Privacy Policy

This Privacy Policy explains how SYNQ handles your personal data. SYNQ is operated by Sascha Kissling as a sole proprietorship (Einzelunternehmen) under Swiss law: Sascha Kissling Grindelstrasse 59b 8604 Volketswil Switzerland admin@joinsynq.ch For privacy-related inquiries, write to admin@joinsynq.ch. We aim to respond within 14 days. This policy applies to our website at joinsynq.ch and our mobile apps for iOS and Android.

We collect the following categories of personal data: Account information — email address, password hash, display name, profile photo (optional), date of birth. Profile information — bio, languages spoken, interests, activity preferences, home neighborhood (if you choose to set one). Activity data — activities you host, activities you've joined, RSVPs, circles you're a member of. Communication data — chat messages and connection requests (stored for delivery; not used for advertising or mining). Usage data — pages visited, features used, time spent, app version. Device data — IP address, device type, operating system version, locale, timezone. Location data — precise GPS coordinates (only when you grant permission; only while using the app). AI interaction data — text prompts submitted to AI features (for draft generation, content moderation, or image generation). Generated outputs are stored as part of your content. Sign-in and password-reset attempts while signed out — if a sign-in fails, or a password reset is requested or completed, on a device that is not signed in, the app or website reports the type of attempt, the screen, the failure category and the sign-in method. Our server adds whether the request came from a verified copy of our app or website and a keyed pseudonym of your network address (not the IP address itself). We do not record your email address, your user ID or browser details for these attempts.

We use personal data to: • Operate the service (delivering messages, showing activities near you, authentication). • Personalize your experience (suggested activities, smart scheduling). • Safety and moderation (automated content and image screening via AI). • Analytics (understand feature usage in aggregate — never at an individual level for ad targeting). • Fraud prevention and platform security. • Legal compliance (responding to lawful requests, enforcing our Terms of Service). Legal bases under GDPR Art. 6 and Swiss FADP Art. 31: performance of contract (providing the service you signed up for), legitimate interest (safety, fraud prevention, analytics at aggregate level), and consent (AI features, optional location, tracking on iOS via ATT).

SYNQ uses AI features to help you discover activities, draft posts, search, generate images, and tag activities. These features use Google's Gemini models (text) and Google Gemini image models (banner images and avatars), which SYNQ accesses through the Gemini API. When you use an AI feature, the information you provide (for example, a draft activity description or a search query) is sent to Google's servers for processing. This includes automatic activity tags: when you create an activity, SYNQ sends its title, description and category to Gemini, which suggests a few short tags that help other members find the activity; in the app, this happens only if you have not entered any tags yourself. Google processes this data under the Gemini API terms for paid services: it does not use this data to train its models, but keeps it for a limited period to detect abuse. Google does not guarantee a processing region for these requests. These features work only after you have given your AI consent, and we transmit only the minimum information necessary — we do not send your connections, your messages to other users, or private profile information to AI services unless you explicitly use a feature that requires it. You can choose not to use AI features at any time; non-AI features of SYNQ work independently of these services. Automated safety checks — independently of your AI consent, SYNQ also uses Gemini to check content for safety, based on our legitimate interest in protecting members from harmful content (Art. 6(1)(f) GDPR / Art. 31 FADP). What is sent: the title, description, category and other text of an activity (for example location, requirements, tags, links, items needed, and the question and options of a poll) when you create the activity, change its text or add a new poll to it; profile photos and activity images you upload (uploaded activity images are also screened by Google Cloud Vision SafeSearch); and each new message in activity and circle group chats, together with up to five previous messages from the same chat and the senders' display names. Direct messages are not checked. If a message could cause conflict, only its sender sees a private suggestion to rephrase it; clearly hostile messages may also be flagged for review by the SYNQ operator. Google processes these requests under the same Gemini API terms and does not use them to train its models. Waitlist suggestions — when you join the waitlist of a full activity, SYNQ may use Gemini to rank similar open activities to suggest to you. Only public details of those activities (title, category, tags, location, time and free spots) are sent, no information about you. Organization AI allowances — this applies only once SYNQ turns this feature on. A company universe can then have a monthly AI allowance. When you use an AI feature for its content (for example a draft or a banner for one of its activities), the use counts against that allowance. To apply per-person limits, SYNQ keeps a monthly count per person for up to two months. Organization owners see only totals — in larger organizations also per feature and per day — never who used AI. AI avatars — with SYNQ Pro or a higher plan, you can create a profile picture with AI from a short description and a style you choose. SYNQ sends only the description and the style to the Google Gemini image models, never a photo of you. Gemini checks the description before the image is made and the generated image before you see it; Google Cloud Vision SafeSearch also screens the image. SYNQ keeps no copy of a preview you do not use. Once you use an avatar, it is stored as your profile picture file and shown on your profile with an "AI avatar" label (app versions before 1.4.0 show it without the label); the file also carries a machine-readable "AI-generated" marker next to Google's SynthID watermark. It stays there until a new picture you upload in the app or a new avatar replaces it, until you remove your picture or choose another one on the website, until the profile-picture check removes it, or until your account is deleted. Removing your picture, or choosing another one on the website, takes it off your profile and deletes that file. If saving your profile fails after you use an avatar and you do not save it again, the avatar is not shown on your profile, but its file stays until a new picture you upload in the app or a new avatar replaces it, until the profile-picture check removes it, or until your account is deleted. A description our safety filters flag is kept, shortened to 200 characters, with the AI safety logs; usage records note the style, the model and the outcome, never the description (section 7).

