Privacy Policy

1. Data we collect

• Account data: your email address, name, and password (stored hashed by our authentication provider), or basic profile details from Google if you sign in with Google.
• Content: the questions you ask, files and images you attach, the answers, consensus answers and agreement analyses produced, and your ratings, templates, presets and settings.
• Billing data: your plan, subscription status, credit balance and transactions, and payment identifiers from our payment processors. Card details are collected by Whop directly; we never see or store your full card number.
• Usage data: which models you used, tokens and cost per query, timing and errors, and API key or connector usage.
• Earlier demo data: until October 5, 2026, our homepage let visitors ask a question without an account. For those questions we stored the IP address and the first 500 characters of the question to enforce daily limits and prevent abuse, and we delete them within 90 days. The homepage no longer collects this data.
• Device and analytics data: IP address, browser and device type, pages visited, referring site, and marketing attribution (such as UTM parameters and ad click identifiers), collected through cookies and similar technologies described below.

2. How we use it

• To run the Service: answer your questions, keep your history, show usage, and process payments and credits.
• To secure the Service: authenticate you, enforce rate and free-use limits, and detect fraud, abuse and payment disputes.
• To support you and send service messages, such as receipts, security notices and changes to our terms.
• To understand and improve the product using analytics, and to measure which of our ads and marketing lead to sign-ups and purchases.
• To meet legal, tax and accounting obligations.

We do not use your questions, attachments or answers to train AI models, and we do not sell or rent your personal data. Where the GDPR or similar laws apply, we rely on performance of our contract with you, our legitimate interests in securing and improving the Service, your consent (for non-essential cookies where required), and legal obligations.

3. AI model providers

To answer a question, we send your question, its attachments and the relevant earlier messages in that chat to the providers of the models you picked (OpenAI, Anthropic, Google and/or xAI), plus the providers of the models that write the consensus answer and agreement analysis. We also send your question, and while you type a longer message your unsent draft, to OpenAI to classify it: to suggest or choose how many models answer, and to test features that decide when to search the web and how closely the answers agree. Private mode skips these checks unless you ask Synero to choose the models. When web search is on (you turn it on, or we turn it on for a question that looks time-sensitive), those providers may run web searches based on your question. We use each provider through its business API, under terms that do not allow it to train on API data. Providers may keep API data for a limited time for abuse monitoring under their own policies.

If you use voice input, we send your recording to OpenAI to turn it into text, and the text goes into your message box for you to review before sending. We do not store the recording.

4. Other service providers

We share data only with providers that help us run the Service, under contracts that limit their use of it:

• Supabase (authentication and database)
• DigitalOcean (hosting)
• Whop (payments, subscriptions, fraud prevention, and an advertising pixel on our pages that records page views, sign-ups and your first free question (never its content), plus purchases from its checkout; to measure our ads it also sets a device identifier made from a cookie and a browser fingerprint)
• Google Analytics and Google Ads (analytics and conversion measurement)
• Meta (only if you accept ad cookies: an advertising pixel on our pages and matching reports from our servers that measure our ads by recording page views, sign-ups, your first free question, never its content, and new subscriptions; the server reports include a SHA-256 hash of your email and account ID, your IP address, browser and Meta's cookie identifiers)
• Crisp (live chat support: your IP address, browser, pages viewed, messages and any email you give it)
• sovrn.ai (sales attribution: your IP address, browser, pages viewed, sign-ups, your first free question, never its content, and purchases, tied to a visitor ID cookie)

We may also disclose data if required by law or to protect the rights and safety of our users, the public or Synero, and to a successor if Synero is involved in a merger, acquisition or sale of assets.

5. Sharing you control

Your chats are private to your account by default. If you create a share link or publish a template, anyone with the link (or, for public templates, anyone) can see that content. You can stop sharing at any time. Private mode keeps a chat out of your history entirely; we still record its usage and cost for billing.

6. Cookies and similar technologies

We use essential cookies to keep you signed in and secure your session. We use Google Analytics to understand how the site is used, and Google Ads, Meta and Whop pixels on our pages to measure our advertising (page views, sign-ups, your first free question and purchases). Meta's pixel loads, and our servers report these events to Meta, only after you accept ad cookies in the banner; your choice is kept for a year in a cookie (synero_ad_consent), and you can change it by clearing that cookie. Whop's pixel recognizes your browser with a cookie (_wuid) and a device fingerprint kept in local storage. After you subscribe, the billing page may send Google Ads a SHA-256 hash of your account email, never the email itself, so it can match the purchase to our ads. Our live chat widget (Crisp) sets its own cookies to keep your conversation. sovrn.ai, which measures which visits lead to sign-ups and purchases, sets first-party cookies on our domain: sovrn_visitor_id (1 year), sovrn_session_id (1 hour) and sovrn_t, a test cookie removed straight away; it collects your IP address and browser. We store marketing attribution (UTM parameters and ad click identifiers) in your browser and pass it to our payment processor at checkout so we can tell which campaign brought a purchase. You can block or delete cookies in your browser settings, and you can opt out of Google Analytics with Google's browser add-on. Blocking essential cookies will stop sign-in from working.

7. Retention

Records from the former homepage demo (IP address and question) are deleted within 90 days of collection. We keep your account data and chat history until you delete them or your account. When you delete your account, your account and all associated content, keys, settings and usage records are deleted immediately from our live database and age out of backups within 30 days. We keep records we must retain for tax, accounting, fraud prevention or legal reasons (such as payment records held by our payment processors) for as long as the law requires. Aggregated statistics that do not identify you may be kept indefinitely.

8. Your rights and choices

You can download your chats (your questions, each model's answers, consensus answers and agreement analyses) and delete your account at any time from your account settings in the app; for a full copy of everything else we hold, email [email protected]. Depending on where you live (for example in the EEA, UK or California), you may also have the right to access, correct, delete or port your data, to object to or restrict certain processing, to withdraw consent, and to opt out of targeted advertising. Email [email protected] to make a request. We will verify your identity and respond within the time the law requires (and usually within 5 business days). You will not be treated differently for exercising your rights. You may also complain to your local data protection authority.

9. Security

Data is encrypted in transit (TLS) and at rest. Database row-level security restricts each record to its owner, API keys are stored only as hashes, and access to production systems is limited. No system is perfectly secure; if a breach affects your data, we will notify you as required by law. See synero.ai/security for more.

10. International transfers

Synero and most of its providers operate in the United States, so your data is processed there. Where required, transfers are protected by safeguards such as the European Commission's Standard Contractual Clauses.

11. Children

The Service is not meant for anyone under 18, and we do not knowingly collect data from children. If you believe a child has given us data, contact us and we will delete it.

12. Changes

We will post any changes here and update the date above. For material changes we will also notify you by email or in the app.

13. Contact

Privacy questions and requests: [email protected], or Blove, Inc. (Synero), Colorado, USA.