Beta version. Websonance is in a private beta, and this page will change before the public release. Each new version is posted here with its date, and people with an account hear about it by email before it applies.
Privacy Policy
Beta version · last updated October 19, 2026
The short version
- We collect what's needed to run your account and your frames, and nothing for advertising.
- We use Cloudflare Web Analytics to count visits and measure page speed. It sets no cookies and doesn't follow you across websites. We don't use ad trackers, and we don't sell your information.
- Sign-in is handled by WorkOS. Websonance runs on Cloudflare.
- You can delete your account, and everything in it, from your Account page at any time.
1. Who we are
Websonance is operated by Carnocta LLC, a Florida limited liability company. Contact: support@websonance.com.
2. What we collect
Account information. When you sign in: your email address, your name if you provide one, the identifier WorkOS assigns you, and when your account was created and last used. If you use a password, it passes through our server to WorkOS, which stores it; we never store or log it. If you sign in with Google or Apple, WorkOS receives your name and email address from them, and so do we. With Apple's "Hide My Email", we only see the private relay address.
Your content. The frames you create and their settings, including anything you type into them, such as text, links, and image addresses. Each time you publish a frame we keep a copy of that version, up to the 20 most recent, so you can bring an earlier one back.
Images you upload. We remove location and camera details from photos before we store them. An uploaded image is public at its own address, like a published frame, so it can appear on your site. When you delete one, our servers stop showing it within a day.
Feedback you send. When you use "Send feedback", we keep what you write, your account email, and the address of the page you sent it from (unless you untick it), so we can fix things and reply. Only the page's path is kept, never anything after a question mark.
Form addresses. If you choose to have a form's answers emailed, we keep the addresses you add for that, including ones not yet confirmed, and send each a one-time confirmation email. We keep them until you remove them or close your account.
Invites. While new accounts are invite-only, we keep the email address of each person invited, and any note the inviter adds, so that address can create an account. It's removed if the invite is withdrawn, once that person has made their account and closed it again, or when the invite-only beta ends.
Web addresses. If you connect a free <name>.websonance.app address or your own domain to a published page, we keep the address, the page it shows, its status, and the DNS records we asked you to add, until you remove it or close your account. We keep a copy of your published page at the edge for up to two minutes. When you connect your own domain, we register it with Cloudflare, which issues its security certificate; certificate authorities publish the hostnames of certificates in public logs.
Page checks. When you ask Websonance to check a page ("Check my page"), our server requests that one page once, the way a browser would, and looks for your frame's embed code in it. The request identifies itself as Websonance. We show you the result and keep nothing from the page; your browser keeps the address you checked, so the next check can start from it. We only visit a page when you ask. Nothing in a frame reports back to us about the pages it's on or the people who view them.
Code you paste into Transpose. Transpose is not switched on during the private beta; this describes how it will work when it is. When you paste a component's code to turn it into a frame, our server first takes out anything that looks like a key or a password. If the code needs a model to read it, what's left is sent to an AI model run by Cloudflare (Workers AI), and to Anthropic (Claude) when it needs a second look. They read it to separate your words from your design, and send back what they found. Under their current terms, neither trains its models on it. Cloudflare doesn't keep it. Anthropic deletes it within 30 days, unless it's flagged as breaking their usage rules, which they may keep longer to look into. On our side, the job that turns your paste into a frame keeps it for one day, so it can finish, and then it's gone. Nothing else is kept unless you choose to keep the source with your frame.
Sandbox. The sandbox is not available during the private beta; this describes it for when it returns. A random identifier stored in a cookie, and the frames you make. Both are deleted 24 hours after the sandbox was started.
Connection information. When you sign in, and when a visitor submits a form, we use the IP address to limit abuse. For sign-in we also pass the IP address and browser to WorkOS for fraud checks. When the sandbox is on and one is created, we hold the IP address for about two minutes and discard it, and Cloudflare Turnstile checks that you're a person: it runs in your browser, and we send Cloudflare the check's result and your IP address to confirm it. We don't keep request logs of our own. Cloudflare, which carries all traffic to Websonance, processes connection data for security under its own privacy policy.
Visits and page speed. websonance.com uses Cloudflare Web Analytics to count page views and measure how quickly pages load. It runs in your browser without cookies and doesn't build a profile of you or follow you to other websites. Cloudflare receives the address of the page, the page that linked to it, and basic browser and device information, and gives us totals.
Product event counts. We count a few things that happen in Websonance, such as "a sandbox was started" or "a frame was published". Each count records only what happened, the kind of frame involved, and which version of the service recorded it. It never records who did it: no account, email address, IP address, frame, or anything you typed.
Support messages. Anything you send to support@websonance.com.
We don't collect payment information, because nothing on Websonance is paid today.
