Sounder Privacy Policy

This policy explains what personal information Sounder collects, why we collect it, who we share it with, and the rights you have over it. We have written it in plain language. Where this policy uses defined legal terms, they carry their meaning under the Privacy Act 2020 (New Zealand).

---

1. Who we are

Sounder is a cashflow-prediction tool for families and individuals, operated by Cyber Networks (New Zealand).

• Legal entity: CYBER NETWORKS LIMITED
• NZ company number: 8309812
• NZBN: 9429050316984
• Registered address: 98 Havill Street, Takaro, Palmerston North, 4410, New Zealand
• Website / app: sounder.nz
• Contact / support: support@sounder.nz

We are the agency responsible for the personal information described in this policy.

Our Privacy Officer

Under the Privacy Act 2020 we have a nominated Privacy Officer who is responsible for our compliance with the Act and for handling privacy questions, access requests, and complaints:

• Privacy Officer: Adam Blair
• Email: privacy@sounder.nz

---

2. What we collect

We collect only what we need to run the service. The information falls into the following groups.

Account information

• Your email address.
• Your name — a single name of your own choosing. It does not have to be your legal name, and we do not ask for a given name and family name separately. A name is required: it is asked for when you sign up, and every account has one.
  • If you had an account before we introduced names, we did not leave it blank and we did not ask you to pick one before carrying on. We set your name for you from the part of your email address before the "@" — so an account registered as sam.jones@example.com was given the name sam.jones. That derived name is shown to the other members of any household you share and to our administrators until you change it.
  • You can change your name at any time in your account settings, and we would encourage you to if the one we derived is not what you want shown.
  • We use your name so that members of a household you share can tell whose household is whose, and so we can address you properly.
• Your password, stored only as a bcrypt hash (we never store your plain password).
• Email-verification codes and email two-factor (2FA) codes.
• Trusted-device tokens (stored only as a hash) if you choose "remember this device".

Financial information (the core of the service)

This is the information you enter so we can forecast your cashflow. It can be detailed and sensitive:

• Bank account names, nicknames, and free-text notes.
• Account balances and balance updates.
• Recurring income, including salaries and benefits.
• Recurring expenses, including bills, groceries, mortgages, and informal or family loans.
• Debts, including interest rates and remaining balances.
• One-off transactions, along with their dates and descriptions.
• Spending categories, including names you create, and which category each item belongs to.

We do not connect to your bank. You enter this information yourself; we do not receive bank feeds or transaction imports from your bank.

Usage and technical information

• Your sign-in source IP address, and the country it resolves to. The country is worked out on our own servers using an offline database — your IP address is not sent to any third party to look up its location.
• Authentication and feature event logs (for example: sign-in, sign-out, sign-up, 2FA, invitations, role changes).
• Logs of your use of the AI features (feature, model, tokens, and cost).

Optional demographic information

If you choose to provide it, we hold a coarse profile: country, city, age band, and sex. This is optional and used only for aggregate analytics.

Chat information

• The content of your conversations with the in-app AI assistant, including messages you send and the assistant's replies.

If you register your interest (you do not need an account)

While Sounder is in its testing phase, signing up is by invitation. Anyone else can ask us to get in touch using the register-your-interest form on our website. The form is open to the public and you do not need an account to use it. If you fill it in, we collect:

• The name you give us and your email address. These two are required — without them we cannot come back to you.
• An optional note — a free-text box for anything you want to tell us. Please do not put financial details or other sensitive information in it; it is a message to us, not part of a forecast, and it is stored and emailed to us as you typed it.
• The source you came from, if the link you followed carried a referral or campaign tag (a ?channel= or ?ref= parameter in the web address). It records which link or campaign brought you here, and it is stored with your registration.
• Your IP address, recorded when you submit a public form on our website so we can limit automated abuse of it. It is counted within a short window and cleared as later submissions come through, and it is not attached to your registration.

Why we collect it. We use this information for one purpose: to contact you about beta access and the launch — to email you an invitation to sign up when we can offer you a place, or to tell you when Sounder opens. We do not use it to advertise to you, we do not sell it, and we do not add you to a marketing list for anything else. We collect it directly from you and tell you here what it is for, consistent with IPP 1, IPP 2 and IPP 3 of the Privacy Act 2020, and we use it only for that purpose or a directly related one (IPP 10).

