Privacy Policy

1. Who we are

This Privacy Policy is issued by Syndica Labs Inc. ("Syndicate," "we," "us," or "our"), the operator of the Syndicate website at usesyndicate.org and the Syndicate desktop application (together, the "Service"). For the personal information described below, we act as the data controller. Our contact details are in Section 14.

2. Information we collect

We keep collection to a minimum. Specifically:

• check_circleRequest Access details. When you fill out the Request Access form, we collect your name, your email, your platform choice (macOS or Windows), and — if you choose to provide them — your company and the optional note you write about how you'd use Syndicate.
• check_circleProduct-update signups. If you give us your email to follow along, we use it only to send product news and early access.
• check_circleBasic website analytics. Aggregate, non-identifying usage data (page views, referrers) so we can understand what's useful. No tracking of you across other sites.
• check_circleDesktop app usage data. The Syndicate app sends us periodic usage snapshots so we can understand which features matter and where to invest. A snapshot is linked to your account and includes your app version, operating system, a per-install device identifier (stored hashed with SHA-256, never raw), and aggregate counts: how many teams, agents, and workspaces you have, how many messages you have sent, which features you use, and which providers and models you use. We do not collect your location. Snapshots never include your files, your prompts, message content, agent output, or your credentials.
• check_circleTechnical logs. Our hosting providers automatically record standard server-log data (such as IP address, browser type, and request time) for security, fraud prevention, and reliability.

We do not intentionally collect special categories of data (such as health, biometric, or government-ID data), and we ask that you not submit them in the optional Request Access note.

3. How we use it

We use the email and details you provide to review and approve access requests, send your download link, respond to questions, and, if you opted in, share product updates. We use aggregate analytics, desktop app usage data, and technical logs to operate, secure, and improve the website and app, and to keep the app reliable. We do not sell, rent, or share your personal information with advertisers, and we never use it for purposes beyond those above.

4. Legal bases for processing (EEA/UK)

If you are in the European Economic Area or the United Kingdom, we rely on the following legal bases under the GDPR / UK GDPR:

• gavelConsent: for sending product-update emails. You can withdraw it at any time.
• gavelLegitimate interests: for reviewing access requests, responding to you, securing the Service, and understanding usage of the website and the desktop app (including the usage analytics described in Section 2) so we can improve the product, balanced against your rights. You can object at any time using the contact details in Section 14.
• gavelLegal obligation: where we must retain or disclose data to comply with applicable law.

5. Your model keys and agent work (BYOK)

Syndicate is bring-your-own-key and local-first by design. The API keys you connect, the prompts you write, your files, and everything your agents produce are stored and processed on your own machine. They are never transmitted to Syndicate's servers. When your agents run, requests go directly from your computer to the model provider you chose. Syndicate is not an intermediary and never sees the contents.

6. Third-party processors

We keep our vendor list short and use them only to run the website, email, and app services:

• mailResend: sends our transactional and update emails (e.g. your access link). It processes your email address for delivery only.
• cloudAmazon Web Services (including SES & CloudFront): hosts and serves this website and delivers email. Standard server logs may include IP addresses for security and reliability.
• databaseSupabase: provides authentication, stores account data, and stores the desktop app usage analytics described in Section 2.
• smart_toyLLM providers you choose: OpenAI, Anthropic, GitHub (Copilot), or Google (Gemini). When you bring your own account, your requests go from your machine directly to that provider under that provider's privacy terms. Syndicate is not party to that data.

We engage these vendors as data processors under appropriate data-processing terms and do not authorize them to use your data for their own purposes.

7. International data transfers

Our service providers (such as AWS, Resend, and Supabase) may process the limited personal information we hold in the United States and other countries. Where data is transferred out of the EEA or UK, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses (and the UK Addendum) or an adequacy decision. You can request more detail about these safeguards using the contact details in Section 14.

8. Cookies & analytics

The website uses only essential cookies and privacy-respecting, aggregate analytics. We do not use advertising or cross-site tracking cookies. You can block cookies in your browser without losing core functionality.

9. Data retention

We keep the email and request details you submit for as long as your account or interest is active, or until you ask us to delete them, and in any case no longer than 24 months after your last interaction with us, unless a longer period is required by law. Aggregate analytics and technical logs are retained only for a short period for security and operational purposes. Desktop app usage analytics are retained while your account is active and deleted or de-identified on request. Locally stored data (keys, prompts, agent work) is retained on your machine and is fully under your control: uninstalling the app or clearing its data removes it.

10. Data security

We use reasonable technical and organizational measures to protect the limited personal information we hold, including encryption in transit (HTTPS/TLS), access controls, and reputable infrastructure providers. Our local-first architecture is itself a security measure: because your keys, prompts, and agent work never leave your device, they are not exposed to a breach of our servers. No method of transmission or storage is completely secure, however, and we cannot guarantee absolute security.

11. Data breach notification

If a personal-data breach affecting your information occurs, we will assess it promptly and, where required by applicable law (including the GDPR's 72-hour regulator notification obligation), notify the relevant supervisory authority and affected individuals without undue delay.

12. Your privacy rights

Subject to applicable law, you can ask us to access, correct, export (portability), restrict, or delete the personal information we hold about you, including the desktop app usage data described in Section 2, and to object to or withdraw consent for certain processing. You can unsubscribe from updates at any time via the link in any email. To exercise any right, email hello@usesyndicate.org; we'll honor verified requests promptly and free of charge in most cases.

EEA/UK residents. You also have the right to lodge a complaint with your local data protection authority if you believe we have not handled your data properly.

California residents (CCPA/CPRA). You have the right to know what personal information we collect and how it is used, to request deletion or correction, and to be free from discrimination for exercising these rights. We do not sell or share your personal information as those terms are defined under the CCPA/CPRA, and we do not use it for cross-context behavioral advertising.

13. Children's privacy

Syndicate is not directed to children under 13 (or the minimum age required in your jurisdiction, such as 16 in parts of the EEA), and we do not knowingly collect personal information from them. If you believe a child has provided us personal information, contact us and we will delete it.

14. Changes & contact

If this policy changes, we'll update this page and revise the date below. Material changes will be communicated to people on our update list.

Questions about privacy or your data, or to exercise a right? Contact Syndica Labs Inc., 251 Little Falls Drive, Wilmington, New Castle County, Delaware 19808 (c/o Corporation Service Company, registered agent), or email hello@usesyndicate.org.