Back to site

Synapser Privacy Policy

Last Updated: October 4, 2026

1. Introduction

Synapser S.R.L. ("Synapser", "we", "us", or "our") is a company incorporated in Italy, with its registered office at Via Timavo 34, 20124 Milan, Italy. Synapser is a mobile productivity App that brings together email, calendar, notes, and tasks in one place, helping users manage their information, schedules, and commitments more easily. Certain features may also include AI-powered suggestions intended to help users organize and act on their information more effectively.

Synapser is a productivity tool, not a legal archiving, compliance retention, or records-management service. Users remain responsible for any legal, regulatory, retention, recordkeeping, or compliance obligations applicable to their own communications, documents, and records.

When you use the Synapser mobile App and related services (collectively, the "Services"), you trust us with your Personal Data. We take that responsibility seriously. We do not sell your Personal Data, and we do not monetize your content. Our business model is based on a paid subscription.

This Privacy Policy ("Privacy Policy" or "Policy") explains how we collect, use, disclose, and otherwise process Personal Data in connection with the Services. Please read it carefully. This Policy should be read together with our Terms of Service, which govern your use of the Services. By accessing or using the Services, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with it, you should not use the Services. You may exercise your rights in relation to your Personal Data as described in this Policy.

Synapser provides the Services to individual users, including where you choose to use the Services for business or professional purposes or connect an account provided or managed by your employer or another organization. If you connect such an account, you are responsible for ensuring that you are authorized to do so and that your use of the Services complies with any applicable organizational policies and requirements. Synapser acts as the data controller for the Personal Data it processes in connection with your use of the Services, as described in this Privacy Policy.

2. Privacy Policy Updates

We may revise this Privacy Policy from time to time. When we do, we will post the updated version on our website and within the App, and update the "Last Updated" date at the top of this Policy. We encourage you to review this Privacy Policy periodically. If we make material changes, we will notify you directly by email or through the App before those changes take effect. If you continue to use the Services after the updated Privacy Policy becomes effective, you will be deemed to have acknowledged the updated Policy. Updating this Privacy Policy or continuing to use the Services does not mean that you consent to optional data processing. If we need your consent for a new or changed use of your Personal Data, we will ask you separately before we begin. You can refuse or withdraw your consent at any time.

3. Information We Collect

For purposes of this Policy, "Personal Data" means any information relating to an identified or identifiable individual. This includes information that you provide directly, information that we receive from connected providers, and information that is generated when you use the Services.

Synapser is not designed to request, identify, classify, infer, or intentionally collect special categories of Personal Data, such as health information, political opinions, religious beliefs, trade union membership, or similar sensitive information. However, because the Services allow you to connect, store, search, process, and manage content from your email, calendar, task, note, and contact providers, such information may be present in content that you choose to connect, create, import, or upload. We process that content only to provide the Services you request. Where we rely on consent, we process the relevant content only with your explicit consent.

Account information. When you register for an account, you sign in using a third-party identity provider, such as Apple, Google, or Microsoft. The provider may share certain account details with us, such as your name, email address (including, where applicable, an Apple private relay email address), profile photo, and a unique account identifier. Our authentication service also assigns a unique user identifier to your account, which we store and use to manage your account. When you connect an email, calendar, task, or contact provider, we receive the information and authorization credentials necessary to maintain that connection. For Google and Microsoft accounts, we do not receive your account password; access is provided through authorization tokens issued by the provider. For IMAP accounts, including iCloud Mail, you may provide an app-specific password. Authorization tokens and app-specific passwords used to maintain connected accounts are encrypted before they are stored. To use the App, you must connect at least one existing email account to Synapser. You may connect additional accounts at any time. Synapser does not provide you with a new email address and does not host your email service; it enables you to access and manage existing accounts through the Services.