Where it goes. Your registration is stored in our database (Microsoft Azure, Sydney) and a copy of your name, email address and note is emailed to our own support inbox at support@sounder.nz through Microsoft Graph. Those are both sub-processors already listed in section 5. It goes nowhere else — in particular it is not sent to the AI/LLM providers, to Stripe, or to Atlassian.

How it is held. Unlike your financial data, a registration is held in ordinary readable form, because there is no account and no encryption key at the point you fill in the form (see section 7). Our administrators can see the list, and can convert an entry into an invitation to sign up.

How long we keep it. We delete interest registrations when Sounder moves out of its testing phase, and in any case we keep them no longer than one year (see section 9). You can ask us to delete yours sooner at any time — see section 8.

---

3. How and why we use your information

We use your information to:

• Provide the core service — forecast the day-by-day balance of each of your accounts.
• Create and secure your account, verify your email, and provide two-factor authentication.
• Operate household sharing, so members of a household can share one cashflow — including showing your name to the other members of a household you share, so everyone can tell whose household is whose (see section 11).
• Provide the AI features — the chat assistant, cashflow insights and AI fill (see section 4).
• Send you transactional messages (verification, 2FA codes, security notices) and, if you opt in, a daily forecast email.
• Take payment and manage your subscription (see section 5 and our separate Billing & Trial Terms).
• Understand and improve the service through aggregate analytics.
• Contact you about beta access and the launch, if you registered your interest while sign-up was invitation-only (see section 2).
• Keep the service secure, prevent abuse, and meet our legal obligations.

We rely on the information-privacy principles in the Privacy Act 2020, including IPP 3 (we tell you what we collect and why, through this policy) and IPP 10 (we use information only for the purposes for which it was collected, or a directly related purpose).

---

4. AI features and the LLM provider (please read)

Sounder includes an AI chat assistant, AI cashflow insights and AI fill, which turns a plain-English description into a draft item. These features work by sending information to a third-party large language model (LLM) provider that generates the response.

What is sent. For the chat assistant and cashflow insights, we send to the LLM provider both your chat message content and a snapshot of your financial data relevant to answering you. That snapshot can include your account balances, debts (with interest and remaining balances), recent and upcoming transactions, and computed projected shortfalls. For AI fill, we send only the description you type and your household's category names, with no financial snapshot. It can also include the names of your household's spending categories, including custom names you or another household member have created, so the AI can suggest a category. Because those names are free text, avoid putting anything in one that you would not want sent to the AI provider.

What is not sent. We do not send your name or your email address to the LLM provider. The financial snapshot is deliberately built without them.

To whom, and where. The AI features are provided through OpenRouter and, in turn, model providers such as OpenAI, accessed via the LiteLLM library. These providers may be located overseas, including in the United States. This is a cross-border disclosure of your personal information under IPP 12 of the Privacy Act 2020.

Why. The information is sent solely so the provider can generate a response for you. It is not used by us to advertise to you.

No training, and minimal retention. We restrict every AI request to providers that do not train their models on what we send and that do not retain it beyond generating your response. Technically, we require the provider to have data collection turned off and zero data retention, on every request. A model that does not meet these conditions is rejected and not used. This means your information is used only to generate the response you asked for and is not kept by the provider to train models or for other purposes.

Still a disclosure overseas. Even so, your information does leave our systems to be processed by a third party overseas while your response is generated, and once it reaches the provider it is handled under that provider's terms. You should treat anything you put into the chat with that in mind.

Your choice — you can turn AI off. The AI features are on by default, but you can turn them off at any time in Settings. This is a per-member choice — it applies to your own use, not the whole household. Turning AI off disables the chat assistant, the cashflow insights, AI fill, and any automatic issue-logging from the assistant — everything that uses AI — so no chat content or financial snapshot is sent to the LLM provider on your behalf. When AI is off, a small prompt in the app lets you turn it back on and links to this section. If you are not comfortable sending your financial details to an overseas AI provider, turn AI off; the rest of the app works without it.

---

5. Who we share your information with (sub-processors)

We use a small number of trusted third parties ("sub-processors") to run the service. We share only what each needs for its purpose.

Where we automatically notify our development team about an issue you may be experiencing (the Jira row above), the notification text is deterministically redacted before it leaves our servers — money amounts, your bank and account names, custom category names, email addresses, and any city/country we hold are stripped — and it carries no account identifier that links it to you. Your name is not included in these notifications. It will not contain personally identifiable information, including anything that identifies you. This automatic issue-notification only happens while your AI features are on (see section 4); if you turn AI off, it is disabled along with the other AI features.

