- No passwords to steal. Email sign-in links are single-use, expire in 15 minutes, and are stored only as hashes. SMS sign-in codes are single-use, expire in 10 minutes, and are stored only as hashes.
- Secure, signed session cookies.
- Account data is reached only through our server, never directly from the browser.
- Logs leave out emails, tokens and full IP addresses.
- Keys and secrets are kept in encrypted storage, not in our code.
- Rate limits and bot checks on sign-in and sign-up.
No system is perfectly secure, but we work to protect your data.
16. If there's a data breach
If a breach creates a real risk of significant harm to you, we'll:
- tell you as soon as we can, with what happened and what you can do,
- report it to the Privacy Commissioner of Canada and any other regulator as the law requires, and
- keep a record of the breach.
17. Changes to this policy
We may update this policy. For important changes, we'll email you at least 14 days before they take effect. Past versions are kept in a public archive. The version and date at the top show the current policy.
18. Contact
hello@fedsonar.com
FedSonar, 329 Howe St, Unit #200, Vancouver, BC V6C 3N2, Canada. Run by Farsonar.