Email, Calendar, Tasks, Notes, and Contacts. When you connect and authorize supported providers or device-level integrations, or create content directly in Synapser, we access, receive, sync, store, and process the content that you choose to make available through those connections. Depending on the provider and feature used, this may include: email messages and drafts, including subjects, body content, sender/recipient addresses, threading and folder/label structure, attachment metadata and content references, and email-management actions such as muted threads, snoozed messages, follow-up reminders, and scheduled sends; calendar events and related details, such as titles, descriptions, participants, dates, times, locations, recurrence rules, conference links, reminders, and calendar list metadata, and, if you choose to attach a Google Drive file to an event, the metadata of that file (such as its name, type, size, modification date, thumbnail, and link), and, if you choose to attach a Google Drive file to an email or a note, the metadata of the file you select through Google Picker and a copy of that file (for Google Docs, Sheets, Slides, and Drawings, the PDF or Office export you choose), which becomes an attachment of that email or note; tasks, reminders, labels, due dates, completion status, priority, URLs and linked resources, location-based reminders, and checklist items/subtasks where providers expose them (including Microsoft To Do checklist items); contacts and address-book information, such as names, email addresses, phone numbers, postal addresses, organizations, job titles, and birthdays; and notes that you create directly within the App — including note text, formatting, color, pin/archive/trash status, attachments, version history, sharing and collaboration metadata, and location-based reminders — and notes and related content that you choose to import from third-party tools or files. We use this information to provide the core functionality of Synapser, including unified inbox and dashboard views, search, synchronization across connected sources, reminders, sharing features, scheduled send, and other features you choose to use. Some integrations rely on permissions granted through third-party providers such as Google or Microsoft, while certain Apple data may be accessed through on-device APIs and then synced to our systems to support the Services. Synapser uses contact information to provide contact-related features, such as email autocomplete and contact details, and, if you enable AI Suggestions, to match people named in your emails or notes to known calendar-invitation addresses as described below. Synapser does not create, edit, or delete contacts in connected providers. When you set a location-based reminder on a note or on an Apple Reminders task, Synapser stores and synchronizes the selected place and reminder area (including the selected place name, latitude and longitude, geofence radius, and arrival/departure trigger) with your account so the reminder remains available across your devices. A location-based reminder on a Google Tasks or Microsoft To Do task is stored only on your device. iOS evaluates your device's current location to deliver the reminder. Synapser does not store a history of your movements or the times when your device enters or leaves the reminder area.

Settings and preferences. We store certain account preferences, such as your calendar, email, and task settings and your time zone, to provide Synapser and remember your choices. We also keep records of your privacy and consent choices so that we can apply them consistently and, where necessary, demonstrate compliance with applicable privacy requirements.

Communications with Synapser and feedback. If you contact us, including through support, customer service, surveys, or other feedback channels, we collect your contact details and any information you choose to share with us. This may include your email address, the content of your message, survey responses, ratings, opinions, feature requests, and any files, photos, videos, or other materials you submit. We use this information to respond to you, provide support, improve the Services, and understand user needs and preferences.

Illegal-content reports. If you report content that you believe is illegal, we collect the information you provide, including details identifying the content, your explanation, contact details, and any good-faith statement. We use this information to assess and respond to your report, take appropriate action, handle related complaints, and meet applicable legal obligations. We do not use this information for marketing.

Onboarding information. During onboarding, we may ask optional questions or request optional information to understand how users intend to use Synapser, improve the Services, and inform our product and marketing strategy. The specific questions or prompts may change over time. You may skip these questions, and doing so does not prevent you from using the core Services.

Technical information. We automatically collect certain technical information about your device and use of the Services. This may include IP address; device type and device identifiers; operating system and App version; language and time-zone settings; network and connectivity information; and diagnostic and performance information. Routine application logs use a stable, shortened hash instead of the resolved network address, although infrastructure providers may process IP addresses as necessary to route and secure requests and specific audit records may include an IP address. We do not continuously track your location. With your permission, we use geolocation data only as needed to provide the location-based features you choose to use, such as local weather, map directions, and location-based reminders. For note and task location reminders, iOS evaluates your current location; we do not store your movement history.

Usage information. We collect information about how you interact with the Services, such as: the features and functions you use (for example search, AI Suggestions, reminders, scheduling, and sharing); screens, pages, and content you access; searches you run (including original and normalized query forms, result counts, and response times); interactions with emails, tasks, notes, calendars, and other in-App content; timestamps and activity logs; and API request, security, and system logs.

Feature configuration. The App uses Firebase Remote Config and a Firebase installation identifier to retrieve operational settings, such as whether an optional feature is available. This does not grant consent for that feature or enable analytics or diagnostics. Email content, order details and tracking numbers are not sent to Firebase Remote Config.

Diagnostics and performance data. If you enable Diagnostics & Performance, we collect technical information about App crashes, errors, hangs, and performance. This may include device and operating-system information, App version, timestamps, stack traces, performance measurements, a pseudonymous account or session identifier, and analytics breadcrumbs. We do not intentionally attach the content of your emails, notes, tasks, or other User Content to diagnostic reports. Diagnostics & Performance is off by default and is collected only if you enable it. You can change your choice at any time in Settings.

Usage Analytics. If you enable Usage Analytics, we collect information about how you interact with the Services, such as usage events, feature interactions, screen views, device model, and App version, to understand usage patterns and improve the Services. Usage Analytics does not include the content of your emails, notes, messages, or other User Content. Usage Analytics is off by default and is collected only if you enable it. We do not use your data for advertising or targeted advertising, sell your Personal Data, or track you across other companies' apps or websites.

Push notification information. If you enable push notifications, we use device tokens and related messaging identifiers to deliver service notifications about emails, calendar events, tasks, reminders, and similar product events. If you also enable Diagnostics & Performance, we may collect limited delivery and performance information to help troubleshoot notification delivery. These records do not include notification titles, bodies, or the content of your emails, notes, tasks, or calendar events and are generally retained for approximately 30 days. We do not send marketing or promotional push notifications.