If you registered your interest rather than signing up (section 2), what you gave us goes no further than two of the sub-processors above: it is stored in our database with Microsoft Azure, and emailed to our own support inbox through Microsoft Graph. It is not sent to the AI/LLM providers, to Stripe, or to Atlassian.

We do not sell your personal information, and we do not share it with advertising networks.

---

6. Cookies and analytics

Sounder uses only functional / strictly-necessary cookies. Because we do not use advertising or tracking cookies, we do not show a cookie-consent banner.

The cookies we set are:

• A session cookie — HttpOnly, Secure, SameSite=Lax — that keeps you signed in.
• A 14-day trusted-device cookie if you choose "remember this device" to skip 2FA on that browser.
• Administrator cookies — used only in the separate admin portal, not for ordinary users.

For website analytics we use Umami, a first-party, self-hosted analytics tool. It measures aggregate site usage (such as visits and page views). It does not use advertising trackers, and it is not shared with third-party ad networks.

---

7. How we protect your information (security)

Security is central to Sounder. We should be precise about what our encryption does and does not do — Sounder is not "zero-knowledge".

• Financial data is encrypted at rest using AES-256-GCM, under a per-household key. Much of your personal data — your settings and your chat conversations with the assistant — is encrypted the same way, under your own member key. These data keys are randomly generated; each is then protected (wrapped) by a further key derived from your password using Argon2id, so for the encrypted fields the database and its backups hold only ciphertext.
• Not everything is encrypted, and we want to be straight about that. The following are held in ordinary readable form in our database, because the service has to be able to read them when you are not signed in — to send you an email, to bill you, to show your name to the other members of your household, or to keep the service secure: your email address, your name, your sign-in source IP addresses and the country they resolve to, your subscription and billing status, the structural record of which household and role you belong to, and — if you choose to supply it — your optional demographic profile (country, city, age band, sex), which is held readable so that it can be aggregated for analytics.
• Taken together, this is identifying information. A name sitting alongside an email address, sign-in IP addresses and a location is enough to identify you directly — and most people put their real name in the name field. Encryption protects the content of your finances; it does not make your account anonymous, and a breach of our database would expose the readable fields listed above even though it would not expose your financial data.
• A register-your-interest submission is readable too (section 2) — the name, email address, note and source you gave us are held in ordinary readable form, because at that point you have no account, no password and therefore no key to encrypt them under. Treat what you put in the note accordingly.
• Because the data keys are protected by a password-derived key, someone who only has a copy of the database or a backup cannot read your financial data — though, as above, they would be able to read the fields that are not encrypted.
• Administrators cannot read your financial data in normal operation. There is no standing capability on our servers to read it. Our product administrators can see the readable account information described above — including your name, email address, sign-in records and subscription status, and which households you belong to — and can search our administration console by name or email. They use this to run the service: support, billing, and abuse handling. Administrator actions in that console are logged.
• There is one deliberate exception. For two specific purposes — account recovery (helping you back in if you lose both your password and recovery key) and the opt-in daily forecast email — your data can be unlocked using a separately-protected key held in a hardware security module (HSM) in Azure Key Vault. That key can only be used during an active administrator sign-in through Microsoft Entra. Absent a live administrator sign-in, even we cannot read your financial data.

No system is perfectly secure, but we take reasonable steps to protect your information as required by IPP 5.

If something goes wrong (privacy breach)

If we experience a privacy breach that is likely to cause serious harm, we will notify the Office of the Privacy Commissioner and the affected individuals as required by the Privacy Act 2020.

---

8. Your rights over your information

Under the Privacy Act 2020 you have the right to access and correct your personal information (IPP 6 and IPP 7).

