1 Who we are
Synclo is made by Synclo Inc., a Delaware corporation (“Synclo”, “we”, “us”). This policy covers synclo.app, the Synclo app, and synclo.site, where documents shared from Synclo are read (each workspace’s links live at its own address there, such as your-team.synclo.site). For anything about your data, write to privacy@synclo.app.
2 What we collect
- Your account: your email address and name. If you sign in with Google or Microsoft, the basic profile that service shares with us: your name, email address and a link to your profile picture.
- What you make: your documents; the brief behind each one (the line you typed, or the text you pasted, attached or brought in from a file or a link); your themes and logos; the images you upload or generate, with the prompts behind them; and each document’s settings.
- Workspaces: the workspaces you belong to, your role in each, who invited you, and the invitations you send (the invitee’s email address, and a hash of the invite’s secret).
- Sharing settings: whether a document is shared and, if you set a password, a salted hash of it. We never store the password itself.
- Reading of shared links: how a document’s link is read, with nothing that identifies the reader unless the link was made for them or asked for their email. See When you read a shared document.
- Technical data: our hosting provider records requests to our servers, including IP addresses, browser type and error details, so we can keep Synclo running and secure.
- Cookies and browser storage: see Cookies and browser storage.
Payments: Stripe sells Synclo’s plans and credit packs to you as the merchant of record, and handles your card or other payment details; we never see or store them. We keep your workspace’s plan, its credits and their history, and Stripe’s references for your subscription and invoices.
3 How we use it
- To run Synclo: sign you in, save and show your documents, make the documents and images you ask for, export PDFs and serve the links you share.
- To send the emails your account works through (sign-in codes, invitations from your team and one reminder before an invitation ends, a change to your role or access, a welcome, one email about the first person to read something you shared, notices about your account), and emails about your work that you can turn off in Settings › Email or in a document’s Share: mentions, when someone you invited joins, a link about to end, and who read a document you shared. Our emails carry no tracking pixels, and their links aren’t rewritten. We don’t send marketing email.
- To keep Synclo secure and working: stop abuse, fix errors and enforce our Terms.
- To answer you when you write to us.
We don’t sell your personal information. We don’t show ads or use advertising trackers, and we don’t track you across other sites. On synclo.app we use Google Analytics to learn how people find and use Synclo (see Cookies and browser storage). Shared documents and published sites carry none of it: how they’re read is counted by Synclo itself, described below. We don’t use your content to train AI models.
4 AI processing
When you ask Synclo to write, revise, check or make something, we send what that task needs to an AI model. That can be your brief, the document’s text, your instructions, and for images the prompt and any reference images. To check a draft’s layout, we also send pictures of its pages.
Files you bring in (a PDF, a Word or PowerPoint file) are read in your browser; the file itself isn’t sent to us. Its words become the document’s brief, as pasted text does, and the images you keep from it are stored with your documents. If some pages are pictures of text and you choose to have their words read, pictures of those pages are sent to an AI model to read them.
Requests to Anthropic’s Claude models, which do most of the writing, usually go to Anthropic directly. The others go through OpenRouter, which passes each one to the model provider we use for the task, such as Anthropic, Google, OpenAI, Black Forest Labs, ByteDance or Recraft. They process the request to return the result. Anthropic doesn’t train its models on requests sent to it this way, and we tell OpenRouter to use only providers that don’t train AI models on the content they’re sent. Providers may still keep requests for a limited time, for example to detect abuse, under their own privacy terms.
When an image’s background is removed (you choose Remove background, or Synclo makes a cut-out for a document), the image goes to Replicate instead, which runs the model that cuts out its subject. Replicate deletes the image and the result within an hour.
6 What you share
- In a workspace with other people, a document is private to whoever made it until they share it with the team. The team can then view, edit or fully share it, as they chose. The workspace’s admins can’t open private documents, and they can turn off public links.
- Anyone with a shared document’s link can open it. You can add a password, and you can turn the link off at any time.
- A shared link shows its readers your name, as the person who shared it.
- While a link is on, Synclo counts how it’s read (see When you read a shared document), and the people who can edit the document see those counts. Speaker notes are never part of a link, an embed or a PDF.
- A link lives at your workspace’s address, followed by the first few words of the document’s title (your-team.synclo.site/r/the-plan-…): the address is a team’s name by default, two random words for a personal workspace, and you can change it in Settings › Publishing. Anyone who sees the link sees those words; a document’s main link carries none while it has a password, and links sent before a document was renamed keep their earlier words.
- When a link is pasted into a chat, an email or a post, that service shows its title, a line from the document and a picture of its cover, and may keep them. Behind a password only the title shows; a link that asks for an email shows its subtitle, never the document’s words.
- Search engines never list shared links.
- A document you publish to the web is a public website at its own address (your-plan.synclo.site, or a domain your workspace connected). Anyone can open it. It shows the version you published until you update it, search engines list it only if you turn indexing on, and unpublishing takes it off the web. A site’s address is yours while the site exists; an address given up is held for a year before anyone else can take it.
- Images are stored at long, unguessable web addresses. Anyone who has an image’s address can open it, even without the document it’s in.
- Embedded videos, forms and pages load from the services that host them when someone views the document, and those services’ policies apply.
