Privacy Policy

1. Information we collect

When you use Synecto, we collect:

• Account info: email address, display name, and password (hashed).
• Reflection content: text messages and voice transcripts you create during sessions.
• Extracted insights: values, beliefs, goals, blockers, strengths, key quotes and actionable tasks derived from your sessions by AI.
• App preferences: theme, voice mode settings, reminder schedules, language.
• Usage telemetry: minimal — session count, last reflection date, streak. No third-party analytics.

2. How we use your data

• To provide the Synecto app and personalise your experience
• To extract insights and build your evolving Inner Profile
• To send service emails (email verification, password resets, occasional product updates if you opt in)
• To detect and prevent abuse

We never sell your personal data. We never use your reflections to train AI models. Your data is processed only to make Synecto work for you.

3. Legal basis (GDPR)

We process your data on the lawful basis of contract performance (to provide the service you signed up for) and your consent (for optional features like email reminders). We do not process special category data under Article 9 — Synecto is a personal-growth tool, not a health service.

4. Sub-processors

We use these vendors to deliver Synecto:

• Supabase (database, authentication) — hosted in US East
• OpenAI (AI conversation, transcription, insight extraction) — zero-retention mode enabled
• Brevo (email delivery) — transactional emails only
• Cloudflare (CDN, DDoS protection)
• Expo / EAS Hosting (web app hosting)
• Tavily (optional web-search context inside conversations)
• Google / Notion (only if you explicitly connect those integrations)

5. International transfers

Some of our sub-processors are based in the United States. Where data transfers occur, we rely on Standard Contractual Clauses and other appropriate safeguards under GDPR.

6. Data retention

We keep your data for as long as your account is active. You can delete your account and all associated data anytime from in-app Settings — this is irreversible and removes everything within 30 days.

7. Your rights

Under GDPR you have the right to:

• Access your personal data
• Correct inaccurate data
• Delete your data ("right to be forgotten")
• Export your data in a portable format (we offer JSON export from Settings)
• Object to processing or withdraw consent
• Lodge a complaint with the Irish Data Protection Commission (dataprotection.ie)

To exercise any of these rights, email hello@synecto.io.

8. Children's privacy

Synecto is not intended for use by anyone under 16. We do not knowingly collect data from children. If you believe we have, please contact us immediately.

9. Cookies & tracking

We do not use advertising cookies, marketing pixels, or third-party analytics that track you across the web. That's why you won't see a cookie consent banner here — we don't have anything to ask consent for.

What we do use:

• Cloudflare Web Analytics on synecto.io — cookieless and privacy-first. It records anonymous, aggregate visitor counts (page, country, device type) without IP addresses, fingerprinting or any identifiers. No data is shared with third parties.
• Cloudflare bot-protection cookies (e.g. __cf_bm) — strictly necessary for security and DDoS protection. These are exempt from consent under EU ePrivacy rules.
• Local storage in the Synecto app — used only to keep you signed in and remember your preferences (theme, voice settings). Cleared when you sign out.

10. Changes to this policy

We may update this policy occasionally. The "Last updated" date at the top reflects the most recent revision. Significant changes will be communicated via email.

11. Contact

Questions about your privacy? Email hello@synecto.io.