We share personal data only with the following service providers and only to the extent necessary for the stated purpose. Google, Sentry, Resend and — once paid billing is activated — Stripe act as our processors under their standard data processing terms. Apple and Meta process sign-in data as independent controllers under their own terms. Google LLC (United States) — Firebase and Google Cloud services: Firestore database, Cloud Functions and web hosting in us-central1 (Iowa); Cloud Storage for uploaded photos and media in us-east1 (South Carolina); Authentication, Cloud Messaging, Google Analytics for Firebase, App Check and Crashlytics on Google's global infrastructure. Also the Gemini API (Gemini text and image models for AI features), Cloud Vision (image safety screening), Google Maps (activity locations) and Google Sign-In (optional authentication method). Transfer basis: Swiss–U.S. Data Privacy Framework (active since September 2024), EU–U.S. DPF, and Standard Contractual Clauses as fallback. For users in the European Economic Area, the contracting entity is Google Cloud EMEA Limited, Ireland. Meta Platforms, Inc. (United States) — Facebook Login (if you choose it) and Facebook SDK app events, as an independent controller under Meta's terms. On iOS, app events and advertising-identifier collection stay off unless you grant App Tracking Transparency permission; on Android they are disabled. We also set Meta's Limited Data Use option, which Meta applies to users in applicable US states. Apple Inc. (United States) — Sign in with Apple (for users who choose this method) and SKAdNetwork (privacy-preserving ad attribution), as an independent controller under Apple's terms. Stripe Payments Europe, Ltd. (Ireland) and Stripe, Inc. (United States) — payment processing for paid subscriptions once paid web billing is activated. Paid billing is not active yet, so no payment data is shared with Stripe today. Functional Software, Inc. d/b/a Sentry (United States) — error monitoring and crash reporting. SYNQ's error reports are stored in Sentry's EU data region (Frankfurt, Germany). Transfer basis: Standard Contractual Clauses. Resend, Inc. (United States) — transactional email delivery (invitations, password resets, notifications). Transfer basis: Standard Contractual Clauses. Content loaded from other providers — some images and files are loaded directly from other providers' servers. Your browser or the app then sends your IP address and technical request details (such as browser or device type) to these providers, which process them under their own terms: • Default profile pictures: members without an uploaded photo get a generated picture from Vercel Inc. (avatar.vercel.sh, United States), on the website and in the app; the image address contains that member's SYNQ user ID. • Default activity images: activities without an uploaded image show a stock photo from Unsplash (images.unsplash.com), on the website and in the app; the website also uses some Unsplash sample images. • Older profile photos: some older profiles still show a photo taken over from the member's Google or Facebook account; it is loaded from Google's servers or, in the app, from Meta's servers. • Map view in the app: the map library is loaded from unpkg.com and the map tiles from OpenFreeMap (tiles.openfreemap.org); OpenFreeMap also sees which map area is displayed. Calendar services you choose — if you add a SYNQ activity to your calendar or create a calendar subscription link (available only once SYNQ turns this feature on), the calendar service you choose (for example Apple, Google or Microsoft) receives the title, time and place of your SYNQ activities and processes them under its own terms. Anyone who has your subscription link can see the same details until you reset or turn off the link. We do not sell personal data. We do not share data with third-party advertisers except for the privacy-preserving SKAdNetwork and Facebook attribution events described above, and only on iOS when you have granted App Tracking Transparency permission (default off).