7 When you read a shared document
When you read a document through its link, Synclo counts the reading for the people who can edit it. Every shared link’s page links to this policy (“Privacy”); a document embedded in another site counts no reading.
- What’s recorded: how long you read, which sections you read and for how long, the section on screen when you last read (so the sender can see someone is reading now), the kind of device (for example “Mac” or “iPhone”), whether you presented it, which link you came through, and when.
- What isn’t: your IP address (our hosting provider’s request logs keep it for a short time, as under “Technical data”, but it isn’t stored with your reading), and on an ordinary link your name or email address. Synclo sets no cookie and stores nothing in your browser to count a reading, so a return visit can’t be linked to an earlier one, and nothing follows you to other sites. (Two cookies, below, only tell your own team’s reading apart, and hold no reading.)
- A link made for you: the sender can make a link for one person and give it a name (yours, for example). Reading through it shows under that name.
- A link that asks for your email: you type your email before reading, and the sender and their team see it with your reading. A cookie (
sy_e_…) remembers it for that link for 30 days, so you aren’t asked again. - An email to the sender: when you finish reading a link made for you, or one where you gave your email, the document’s owner may get an email saying so, with the sections you read and for how long, at most once a day. Separately, the first time anyone reads something a person has shared, that person gets one email about that reading, whether or not the reader was named. It comes once for each account, never again.
- What counts: only reading. A visit is recorded after a few seconds with the page in view and someone scrolling, moving or typing. Time stops when the page is hidden or left idle. Link previews and email security scanners aren’t counted, and neither are the document’s owner or their team. To know them, a browser’s first visit to a workspace’s address in a week passes once through synclo.app, which checks whether that browser is signed in to Synclo as one of the workspace’s members, and comes straight back.
- Who sees it: the people who can edit the document.
- How long: 12 months.
8 When you visit a published site
A published site counts its visits for the people who can edit its document, the same way as a shared link (see When you read a shared document), with two additions, and with no cookie and nothing stored in your browser.
- Where you came from: the site that sent you there, as its name only (for example “linkedin.com”), or the campaign name in the address you followed (its
utm_source). Never the full address of the page you came from. - Your country: worked out from your network address where our servers receive the request. The address itself isn’t kept with the visit.
- The site owner’s own analytics: a site’s owner may add Google Tag Manager or Meta Pixel to measure their visitors. Those are the owner’s, set Google’s or Meta’s cookies, and fall under the owner’s and those companies’ policies. Where the law requires your consent, the site asks first and they run only after you accept; your answer is kept in your browser on that site. A browser that sends Global Privacy Control is taken at its word: they don’t run, and you aren’t asked.
- Who sees it, and how long: the people who can edit the document, for 12 months.
- Custom domains: when a workspace connects its own domain, Synclo looks up the domain’s public DNS records (through Google’s and Cloudflare’s public DNS services) and Google issues the domain’s security certificate.
9 Where your data is stored
Our database, files and servers are in Singapore. AI providers and email services may process requests in other countries, including the United States. For those transfers we rely on the safeguards our providers offer.
11 How long we keep it
- Your account and content: for as long as your account exists.
- Documents you delete go to the Trash and stay there until you delete them forever. Images you delete are removed from storage.
- You can delete your account yourself, in Settings. It’s deleted at once, with your private documents, the images only they use, and any workspace where you’re the only member. Documents you shared with a team stay with that team, looked after by its admins. If you ask us instead, we do the same within 30 days.
- If you leave a workspace or are removed from it, what you shared stays with the team and your private documents move to your own workspace.
- Server request logs: 30 days.
- Reading counts on shared links: 12 months.
- Reports about a shared page: the reason, any words and email address the reporter gave, and a one-way hash of their IP address (to spot floods), kept until the report is resolved and for 12 months after. Our abuse team is emailed that a report came in, with the page and the reason, never the reporter’s words or email address.
- Anything the law requires us to keep, for as long as it requires.
12 Your rights and choices
- See and change your content in Synclo at any time, and download any document as a PDF.
- Delete documents, images and themes yourself, and delete your account in Settings.
- Ask us for a copy of your personal data, to correct it, or to delete your account for you, at privacy@synclo.app. We answer within 30 days.
In the EU, EEA, UK or Switzerland
You have the right to access, correct, delete, restrict or port your data, and to object to how we use it. You can also complain to your data protection authority. We use your data to provide the service you asked for (a contract), to keep it secure (our legitimate interests), and to meet legal obligations.
In California
You have the right to know what we collect, to delete and correct it, and not to be treated differently for using these rights. We don’t sell your personal information or share it for cross-context behavioral advertising.
13 Security
Synclo runs over HTTPS. Each account can reach only its own content and what its workspaces share with it, share passwords and invite secrets are stored only as hashes, and sign-in links, codes and invites expire. No system is perfectly secure, so if you find a problem, tell us at privacy@synclo.app.
14 Children
Synclo is not for anyone under 16. We don’t knowingly collect data from children under 16, and if we learn we have, we delete it.
15 Changes to this policy
When we change this policy, we update the date at the top. If a change is significant, we tell you by email or in Synclo before it takes effect.
16 Contact
Synclo Inc. · privacy@synclo.app