Who we are
This policy is issued by Syncogia (“we”, “us”), which is responsible for your data as described here. You can reach us at support@syncogia.com. This policy covers the Syncogia iPhone and iPad app and the website at syncogia.com.
What we collect
| Data | Details | Why |
|---|---|---|
| Account | Email address, username, first and last name, a hashed password, and your Apple or Google account identifier if you use those to sign in. | Create and secure your account. |
| Your content | Decks, cards, tags, comments, likes, images, audio recordings, PDF documents, profile photo, bio, and cover photos you add. | Provide the service. Content you make public or share is visible to others. |
| Study activity | Review ratings and timestamps, study history, goals, streaks, achievements, statistics, and your scheduling (FSRS) parameters. | Schedule reviews and show your progress. |
| Social activity | Who you follow, block, or collaborate with, shares, invites, and referral codes. | Provide social features. |
| Devices and sessions | Device name and operating system, app version, a push notification token, your IP address and an approximate location (city and country) derived from it, user agent, session and trusted-device records, and two-step verification settings. | Keep your account secure, sync across devices, and send notifications. |
| Reports | Reports you send about a deck, comment, or user, and, for a reported item, a copy of its content at the time of the report together with our review notes and decision. | Review reports, keep the community safe, and show what was decided. |
| Server logs | Request time, path, status, IP address, and user agent. | Operate the service, prevent abuse, and fix errors. |
| Your address and the messages we send you, such as verification codes and security alerts. | Verify your email and notify you about your account. |
Syncogia asks for access to your microphone (to record audio for your cards), and photo library (to pick a deck cover or profile picture). Each is optional and only used when you use that feature. Images, audio, and photos you choose are uploaded to your account.
No advertising, no trackingSyncogia has no ads, does not track you across other companies’ apps and websites, does not use the advertising identifier, and does not sell or rent personal data. Analytics and advertising measurement are turned off in the app.
How we use it
- To provide the app: sync your decks, schedule reviews, show statistics, and power social features.
- To keep accounts and the service safe, including detecting abuse and unauthorized access.
- To send notifications you have allowed, and essential emails about your account.
- To respond to support requests and reports, and to enforce our Terms of Use.
- To meet legal obligations.
Where the law requires a legal basis (for example under the GDPR), we rely on: contract for your account, content, study data, sync, and social features; consent for push notifications, microphone, and photo library access, which you can withdraw in iOS Settings; legitimate interest for security, abuse prevention, server logs, and moderation; and legal obligation where we must respond to lawful requests.
Who we share it with
We share data only with providers that help us run Syncogia, and with other users as described below.
- Amazon Web Services hosts our servers and database in the European Union.
- Cloudflare delivers this website and handles network traffic, which includes your IP address.
- Google provides Sign in with Google, Firebase App Check (which confirms requests come from a genuine copy of the app), and the email relay we use to send verification codes and alerts.
- Apple provides Sign in with Apple and the push notification service.
- A geolocation lookup service receives your IP address (and nothing else) when you sign in, so that security emails and your session list can show an approximate location. The answer is cached for a few hours.
- Other users. Your username, profile, public decks, and activity you choose to make public are visible to others, subject to your privacy settings. Decks you share or collaborate on are visible to the people you share them with.
- Authorities, when we are legally required to, or to protect people from harm.
Some of these providers process data outside your country, including in the United States. Where required, we rely on safeguards such as the European Commission’s Standard Contractual Clauses or the EU–US Data Privacy Framework for those transfers.
Website. The syncogia.com website uses no advertising or analytics cookies and no third-party trackers. Cloudflare may process technical data, and set strictly necessary security cookies, to deliver the site and block abusive traffic.
How long we keep it
| Data | Kept for |
|---|---|
| Account, decks, cards, and study data | While your account is open. |
| After you delete your account | Access ends immediately. Your decks and any remaining personal data are removed about 30 days later. Decks that other people study stay available to them until they remove those decks. |
| Deleted decks and card attachments | 30 days, then permanently deleted. |
| Sign-in sessions | Up to 7 days after your last refresh, then removed. |
| Trusted devices | Up to 90 days. |
| Read notifications | 180 days. |
| Security and audit records | Up to 400 days. |
| Report copies of content | 90 days after a report is dismissed, 365 days while it waits for review, and for as long as a content or account action stands (at most 2 years). |
| Backups | Database backups are kept for 7 days, so deleted data disappears from them within that window. |
| Verification codes | Minutes. They expire automatically. |
| Server logs | Rotated automatically and kept only for a short time. |
Security
- Data is encrypted in transit with TLS, and the app checks our server’s certificate.
- Passwords are stored only as salted hashes. Sign-in tokens are kept in the iOS Keychain.
- Two-step verification, active session management, and trusted devices help protect your account.
No system is perfectly secure. To report a vulnerability, email security@syncogia.com.
Your choices and rights
- Edit your profile and content in the app at any time.
- Delete your account in the app. See how to delete your account.
- Permissions such as microphone, photos, and notifications can be changed in iOS Settings.
- Request a copy of your data, a correction, or a restriction of processing by emailing support@syncogia.com. Depending on where you live, for example under the GDPR, you may also have the right to object to processing or to complain to your data protection authority. We reply within 30 days.
If you live in California, you have the right to know, delete, and correct your personal information and not to be discriminated against for using these rights. We do not sell or share personal information for advertising, and we use sensitive information only to provide the app.
Children’s privacy
Syncogia is for people aged 13 and over. Where your country sets a higher age for consenting to online services, you need a parent’s or guardian’s permission until you reach that age. We do not knowingly collect data from younger children. If you believe a child under 13 has an account, email support@syncogia.com and we will delete it.
Changes to this policy
We will update this page when our practices change and change the date above. If a change is significant, we will tell you in the app or by email.
Contact us
Questions about privacy: support@syncogia.com. Security reports: security@syncogia.com.