SYNQ runs on Google Cloud and Firebase in the United States. The Firestore database, Cloud Functions and web hosting are in us-central1 (Iowa); uploaded photos and media are stored in Cloud Storage in us-east1 (South Carolina). Firebase Authentication, Cloud Messaging, Crashlytics, Google Analytics for Firebase and App Check run on Google's global infrastructure, primarily in the United States. AI requests go to Google's Gemini API (Gemini text and image models) and Cloud Vision, for which Google does not guarantee a processing region. Error reports are stored by Sentry in its EU data region (Germany). Email is sent by Resend (United States). For Swiss users: transfers to the U.S. rely on the Swiss–U.S. Data Privacy Framework (adequacy decision in force since September 2024). For EEA users: transfers to the U.S. rely on the EU–U.S. DPF, with Standard Contractual Clauses as fallback. For UK users: UK Extension to the EU–U.S. DPF, with the UK International Data Transfer Agreement as fallback. Where Google, Sentry, Resend and Stripe are certified under the relevant Data Privacy Frameworks, we rely on that certification; in addition, we rely on the Standard Contractual Clauses incorporated in each provider's data processing terms. Apple and Meta process sign-in data under their own terms as independent controllers.

Account data — retained for the life of your account. Requesting deletion for a registered (non-anonymous) account starts a 30-day grace period. After it expires, account data is deleted or anonymized; until then, you may explicitly cancel the request from Settings. Explicit cancellation keeps existing account data, but it does not restore AI consent; you must consent again before using AI features. Authenticated anonymous or guest accounts with an existing SYNQ profile are instead queued for irreversible deletion immediately and cannot be cancelled. Chat messages — retained while your account is active. Anonymized on account deletion (your name replaced with "Deleted user"; your connections can still read the conversation history they were part of, but cannot identify you). Activities you hosted — retained for historical record to other attendees. Your name anonymized on deletion. Moderation logs — retained 12 months from creation, for safety audit purposes; then deleted. Security and audit records (for example failed sign-in attempts, consent given or withdrawn, account deletion requests, plan and subscription changes, and administrator actions) — kept for 90 days, 12 months or up to 7 years depending on the type of event; records of consent, account deletion, plan changes and administrator permissions are kept for up to 7 years as evidence. They can contain your user ID, email address, IP address and browser details. When your account is deleted, your user ID, name, email address and the event details are removed from them; the remaining entry (event type and time and, where recorded, the IP address and browser details) is kept until its period ends. Sign-in and password-reset attempts made while signed out are kept for 90 days and contain only the details listed in section 2 — never an email address, user ID, IP address or browser details. Because they are not linked to an account, deleting your account does not remove them and data exports do not include them. The key behind the network pseudonym is replaced at least every 90 days and the old key is destroyed, so older entries can no longer be matched to a network address. AI usage and safety logs (including prompts and avatar descriptions flagged by our safety filters) — 12 months, then deleted. Demo and contact requests (name, email, company or group, message, IP address, browser details) — 12 months, then deleted. Email delivery records — about 1 month. Email block records — if an email to you bounces permanently or you mark it as spam, we keep a keyed hash (HMAC) of your address (not the address itself) and the reason, without a time limit and also after account deletion, so that SYNQ never emails that address again. Personal weekly summaries — deleted after 90 days. Organization audit logs — this applies only once SYNQ turns this feature on. Then, if you belong to or ask to join a private universe (for example your company), its owner can see and export a record of administrative events there for 12 months, such as joins, join requests and decisions on them, invitations, removals, role and ownership changes, offboarding, settings changes and data exports. Moderators the owner authorizes can see the member and content events. The record shows your display name, never your email address or IP address. When your account is deleted, your name is removed from these entries; copies the organization has already exported are the organization's responsibility. Calendar subscription links (available only once SYNQ turns this feature on) — kept until you reset or turn off the link or delete your account. After that, the old link shows an empty calendar for 30 days so that subscribed calendars remove the events; during that time we keep only a one-way hash of the old link. Server access logs — 30 days. Aggregated analytics (no personal identifiers) — indefinite. Error reports, crash reports and app analytics — kept by Sentry, Firebase Crashlytics and Google Analytics for Firebase according to their retention settings. Recovery copies — the database keeps prior versions for up to 7 days (point-in-time recovery), and deleted uploads remain recoverable for 7 days. Google then removes residual copies from its systems within the period set in its cloud data processing terms.