Security, legal, and consent records. We keep limited records needed for security and legal accountability, including relevant audit logs and technical metadata, the versions of legal documents you accepted or acknowledged, whether and when you confirmed that you meet the age requirement (not your date of birth), delivery of later legal notices, and your affirmative consent choices. When we rely on consent, we ask you to make a clear, affirmative choice. Receiving a legal notice or continuing to use the Services does not alter your existing consent choices or constitute consent to any additional optional Personal Data processing. We delete these records when you delete your account, except where limited retention is required or permitted by law.

User content. We collect and process content that you create in Synapser or otherwise make available through the Services, including notes, note and task attachments, tasks, reminders, labels, files, documents, images, videos, and other user-generated content. If you choose to add a photo or video from your photo library, we access, with your permission, only the photo or video you select and do not otherwise access your photo library. This includes photos you attach to a note, task, email, or support message, and videos you attach to a note, task, email, or support message. When you choose Save to Photos for a note image, Synapser requests permission only to add that image to your photo library; it does not read other photos. When you export a note as a PDF, Synapser creates the document on your device and shares it only with the destination you choose. Copies saved to your photo library or exported to other apps remain there independently of the original note and are not deleted when you delete the note or your Synapser account. If you choose to take a photo using your device camera, we access the camera, with your permission, only while you are using that feature and only to capture the photo you choose to add. If you choose to scan a document using your device camera, we access the camera, with your permission, only while you are using the scanning feature and only to create the document scan you choose to add. Photos and scanned documents may be attached to a note, task, or email. We do not otherwise access your camera.

Non-user information. Content made available through Synapser may include Personal Data relating to individuals who are not Synapser users, such as email correspondents, recipients, meeting participants, contacts, participants in chats you share to Synapser, or other individuals whose information appears in connected email, calendar, task, note, contact data, attachments, or content you share to Synapser.

We process this information as part of the content made available through a user's connected accounts and only as necessary to provide and operate the Services requested by the user, including synchronization, search, organization and other features selected by the user.

Synapser does not use Personal Data relating to non-users for direct marketing to those individuals or for purposes unrelated to providing the Services to the relevant user.

Where Synapser acts as a controller in relation to a separate processing of such Personal Data, we process that information only where permitted by applicable data protection law and comply with the applicable transparency requirements. Where the conditions of Article 14(5)(b) GDPR are satisfied, we may rely on that provision and take appropriate measures to protect the rights, freedoms and legitimate interests of the individuals concerned, including making this Privacy Policy publicly available.

AI Suggestions. Synapser offers optional AI-powered suggestions. If you enable this feature, Synapser may process relevant content from your email, calendar, tasks, notes, and recent AI-suggestion activity to generate and update suggestions. This includes the content of email and note attachments and of files you upload to tasks in Synapser, such as images, audio recordings, PDF documents, and plain-text files, and the names and email addresses of your Synapser and connected accounts, so that suggestions are made for you. When an email or note names a person in full, Synapser may also process matching names and email addresses from your synchronized contacts and email and calendar history to suggest event attendees. Each request includes at most 100 matching contacts, prioritized by usage frequency and recency, within the request size limit. These selected names and email addresses are sent to the configured AI provider; phone numbers, postal addresses, and other address-book fields are not included for this matching. Synapser omits uncertain matches, including first-name-only matches, conflicting names, and multiple known addresses for the same name. A proposed attendee is checked against the supplied source or contact evidence before it is saved, and sending invitations still requires your confirmation. For tasks, newly added files may trigger suggestions; saving a task without a new attachment does not. Audio is transcribed using OpenAI API models. PDF documents are sent to OpenAI for native processing, which extracts text and page images for AI analysis. Synapser does not retain additional working copies of attachment files, extracted text, or transcripts after AI processing. The attachments you save in Synapser remain stored with their email, note, or task as described in Section 12. AI Suggestions do not automatically create, modify, send, or delete content; you decide whether to accept, reject, edit, or ignore them. They may be inaccurate, incomplete, or inappropriate for your circumstances. Depending on our configuration, AI processing may be performed using Google Gemini Enterprise Agent Platform and/or OpenAI API models. Relevant content is transmitted securely to the configured provider and handled under the applicable enterprise or API data-processing terms. The providers do not use submitted API content to train their models by default, although they may temporarily retain it for service operation, security, or abuse monitoring subject to their terms and available controls. AI Suggestions require your explicit consent. If you do not enable AI Suggestions, Synapser does not process your content to generate them. If you later withdraw your consent, we stop generating or updating AI Suggestions and stop sending content to AI providers for that purpose from that point forward. Order tracking requires AI Suggestions and has its own separate consent, as described below, so withdrawing your consent to AI Suggestions also turns off order tracking. Previously generated AI Suggestions and related history remain in your account as described in Section 12. We do not use this information to train our own models.

