Sotto is operated by Samijoe El Hayek, an individual based in Lebanon, who is responsible for your data. Questions or deletion requests: support@sottohq.app.
The short version
- Your call’s audio is transcribed on your computer and never uploaded.
- When you ask for an answer, Sotto sends that request — the new transcript, your profile, and for screen analysis one screenshot — to Sotto’s servers, which pass it to Anthropic’s Claude API to write the answer.
- Sotto’s servers don’t store transcripts, profiles, screenshots or answers. They keep your account, your credits, and how many tokens each request used.
- This website carries no tracking on any page, with one exception: sottohq.app/go, the page our ads link to, loads Meta’s pixel. It is described below.
What we hold
| Data | Why | How long |
|---|---|---|
| Email address and account ID | To sign you in and support you | Until you delete the account |
| An email address someone asked us to send the download link to, and the invite code it came with | To send the link, and to add a friend’s invite credits when that address first signs in | 90 days, then deleted. Ask us at any time and we delete it sooner |
| About the download emails we send you: whether each one arrived, whether it was opened (roughly: see below), the taps on its links (only whether a phone or a computer, and when; the link never contains your address), and whether you said “no more reminders”. Each download email carries one tiny image of our own; when your email app shows it, we note that the email was probably opened, once per email. It is not a pixel from anyone else, and some email apps load it without you opening anything, or never load it, which is why it is only a rough sign | To send at most two short reminders, only while you haven’t signed in, and to see where people get stuck | 90 days, then deleted. An address that bounced for good or marked our email as spam is kept only so we never write to it again, and deleted if you ask |
If you came to sottohq.app/go from one of our ads: which ad it was and where Meta showed it (Instagram, Facebook, Messenger or another app, and the spot, such as Stories), the address you typed, the browser and IP address you typed it from, and Meta’s two cookies (_fbp and _fbc). Also that the page was visited, and whether you pressed Download on it from a computer: for those, the same ad, Meta’s cookies and your browser, with a salted hash of your IP address rather than the address itself | To tell Meta that its ad worked, so we stop paying for the ads that don’t. An ad clicked on a phone and an app opened on a computer days later are otherwise two strangers | Which ad brought you is kept with your account and deleted with it. The address you typed, your browser and IP address and Meta’s two cookies are deleted after 90 days, and sooner if you ask |
| The first time the Sotto app opens on a Mac or a Windows PC, it sends us one anonymous “installed” message: a random number the app makes up for itself, whether it is the Mac or the Windows app, and its version. Our server adds a salted hash of the internet address it came from (never the address itself). No email and no account, until you sign in: then it is linked to your account | To count how many downloads become an installed app, and which ads lead to one | The hash of the internet address: 90 days. The rest is kept with your account once you sign in, and deleted with it; if you never sign in, it says nothing about anyone and stays. Ask us and we delete it sooner |
| Who invited whom, and the credits each side was given | To pay invite rewards once, and to stop the offer being farmed | Until you delete the account; the ledger entry stays without your email |
| A salted hash of your computer’s hardware identifier (the Mac’s platform UUID, or Windows’ machine identifier) | One free allowance, and one invite reward, per machine | Kept without your email after you delete the account, so the same computer can’t claim a second free allowance |
| A salted hash of the internet address your computer signs in from (never the address itself) | To spot someone inviting themselves: an invite reward where both computers used the same connection waits for a person to check it | 30 days, then deleted. Deleted with your account |
| Credits, purchases and refunds | To run the ledger and meet tax rules | As long as the law requires |
| Wallet addresses, transaction IDs and, for Whish, the name you type | To match your payment and keep tax records. We check paying addresses against the US OFAC sanctions list | Five years |
| Per-request token counts, timings and errors | To keep the service working and priced honestly | 12 months |
| Your requests and answers | Not stored at all | — |
Who else processes your data
- Anthropic (Claude API) writes the answers. Anthropic does not train on API content and does not retain it by default; content flagged by their safety systems can be kept up to two years.
- Supabase stores the account database and handles sign-in.
- Fly.io runs Sotto’s servers.
- Resend delivers the emails with your sign-in code, so it handles your email address.
- Helius (Solana node provider) sees the activity of our payment address, which includes the sending address of anyone who pays us.
- Meta receives conversion events, and only about people who reached us through one of its ads. What it gets is described in the next section.
The one page with tracking: /go
We run ads on Facebook and Instagram. They link to sottohq.app/go, sometimes with a word after it that says which ad it was (sottohq.app/go/meta-v1-interview). That page, and only that page, loads Meta’s pixel, and tells Meta the page was seen, whether you asked us for the download link, and whether you pressed Download on a computer. It also sets two cookies on our own domain: _fbp, a random number that stands for your browser and nothing else, and _fbc, which is copied out of the ad link you arrived on. Every other page on this site loads nothing from Meta and sets no tracking cookie at all, and our own tests fail the build if that stops being true.
Those three things are all it reports: Meta’s script can log more of its own accord, and we switch that off. Our server tells Meta about the last two as well, because a phone and a computer share nothing: you see an ad on a phone, and you open Sotto on a computer days later. Without it we would be paying for ads and never learning which ones worked. What is sent, from the page and from the server alike, is:
- Your email address as a SHA-256 hash — a fingerprint of it, which Meta can compare against its own but cannot read back. Never the address itself.
- The IP address and browser you were using on /go, and Meta’s two cookies from that visit.
- Which ad brought you, and one of six things that happened: the page was seen, you asked for the link, you started the download on a computer (from that page or from our email), you signed in, you finished your first answer, or you bought a pack — and for a purchase, its amount.
The page also tells our own server, not Meta, that it was visited: which ad, where Meta showed it, whether you are on a Mac, a Windows PC or something else, and the _fbp cookie. Our server keeps a salted hash of your IP address and browser with it, never the address itself, so that a visitor who reloads the page is counted once.
It never sends your name, your address in the clear, your transcripts, your answers, your screenshots or anything you said on a call. We keep which ad brought you with your account; everything else /go learned we delete after 90 days. Deleting your account deletes it all immediately, along with any event still waiting to be sent.
If you would rather none of this happened: do not use the /go link, or block the pixel with any content blocker — the page works exactly the same, and Sotto itself behaves identically either way. Ask us at support@sottohq.app and we will delete what we hold about your visit. Meta also lets you see and delete what it has under Settings → Your activity off Meta technologies.
Recording other people
Sotto transcribes whatever your computer hears. Whether you may record or transcribe a conversation depends on where you and the other people are; in many places everyone has to agree. That is your responsibility, and Sotto shows an AI notice at the start of every session to make the assistance visible.
Your choices
Ask us at support@sottohq.app for a copy of your data or to delete your account. Apart from the one anonymous “installed” message described above, crash reports and anonymous usage statistics are off unless you switch them on.