Under GDPR (Art. 15-22) and Swiss FADP (Art. 25-28) you have the right to: • Access — request a copy of your personal data (Profile → Settings → Data Export, or email admin@joinsynq.ch). • Rectification — edit directly in your profile, or email. • Erasure — for registered (non-anonymous) accounts, Profile → Settings → Delete Account starts a 30-day grace period, and you may explicitly cancel before the scheduled date. Authenticated anonymous or guest accounts with an existing SYNQ profile are instead queued for irreversible deletion immediately and cannot be cancelled. • Restriction — email admin@joinsynq.ch to restrict specific processing activities. • Portability — data export is JSON format, machine-readable. • Objection — opt out of AI features in Settings. Our website does not use analytics cookies. In the mobile app, Meta app events are sent only if you allow tracking on iOS. To object to other processing, email admin@joinsynq.ch. • Withdraw consent — where processing is based on consent (AI features, optional location, ATT tracking), you can withdraw at any time. • Right to complain — Swiss users may contact the Federal Data Protection and Information Commissioner (FDPIC) at https://www.edoeb.admin.ch. EEA users may contact their national data protection authority. UK users may contact the Information Commissioner's Office.

Our website uses the minimum cookies necessary to operate: session tokens for authentication, and preference cookies for your language and your light or dark appearance. Platform administrators can also set a cookie that previews a design on their own browser. We do not set third-party advertising cookies. We do not engage in cross-site tracking on joinsynq.ch. On mobile, the iOS App Tracking Transparency prompt controls whether Facebook SDK events may be transmitted with identifier-for-advertiser data. If you decline, we use only privacy-preserving SKAdNetwork attribution.

You must be at least 16 years old to create an account. This aligns with GDPR Art. 8 (digital consent threshold in most EU member states, including Germany and Ireland) and Swiss FADP capacity-of-judgment doctrine. We do not knowingly collect personal data from anyone under 16. If you learn that a child has created an account, contact admin@joinsynq.ch and we will delete the account within 48 hours of verification.

Precise location is accessed only when you grant explicit permission through your device settings. On iOS, we request "While Using the App" access — never "Always" background access. On Android, we request foreground-only location. Location is used in-session to show activities near you and is not stored on our servers beyond the session, except for a home neighborhood you explicitly pin and the approximate area described in section 12 if you turn on "People Near You". Location is never shared with advertisers and is never used for ad targeting. You can revoke location permission at any time in your device settings; the app remains functional with a city-level default.

If you enable "People Near You", we store an approximate location for you so we can show you nearby members and show you to them. This feature is off by default and relies on your explicit consent (Art. 6(1)(a) GDPR / Art. 31 FADP). • What we store: only a coarse area identifier — an approximately 5 km grid cell, plus your district (Kreis) in Zurich. We do NOT store your exact coordinates: your device sends them to our server once, which computes the coarse cell from them and then discards them. • Why: to power neighbourhood discovery — surfacing nearby members you might want to connect with, and (for Pro members) to improve the relevance of connection suggestions. • Visibility: your approximate area is never shown to other members or made readable by them; it is used only by our servers to match you with nearby people. Other members see only your normal public profile. • Your control: you can turn "People Near You" off at any time, which immediately deletes your stored area. It is also deleted when you delete your account.

Data in transit is encrypted with TLS (version 1.2 or higher). Data at rest is encrypted with AES-256 (Google Cloud default encryption). Passwords for email/password accounts are managed by Firebase Authentication, which hashes them with a modified scrypt algorithm; federated sign-in uses OAuth 2.0 / OpenID Connect. In the event of a personal data breach likely to result in risk to your rights and freedoms, we will notify affected users and the relevant data protection authority within 72 hours of discovery, per GDPR Art. 33–34 and FADP Art. 24.

We may update this Privacy Policy to reflect changes to our practices, technology, or legal requirements. Material changes will be announced via in-app notification and by email to the address on your account. The "Last updated" date at the top of this policy reflects the most recent version. Continued use of SYNQ after the effective date constitutes acceptance of the updated policy. When you accept the Terms of Service, this Privacy Policy and the Community Guidelines, we record which version of each document you accepted and when.

For any privacy questions, to exercise your rights, or to submit a complaint: Sascha Kissling (operating as SYNQ) Grindelstrasse 59b 8604 Volketswil Switzerland admin@joinsynq.ch We are not required to appoint a Data Protection Officer under Swiss FADP for a controller of our current scope. All privacy matters go to admin@joinsynq.ch.