Order tracking. If you separately enable order tracking, we analyze email content from your connected Gmail, Outlook and IMAP/iCloud Mail accounts to identify parcels with tracking numbers, including shipping labels received before dispatch. Relevant email content is processed in the regular email AI pipeline by the Google Gemini Enterprise Agent Platform and/or OpenAI API models under the terms and safeguards described above. We keep merchant and order references, item summaries, tracking numbers, carrier information, shipping dates, delivery estimates and status history, together with links to the source emails. We send Ship24 the tracking number and an opaque identifier and, when available, the carrier, shipping date and destination country so that Ship24 can obtain parcel updates from supported carriers worldwide. We do not send Ship24 email bodies, recipient names or street addresses, payment details or item summaries. We do not use this information for advertising or model training. Order tracking is optional. During first-time onboarding, AI Suggestions and Order Tracking are preselected, but these selections do not grant consent or start processing. You may change either choice before confirming with Enable Selected Features; the two choices are recorded separately. Returning to onboarding preserves your recorded choices. Order tracking is available only while AI Suggestions is enabled and requires its own consent; turning on the AI Suggestions switch alone does not enable order tracking. You can withdraw this consent at any time with the Order Tracking switch in the App's AI settings, and turning off AI Suggestions also turns off order tracking. Withdrawal stops new order analysis and parcel registration and starts removal of the derived data and remote tracking subscriptions as described in Section 12. Turning off order tracking does not turn off AI Suggestions.

Content you share to Synapser. If you share content to Synapser from another app and choose Find tasks and events, Synapser processes that content to generate AI Suggestions as described above. This may include an exported chat, text, photos, voice messages or other audio recordings, and PDF documents. Your device unpacks the shared content and sends only these supported types, within size and quantity limits, to our servers; other files, such as videos, are not sent. Synapser does not store the shared files, their text, or transcripts after processing. It keeps the resulting AI Suggestions, the name of the shared chat or file so that you can recognize where a suggestion came from, and records of usage and cost. Shared content may include Personal Data of other people, such as the other participants in a chat, so please share only content that you are entitled to share. This feature requires your consent to AI Suggestions.

Payment and subscription information. If you purchase a Synapser subscription, your payment is processed by Apple through its In-App Purchase system. We do not collect or store your full payment card details. We receive limited transaction and subscription information from Apple, such as the subscription purchased, subscription status, purchase and renewal information, and transaction or receipt-related identifiers. We use this information to activate, verify, manage, and support your subscription. If a signed Apple transaction is already linked to another live Synapser account, the App may show a masked email-address hint so that you can identify that account; it does not disclose the full address.

4. Children's Data

Our Services are intended only for individuals who meet the applicable minimum age requirement. You must be at least 16 years old to create an account or use the Services. If applicable law requires you to be older to use the Services without parental or guardian authorization, that higher minimum age applies.

During onboarding, we ask you to confirm that you meet the applicable minimum age requirement. We record this confirmation as a yes/no together with the date and do not collect your date of birth. Account creation also requires signing in through a third-party identity provider, such as Apple, Google, or Microsoft, which may apply its own age requirements.

We do not knowingly collect Personal Data from individuals below the applicable minimum age. If we become aware that we have collected Personal Data from such an individual, we will take steps to delete that data and, where applicable, block, suspend, or close the relevant account. If you believe that someone below the applicable minimum age may have provided Personal Data to us, please contact us at [email protected].

We process Personal Data only where we have a valid legal basis under applicable privacy law. Depending on the circumstances, we rely on the following legal bases:

Performance of a contract (Art. 6(1)(b) GDPR). We process Personal Data as necessary to provide, operate, and support the Services under our Terms of Service. This includes, for example: connecting and synchronizing emails, calendar events, tasks, contacts, and notes; displaying and managing information across connected providers; authenticating your identity; maintaining your account and subscription status; processing data export requests; and providing the core functionality of the Services.

Legitimate interests (Art. 6(1)(f) GDPR). We process Personal Data where necessary for our legitimate interests in operating and securing the Services, provided that those interests are not overridden by the rights and freedoms of the individuals concerned. For individuals who do not use Synapser, this includes processing Personal Data contained in content made available through a user's connected accounts or use of the Services where necessary to provide and operate the Services requested by that user. This includes preventing fraud and misuse, maintaining the security and integrity of the Services, monitoring server-side service-notification acceptance and delivery errors, audit logging, enforcing our Terms and policies, responding to issues, and establishing, exercising, or defending legal claims. Legitimate interests may also include certain service-related communications, where permitted by applicable law.

Legal obligations (Art. 6(1)(c) GDPR). We process, retain, and disclose Personal Data where necessary to comply with applicable laws, regulations, and lawful requests, including maintaining records of processing (Art. 30), responding to data subject requests, and meeting tax, accounting, reporting, and law-enforcement or supervisory-authority requirements.

