Privacy Policy

Last updated: 2026-11-09 · Scope: website synapse-app.at, native Synapse apps and the associated server services.

Note: The English version is provided for reader convenience only. Only the German version is legally binding. View the German version

Protecting your personal data is important to us. We process your data exclusively on the basis of the statutory provisions (GDPR, Austrian Data Protection Act, TKG 2021). In this declaration we inform you about the most important aspects of data processing within the scope of Synapse.

1. Controller

[First and last name / company name]
[Street and house number]
[Postal code] [City], Austria
Email: support@synapse-app.at

2. What data we process

a) Account data

At registration we collect: email address, username and a password hash. Optional: Google account ID when using "Sign in with Google".

Synapse is not directed at children under 14. If we learn that an account belongs to a child under 14, we delete it.

b) Notebook content

If you use cloud sync, your notebooks, drawings and embedded media (images, PDFs, audio, videos and screen recordings) are transmitted encrypted to our server and stored there. The content is accessible only to you.

c) Billing data

When concluding a paid subscription, the payment data is processed exclusively by our payment service provider Stripe Payments Europe, Ltd. (see point 5).

We ourselves store only what is needed to assign the subscription: the plan code, the validity date, the status and the Stripe customer ID.

d) Technical data / server logs

On every access, IP address, user agent, timestamp and called URL are stored in the server log for a maximum of 14 days (legal basis: Art. 6(1)(f) GDPR — legitimate interest in IT security and abuse detection). After that the logs are automatically rotated and deleted.

e) AI usage data

When you use AI features (handwriting recognition, math solving, chat, study podcast, practice exam), the selected content (image excerpt, text) is transmitted to Google Gemini (see point 5) at the time of the request. When you dictate, this also includes the audio recording. We do not store the request itself, only the token count consumed, the model used and the timestamp — to settle your daily limit or monthly allowance.

f) Your own handwriting

If you write letters under “My handwriting”, we store these handwriting samples on our server so that the app can use them on all your devices (performance of a contract). They are used only to display text in your handwriting — not to recognise or identify you. You can delete them at any time on the same page; if you delete your account, they are deleted with it.

3. Purposes and legal bases

  • Performance of contract (Art. 6(1)(b) GDPR): account management, provision of the Synapse app, cloud sync.
  • Legitimate interest (Art. 6(1)(f) GDPR): IT security, abuse detection, server logs.
  • Legal obligation (Art. 6(1)(c) GDPR): retention obligations under UGB / BAO for invoices (7 years).
  • Consent (Art. 6(1)(a) GDPR): where we explicitly request your consent.

4. Retention period

  • Account data: until you delete the account. Invoice-related data is retained for 7 years under UGB/BAO and then deleted.
  • Notebook content: until you delete it. When you delete your account, all content (including cloud storage) is deleted immediately and irreversibly — there is no recovery window.
  • Trash and earlier versions: Deleted notebooks, folders and pages first stay in the trash for 30 days so you can restore them on any device. After that they are permanently deleted automatically. Images, audio recordings and PDFs you remove from a notebook are kept for another 10 days, earlier versions of a notebook (version history) for 8 days. Only you can access them, never anyone through sharing. To delete permanently right away, use “Delete permanently” or “Empty trash”.
  • Server logs: automatically rotated after 14 days.
  • AI usage data: daily statistics retained for a maximum of 30 days.
  • Handwriting samples: until you delete them or delete your account.

5. Recipients

We share data with the following recipients. The role is stated with each entry: processors act solely on our instructions and under a contract pursuant to Art. 28 GDPR; independent controllers decide on the processing themselves and set this out in their own privacy policy.

  • IONOS SE (DE) — server hosting. Processor.
  • Cloudflare R2 (Cloudflare, Inc., US) — object storage for notebook snapshots. Processor.
  • Stripe Payments Europe, Ltd. (IE) — payment processing. Independent controller: Stripe determines the use of payment data itself, not least because of regulatory and anti-money-laundering obligations. Privacy: stripe.com/at/privacy.
  • Google Ireland Limited (Gemini API) — AI processing for handwriting, math, chat and audio, as well as speech output (study podcast). Processor. Privacy: policies.google.com/privacy. Note: content is not used for model training under Google's terms.

6. Transfer to third countries

If data is transferred to third countries outside the EU/EEA (e.g. Google in the US), this is done on the basis of Standard Contractual Clauses of the EU Commission and/or within the framework of the EU-US Data Privacy Framework, which Google and Cloudflare have joined.

7. Cookies, analytics and similar technologies

This website uses no advertising or third-party tracking cookies. For operation we use functional browser storage (localStorage/sessionStorage, e.g. for your sign-in session and language preference) and a few strictly necessary cookies (e.g. cookie notice, theme selection).

Anonymous analytics: To improve the website we collect anonymous usage statistics with our own privacy-friendly system (no third party): the page visited, the referrer, language, a rough device category and click/funnel events (e.g. "plan clicked"). To recognize a device, a random, anonymous identifier is stored in localStorage. No IP addresses are stored and no data is shared with third parties. Analytics only run with your consent via the cookie banner (Art. 6(1)(a) GDPR, § 165(3) Austrian TKG 2021). You can withdraw it at any time via "Cookie settings" at the bottom of every page; the identifier is then deleted from your browser.

8. Your rights

You have the right at any time to:

  • Information (Art. 15 GDPR) — which data do we have about you?
  • Rectification (Art. 16 GDPR) — have incorrect data corrected.
  • Erasure (Art. 17 GDPR) — "right to be forgotten". Can be exercised any time in the app under Account → Delete account.
  • Restriction of processing (Art. 18 GDPR).
  • Data portability (Art. 20 GDPR) — export of all your data as ZIP.
  • Objection (Art. 21 GDPR).
  • Complaint to the supervisory authority: Austrian Data Protection Authority (DSB), Barichgasse 40–42, 1030 Vienna.

To exercise your rights, an informal email to support@synapse-app.at is sufficient.

9. Data security

  • All connections are encrypted (HTTPS).
  • Passwords are stored exclusively as a cryptographic hash — never in plain text, neither in logs nor in the database.
  • Access tokens, too, are held server-side only as a hash.
  • The database is backed up daily and the backups are kept encrypted.
  • The server is protected by a firewall, automatic blocking after repeated failed sign-ins, and regular security updates.

10. Changes to this privacy policy

We reserve the right to adapt this privacy policy if features or legal situation change. Material changes will be communicated in the app and by email.

Note: This template provides a legally compliant starting point but does not replace individual legal advice.