• Access / export. You can export your whole dataset at any time from within the app. To request a copy in another form, contact our Privacy Officer.
• Correction. You can edit your own data directly in the app — accounts, income, expenses, debts, transactions, your name, and your profile. If you cannot correct something yourself, ask us.
• Deletion. You can delete your own account from within the app (in Settings) — we ask you to re-enter your password to confirm. When you delete your account we erase your user record and everything you solely own: each household you are the sole owner of is wiped (its financial data and its subscription, and its payment record with Stripe is deleted, not just cancelled), and your personal records (sessions, settings, chat, profile, and logs) are removed. If you prefer, you can still ask us to do it for you — email support@sounder.nz or the Privacy Officer. Note that:
  • If you own a household you share with other members, you cannot delete your account until you transfer ownership to another member, so the shared household is not left stranded. A non-owner member who deletes simply leaves the household, which continues for the others.
  • Leaving a household removes your access to that household's data but does not re-encrypt data that was already shared with other members.
  • Because we keep automated backups with point-in-time restore, deleted data will remain in backups until it cycles out over the backup window, after which it is removed.
• If you registered your interest and do not have an account. There is nothing to export or edit in the app, because you have not signed up. Email our Privacy Officer or support@sounder.nz and we will tell you what we hold, correct it, or delete your registration — whichever you ask for. You do not have to give a reason, and you do not have to wait for the retention period in section 9 to run out.

There is no charge to exercise these rights, and we will respond within the timeframes set by the Privacy Act 2020.

---

9. How long we keep your information (retention)

We keep your information for as long as we need it for the purposes described in this policy — principally, for as long as you have an account — and then delete or de-identify it. When you delete your account, your account and financial data are removed as described in section 8. If you do not have an account and have only registered your interest, a fixed period applies instead — see the note below the table.

For the operational logs we keep, we now apply defined retention windows, after which the records are deleted:

Register-your-interest submissions (section 2) are kept only for as long as they can serve the purpose you gave them to us for. We delete them when Sounder moves out of its testing phase, and in any case we keep them no longer than one year. You can ask us to delete yours sooner at any time (section 8).

These windows never touch your encrypted financial data, which is kept for as long as you have an account. As noted above, deleted data also cycles out of automated backups over the backup window.

This reflects our obligations under IPP 9 (not to keep information longer than necessary).

---

10. Cross-border disclosure

Your information is hosted in Sydney, Australia (Microsoft Azure, australiaeast). Some sub-processors — notably the AI/LLM providers, Stripe, and Atlassian — process information overseas, including in the United States.

This means your information may be disclosed to, and stored by, parties outside New Zealand. We take reasonable steps, consistent with IPP 12, to ensure such parties protect your information. By using Sounder, and in particular the AI features, you understand that your information will be processed overseas as described in this policy.

---

11. Household sharing — a privacy note

Sounder lets up to five members share one household's cashflow. If you join or share a household, please be aware:

• Other members can see the household's shared financial data.
• Your name is shown to the other members. Each household is labelled with its owner's name — shown as "Owner: <name>" — so that members who belong to more than one household can tell them apart. Members of a household can also see each other's email addresses. So if you own or join a household, expect the other members to know the name on your account. If that name was derived from your email address when we introduced names (see section 2), it is the derived name they will see until you change it.
• Someone who is merely invited and has not yet signed in does not see this: the invitation preview shown before sign-in does not reveal the owner's name.
• The household has a member-facing audit log that shows other members' authentication events (such as sign-in, sign-out, 2FA, invitations, and role changes). For those sign-ins, other members see only the country the sign-in came from — not the raw IP address. Your full sign-in IP address is shown only to you, for your own sign-ins.
• Leaving a household revokes your ongoing access, but does not retroactively re-encrypt data already shared while you were a member.

Only join or invite people to a household you trust with this information.

---

12. Children

Sounder is intended for people aged 16 and over. It is not designed for, or directed at, children under 16, and we do not knowingly collect their information. If you believe a child has provided us information, contact our Privacy Officer and we will delete it.

---

13. International users

Sounder is a New Zealand service built around New Zealand law.

• Australia. As we host in Sydney and expect Australian users, the Australian Privacy Principles under the Privacy Act 1988 (Cth) are likely to apply to Australian users. We will comply with those principles where they apply.
• EU / UK. We do not deliberately target the European Union or the United Kingdom. If you access Sounder from those regions, you do so on your own initiative, and only the protections described in this policy and applicable New Zealand and Australian law apply unless we have told you otherwise.

---

14. Changes to this policy

We may update this policy from time to time. If we make a material change, we will take reasonable steps to tell you — for example, by notice in the app or by email — before it takes effect. The "Last updated" date at the top shows the current version.

---

15. How to complain

If you have a concern about how we handle your information, please contact our Privacy Officer first (details in section 1). We will work with you to resolve it.

If you are not satisfied with our response, you can complain to the Office of the Privacy Commissioner:

• Website: privacy.org.nz
• Phone: 0800 803 909