Consent (Art. 6(1)(a) GDPR). We rely on your consent for AI Suggestions, order tracking, product analytics, diagnostics (including crash, error, and performance data), marketing communications, and geolocation data when you choose to enable location-based features. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

6. How We Use Personal Data

  • To provide and operate the Services, including synchronizing connected data sources, displaying and organizing your information, and enabling search, reminders, sharing, scheduled send, travel-time estimates, and event weather forecasts.
  • To manage accounts, subscriptions, and payments, including creating and maintaining your account, verifying subscription status, processing entitlements, and supporting purchases made through Apple's In-App Purchase system.
  • To provide customer support and service communications, including responding to support requests and sending account, security, operational, and administrative notices.
  • To send service-related push notifications, where enabled; monitor server-side acceptance and delivery errors; and, with Diagnostics & Performance consent, measure and troubleshoot device delivery.
  • To maintain security, prevent fraud, enforce our Terms, and review and respond to illegal-content reports and related challenges.
  • To troubleshoot, monitor performance, and improve reliability, using technical, diagnostic, crash, error, and performance information (where you have enabled diagnostics).
  • To improve the Services and develop new features, including by analyzing usage information and feedback and creating aggregated or de-identified insights that are not intended to identify you.
  • To conduct surveys, questionnaires, and user research, on a voluntary basis.
  • To provide AI Suggestions and order tracking, each only with its own consent, if enabled, without using the processed information to train our own or third-party AI models.
  • To conduct analytics, if enabled.
  • To provide location-based features, if enabled.
  • To send marketing communications, if you opt in, which you can withdraw at any time.
  • To comply with legal obligations and protect legal rights.

7. Your Rights

Synapser processes Personal Data in accordance with the GDPR, regardless of where users are located. Where applicable law provides additional privacy rights or protections, we honor those rights and protections as required by law. Nothing in this Privacy Policy limits any rights you may have under applicable law.

To exercise your rights, please contact us using the details in the "Contact" section, or use the in-App data-management features. We may request information to verify your identity before responding. We will respond without undue delay and generally within one month of receiving your request. Where necessary due to the complexity or number of requests, we may extend this period by up to two further months. If we do, we will inform you within the first month and explain the reason for the extension. These rights are not absolute and may be subject to exceptions or limitations; while updates or deletions you request will be reflected in our active systems within a reasonable period, we may retain certain information where necessary for backups, security, fraud prevention, legal compliance, or to establish, exercise, or defend legal claims.

You may have the following rights under applicable privacy law:

Access (Art. 15). Request confirmation of whether we process your Personal Data and, where we do, access to that data and a copy of it.

Rectification (Art. 16). Request that we correct inaccurate Personal Data and complete incomplete data concerning you.

Erasure (Art. 17). You may request deletion of your Personal Data where provided by applicable law. You can also delete your Synapser account directly in the App. When you request deletion of your Synapser account, we delete the Personal Data associated with your account and remove the corresponding marketing-email contact from our email provider, regardless of whether that address originally subscribed through the App or website. We may retain only limited information where necessary to comply with legal obligations or to establish, exercise, or defend legal claims. Some deletion steps may run asynchronously; limited identifiers are retained only while needed to complete or verify them. Deleting your Synapser account removes Synapser's copies of data obtained from your connected accounts and revokes Synapser's access where applicable. It does not delete data that remains independently stored with Google, Microsoft, Apple, or another connected provider. Deleting your Synapser account also does not cancel your Apple subscription. To stop future renewals, you must cancel the subscription separately through Apple. The App retains a device-local record of the last signed-in account email and sign-in provider to warn before a different account uses that device. This record is never sent to Synapser, is retained after sign-out solely for this warning, is overwritten by a later sign-in, and is deleted when you delete your Synapser account or remove the App from the device.

Restriction (Art. 18). Request that we restrict the processing of your Personal Data in certain circumstances.

Portability (Art. 20). Request a copy of certain Personal Data in a structured, commonly used, and machine-readable format. Synapser provides a self-service in-App data export containing your account data, Synapser content and attachments, pending actions, AI suggestions, and consent history. Export files remain available for 7 days. Data held independently by connected providers remains under their control and is exportable from those providers.

Objection (Art. 21). Object to processing based on legitimate interests, and object at any time to processing for direct-marketing purposes (we will then stop processing your data for that purpose).

Withdraw consent (Art. 7). Where we rely on your consent to process Personal Data, you may withdraw that consent at any time. You can manage AI Suggestions, order tracking and other consent-based privacy choices through the available App settings, and you can unsubscribe from marketing emails through the App or by using the unsubscribe or preference link in a marketing email. Your marketing preference is synchronized between the App and the email preference center, and an existing website subscription is recognized when the same address is linked to a Synapser account. Device permissions, such as notification and location permissions, can be managed through iOS Settings.

Complaint. Lodge a complaint with your local supervisory authority, including in the country where you live, work, or where you believe an infringement has occurred.