3. Cookies and browser storage
| Name | What it does | How long | Where |
|---|---|---|---|
ws_sess | Keeps you signed in | 7 days | websonance.com |
ws_oauth | Protects sign-in against forgery | 10 minutes | websonance.com |
ws_pwset | Lets you choose a password right after your first sign-in code | 15 minutes | websonance.com |
ws_pend | Holds your place while you type the code we emailed after sign-up | 10 minutes | websonance.com |
fk_guest, fk_mode | Identify your sandbox (only while the sandbox is on) | 24 hours | websonance.com |
| Popup view state | Only if the popup's owner turns it on: remembers whether a visitor has seen or dismissed that popup | Until the visitor clears it, or until the tab closes for "once per visit" | The visitor's browser, for websonance.app |
Your browser also keeps, on websonance.com, an unsaved draft of the frame you're editing, the email you typed while signing in, and which tips you've seen. None of this is sent to us or used to follow you.
We don't use advertising cookies, and our analytics uses no cookies at all.
4. People who view embedded frames
When someone visits a website that embeds a Websonance frame, their browser loads that frame from websonance.app.
- We don't set cookies for them or track them across websites.
- Our own pages, frames and hosted pages load fonts from Google Fonts, so Google receives the visitor's IP address and basic browser information when those fonts load. Google's privacy policy applies to that.
- A hosted page may embed videos from YouTube or Vimeo and images from other sites, as chosen by its owner. Those sites see the visitor's request.
- A popup shows on every visit and stores nothing, unless its owner chooses to show it less often or offers "Don't show again". Then it remembers that choice in that visitor's own browser only, with no identifier.
- If a frame is a form, what the visitor enters passes through our server on its way to where the frame's owner chose (an email address they confirmed, their own web address, or both). We pass it on and don't keep it. The frame owner's privacy policy applies to that information.
5. How we use information
- to provide and operate Websonance;
- to keep it secure and prevent abuse;
- to answer support requests;
- to tell you about important changes to Websonance or these policies;
- to comply with the law.
We don't sell or rent personal information, and we don't use it for advertising.
6. Who we share it with
- Service providers that run Websonance for us: Cloudflare (hosting, storage, databases, analytics, email forwarding, and the AI model that reads code pasted into Transpose), WorkOS (sign-in, including the emails that carry your sign-in codes and password resets), Google (fonts), Anthropic (a second reading of code pasted into Transpose, once Transpose is switched on, when the first reading isn't enough), and our email provider, for support messages. Websonance sends its own email (invitations, address confirmations, and form answers you turn on) through Cloudflare. They may use information only to provide their services to us.
- When the law requires it, or when needed to protect the rights, safety, or security of our users, the public, or Websonance.
- If Websonance changes hands, for example if it moves into a company we form, information may transfer with it and remains covered by this policy.
7. How long we keep it
| Information | Kept for |
|---|---|
| Account and frames | Until you delete them or close your account |
| Images you upload | Until you delete them or close your account |
| Sandbox frames and identifier | 24 hours |
| IP address used to limit abuse | About 2 minutes |
| Records after you close your account | Up to 30 days in encrypted backups, then gone |
| Marker that shuts down old sign-in sessions (after you close your account or sign out everywhere) | About 1 week |
| Support messages | As long as needed to help you |
| Feedback you send | Until you close your account or ask us to delete it |
| An invited email address | Until the invite is withdrawn, or the invite-only beta ends |
| A page you asked us to check | Not kept: you see the result, and the page is gone from our server once the check ends |
| Web addresses you connect | Until you remove them or close your account |
| Code you paste into Transpose | One day, while it becomes a frame (Anthropic, when it reads it, up to 30 days); longer only if you keep the source with your frame |
8. Your choices and rights
- Delete everything: close your account from your Account page. This deletes your workspace, your frames, the images you uploaded, the feedback you sent, your form addresses, your invitation, and your sign-in, and disconnects your web addresses. Embeds and hosted pages stop within a couple of minutes.
- Sign out everywhere: from your Account page, end every signed-in session at once. Your account and frames are untouched.
- See or correct your information: email support@websonance.com.
- Depending on where you live, such as California, the EU, or the UK, you may have additional rights to access, correct, delete, or export your information, or to object to how it's used. Send any request to support@websonance.com. We won't treat you differently for making one.
9. Children
Websonance is for people 13 and older. We don't knowingly collect personal information from children under 13. If you believe a child under 13 has an account, contact us and we'll delete it.
10. Security
Websonance uses encrypted connections everywhere, signed sign-in sessions limited to our app domain, and a separate domain for serving frames so that content made by others can't reach your session. No system is perfectly secure, so we can't guarantee absolute security.
11. Where information is processed
Websonance is based in the United States. Your information may be processed in the US and anywhere Cloudflare, WorkOS and Anthropic operate their infrastructure.
12. Changes to this policy
When we update this policy, we'll change the effective date above. For material changes, we'll let you know by email or with a notice in Websonance.
13. Contact
Questions or requests: support@websonance.com