8. Cookies and Similar Technologies

Mobile App and Google Drive file selection. The native App uses Firebase ID tokens for authentication. Google Drive file selection uses Google Picker in the system authorization browser. Some earlier versions of the App instead open a Synapser file-selection page with Google Picker in your device's browser. That page uses a strictly necessary Synapser session cookie, which expires after five minutes, to securely return your selection to the App. Google Picker may also use Google's own cookies and browser session for sign-in and file selection under Google's privacy and cookie policies. Synapser does not use this file-selection session for analytics or advertising. For further details, see our Cookie Policy.

Website. The Synapser website uses strictly necessary browser storage and, with your consent, Google Analytics 4 to understand how the website is used. You can withdraw your consent at any time through Cookie Settings. For further details, see our Cookie Policy.

9. Who We Share Your Personal Data With

We may share Personal Data with the following categories of recipients:

People you choose. This includes other Synapser users or recipients with whom you choose to share content or communicate through the Services. When you use Synapser to send an email, share content, or invite someone, we process the recipient's contact information and send the communication on your behalf. Where the recipient is not a Synapser user, we may process their email address to deliver the communication, prevent abuse, and keep a record of the request. We do not use recipients' contact information for marketing.

Remote content in emails. Emails may contain images or other content hosted by third parties. When remote images are loaded, Synapser uses an image proxy so that the external host receives the request from Synapser rather than directly from your device. This helps prevent the external host from receiving information such as your IP address, cookies, referrer, or device information. However, some emails may contain unique identifiers in image links that could allow the sender or external host to infer when an image was first loaded.

Service providers acting on our behalf. We use service providers to operate and support Synapser. These may include:

  • Google Cloud and Firebase, for hosting, authentication, App security, push notifications, feature configuration, crash and performance monitoring, and analytics where enabled;
  • Google Workspace, for company email and handling support and illegal-content reports;
  • Cloudflare, for DNS, website delivery, network and application security, and services supporting website functionality. In providing these services, Cloudflare may process limited technical information relating to website visitors and App users, such as IP addresses and request or traffic metadata, and, where applicable, information submitted through website forms. Cloudflare processes this information on our behalf to provide, secure, and protect these services;
  • Google Gemini Enterprise Agent Platform and OpenAI API models, to process relevant content, including attachments and content you share to Synapser, to transcribe audio, and to generate AI Suggestions when you enable AI features;
  • Google Analytics, for website analytics when you consent to analytics cookies; and
  • Loops, to deliver transactional emails related to the Service and, where you have opted in, marketing communications. We share your email address, first name, a pseudonymous account identifier, your marketing-email preference, and information about how you subscribed.
  • Ship24, to obtain parcel status and delivery estimates for order tracking when you enable that feature;

These providers process Personal Data only as necessary to provide their services to us and for the purposes described in this Policy.

Apple platform services. We use certain Apple platform services for App distribution, subscriptions, sign-in, push notifications, diagnostics, maps, directions, weather, and other iOS platform features. Depending on the service, Apple may process Personal Data under its own terms and privacy notices, including for purposes it determines independently from Synapser.

Third-party service integrations chosen by you. If you choose to connect a third-party service, Synapser accesses, receives, and synchronizes the data necessary to provide the integration and its features and carry out the actions you request. These services may include Google services such as Gmail, Google Calendar, Google Tasks, Google Contacts, and Google Drive; Microsoft services such as Outlook, Calendar, Microsoft To Do, and Contacts; Apple services such as Calendar, Reminders, and Contacts; and email services connected through IMAP, including iCloud Mail. When you select a Google Drive file to attach to an email, a note, or a calendar event, you grant Synapser access to that file. For a calendar event, Synapser attaches only a reference to the selected file and does not download or store its contents. For an email, Synapser downloads a copy of the selected file, or the PDF or Office export you choose, and stores it as an attachment so that it can be sent to your recipients. For a note, Synapser downloads a copy in the same way and stores it as an attachment of that note, where it is available to you and to the collaborators you share the note with. These copies are retained as described in Section 12. Files you do not select are not downloaded for these attachment features.

Google Drive search. If you grant read-only access to Google Drive metadata, Synapser sends your search query and applicable filters to Google Drive and receives file metadata to display the results. Synapser does not receive or download the contents of your Drive files or file-content snippets for this search. Returned metadata is retained only as necessary to provide the search functionality, as described in Section 12. The use of information received from Google Workspace scopes will adhere to the Google User Data Policy, including Limited Use requirements.

Payment and subscription platforms. Payments and subscriptions are processed by Apple through its In-App Purchase system. We receive limited information about your subscription and transactions that is necessary to manage your Synapser subscription. We do not receive or store your full payment card details.

Government authorities, regulators, and law enforcement. We may disclose Personal Data where required by applicable law or where reasonably necessary to respond to a lawful request, protect our rights or the rights of others, investigate abuse or security incidents, or enforce our Terms.

Corporate transaction recipients. Personal Data may be disclosed in connection with a merger, acquisition, financing, reorganization, sale of assets, insolvency, or similar corporate transaction.

With your consent or at your direction. We may share Personal Data with other parties when you ask us to do so, direct us to do so, or otherwise provide your consent.

10. Where We Store and Process Your Information

Synapser is operated from Europe, and our backend infrastructure and primary database are hosted on Google Cloud Platform within the European Union. Personal Data is primarily stored and processed in the EU. However, some of the service providers we use (for example Google, Microsoft, Apple, OpenAI, and Cloudflare) may process certain Personal Data in the United States or other countries where they operate, including through remote access from outside the EEA.

Where we transfer Personal Data from the EEA to a country that does not benefit from an adequacy decision, we rely on appropriate safeguards under applicable data protection law, such as the European Commission's Standard Contractual Clauses or other valid transfer mechanisms. Where relevant, we may also rely on adequacy decisions.

11. Security

We design Synapser with security in mind and take appropriate technical and organizational measures to protect Personal Data against unauthorized or unlawful access, disclosure, alteration, loss, destruction, or misuse. These measures include encryption of data in transit and at rest, together with additional safeguards for sensitive credentials and access information.

If we become aware of a Personal Data breach, we will take appropriate steps to investigate, contain, and address it, and will notify the relevant supervisory authority and affected individuals where required by applicable law.

However, no system can be guaranteed to be completely secure. While we work to protect Personal Data, we cannot guarantee absolute security, and any transmission, storage, or processing of data involves some risk.

12. Retention

We retain Personal Data only for as long as necessary to fulfill the purposes described in this Privacy Policy, including to provide the Services, comply with legal obligations, resolve disputes, prevent fraud and abuse, and enforce our agreements. When determining retention periods, we consider the nature of the data, the purposes for which it is processed, the duration of our relationship with you, the operational impact of deletion, and any applicable legal, regulatory, tax, accounting, or limitation-period requirements.

Indicative retention periods:

  • Account data, settings and preferences, and notes: retained while your account is active and deleted when your account is deleted. Notes moved to Trash may be retained for up to 30 days unless you delete them sooner.
  • AI Suggestions and related history: generated only when you enable AI Suggestions and retained while your account remains active. If you later disable AI Suggestions, previously generated suggestions and related history remain in your account, but no new suggestions are generated or updated. They are deleted when your account is deleted, subject to any limited retention required by law.
  • Order tracking data: an order remains in the active dashboard until 24 hours after the confirmed final delivery. Delivery confirmations without an authoritative time zone use the first confirmed observation; duplicate updates do not restart that period. Completed or manually hidden order history is removed 90 days after completion or hiding. Withdrawal of order-tracking consent removes derived orders and the related email-analysis content from our systems and clears the order cache on your device. Removing a connected account removes orders supported only by that account. We request remote unsubscription from Ship24; this stops tracking updates but is not itself a deletion of Ship24 records. Vendor erasure and retention follow the applicable agreement and your rights described in this Policy. Minimal tracking identifiers and cost reservations are kept with the order history. If that history is removed earlier, they remain only until remote unsubscription is complete and at least 32 days have passed since the registration attempt, to prevent duplicate charges and enforce the spending limit. Usage and cost records without email content remain under the account and service-record retention rules above. Account deletion also initiates this cleanup. Some steps run asynchronously.
  • Temporary copies used for AI Suggestions, including attachment files, content you share to Synapser, text extracted from them, and audio transcripts: used only for that processing and not stored by Synapser afterwards. This does not delete the original attachments saved with your emails, notes, or tasks. Content you share to Synapser stays on your device until it is sent. It is deleted from your device once it has been sent or can no longer be sent, when you sign out, and in any case the next time you open Synapser more than 48 hours after sharing. The name of a shared chat or file is kept with the AI Suggestions made from it. AI providers may temporarily retain submitted content as described in Section 3.
  • Synced provider data. Synced provider data is retained while the corresponding provider account remains connected. This includes emails, tasks, contacts, calendar events and, for Google Calendar, associated Google Drive attachment metadata. It is deleted when you disconnect that provider account or delete your Synapser account. If Synapser asks you to reauthorize your Google connection because we are updating provider permissions, existing synced data may remain in your account until you reconnect, remove that provider account, or delete your Synapser account, subject to the retention limits described below.
  • Temporary search-result data. Temporary search-result data stored on our servers, including Google Drive result metadata and information needed to display further results, expires after 15 minutes. It is then deleted through our routine cleanup process and is also deleted when you delete your Synapser account. Synapser does not retain the contents of Google Drive files for search.
  • Temporary Google Drive file-selection records: contain account references, the selected file identifier, and security and session status information needed to return the selection to the App. They expire five minutes after creation and are removed by the next successful scheduled cleanup, which runs every minute. They contain no file contents or Google access or refresh tokens. They are also deleted when you delete your Synapser account or remove the connected Google account.
  • Temporary email attachments, including selected Google Drive files. Synapser stores a temporary copy to save drafts or send email. Unused uploads expire after 24 hours and are removed through scheduled cleanup. Attachments needed by a scheduled, delayed, or retryable send remain available while that action is pending. After verifying that your email provider holds a matching draft or sent attachment, Synapser deletes its temporary copy when no queued send or active save still needs it. If verification or deletion fails, Synapser retains the file or cleanup record and retries; acceptance by a sending server alone does not prove that a retrievable sent copy exists. Canceled scheduled sends without a provider copy receive a 24-hour recovery window before cleanup. Synapser keeps attachment metadata, a content checksum, and provider account, message, and attachment references to retrieve provider-held files and support later draft edits. These records are deleted when you remove the attachment record or delete your Synapser account. Provider-held copies remain subject to your provider's retention and deletion controls. Uploads interrupted before an attachment is saved are removed by background cleanup after their upload reservation expires; older files with no attachment record are also reconciled and removed. After deletion, cloud storage retains recoverable attachment copies for seven days before permanent deletion, including when an account is deleted. Recovery metadata is retained through that period to account for storage and complete cleanup.
  • Google Drive files attached to notes: the copy stored by Synapser is retained as a note attachment for as long as the note, and deleted when you remove the attachment, when the note is permanently deleted, or when your account is deleted.
  • Files you attach to tasks in Synapser: stored by Synapser with the task and deleted when you remove the attachment, delete the task, or delete your Synapser account.
  • Remote email images. Remote images may be temporarily cached on your device to display email content. Cached images are removed through normal cache management or when the relevant account or App data is removed.
  • Device diagnostics. Diagnostic data stored directly by Synapser is generally retained for approximately 90 days. Diagnostic data processed by third-party providers may be retained for different periods under their applicable retention policies and controls.
  • Notification and service logs: generally retained for up to 90 days; push-delivery telemetry is generally retained for approximately 30 days.
  • Audit logs: retained while your account is active and deleted when your account is deleted, except where retention is required for legal obligations or legitimate interests such as security, fraud prevention, or compliance.
  • Illegal-content reports and related correspondence: we retain reports and related correspondence for as long as necessary to assess the report and handle related complaints or challenges. After the case is closed, we retain only the information necessary to comply with specific legal obligations or establish, exercise, or defend legal claims. We determine retention periods by considering applicable complaint deadlines, relevant statutory limitation periods, and any ongoing proceedings. Account deletion does not automatically erase correspondence held in our legal mailbox; this correspondence remains subject to the retention criteria above. You may request erasure at [email protected], subject to applicable legal exceptions.
  • Data export files: available for 7 days and then automatically deleted.
  • Provider credentials: securely deleted or revoked when you disconnect the relevant provider or delete your account, and access is revoked where applicable.
  • Account-deletion records: limited information necessary to complete or investigate a pending deletion may be retained while that process is ongoing. Non-identifying information may be retained where required for legal obligations or legitimate interests such as security, fraud prevention, or compliance.
  • Newsletter contacts: retained while you remain subscribed to marketing emails. If you unsubscribe, we may retain limited information to record your preference, prevent further marketing emails, and document how you subscribed. If you request account deletion or exercise your right to erasure, we delete the corresponding newsletter contact. We or our email provider may retain only limited information needed to honor an unsubscribe or comply with law. If we automatically close an inactive account under our retention policy, your separate marketing-email preference remains unchanged. You can unsubscribe at any time.

Subscriptions. Canceling auto-renewal does not end your access immediately. You can continue using Synapser until the end of your current trial or paid subscription period and, where applicable, any billing grace period provided through Apple. Canceling auto-renewal does not change your marketing-email preference. When your access ends, Synapser stops synchronizing data with your connected providers, processing data for AI Suggestions and order tracking, and sending service push notifications. Pending scheduled actions and reminders are canceled and will not run automatically if you later resubscribe. Your remaining account data is retained in a restricted state for 90 days so that you can restore access by resubscribing. If you do not resubscribe, the data is deleted after that period, except for limited information that we must retain as described in this Privacy Policy or to comply with applicable law. During the 90-day retention period, you can still access limited account and privacy controls to manage your subscription, restore purchases, export your data, disconnect providers, manage consent choices, or request account deletion as described under Erasure (Art. 17). You do not need to wait for the 90-day retention period to end.

Accounts without a subscription. If you have never started a Synapser trial or paid subscription, we delete your account after 90 days without signing in to the App. We send notices before deletion, and signing in again resets the 90-day inactivity period. Accounts that have previously started a trial or paid subscription follow the subscription-retention period described above instead.

13. Contact

If you have questions, comments, or requests related to this Policy, you can reach us at: