Privacy Policy

How SYNC collects, uses and protects your information.

Last updated: September 16, 2026 • Security information • Security White Paper • Terms of Service

Zero-Knowledge E2EE (Mode 2)

Mobile messages and calls use end-to-end encryption. We cannot read your end-to-end encrypted mobile messages. Media is encrypted in transit and at rest.

Client-Side Sovereignty

Private cryptographic keys are generated on-device and leave your hardware only as wrapped ciphertext for vault backup.

No Surveillance or Selling

Zero behavioral ad trackers, zero third-party profiling, and we never sell your personal data.

Minimal Data Collection

Pseudonymous handles supported; we only retain technical metadata required to operate the network.

1. Introduction & Legal Controller

SYNC Superapp ("SYNC," "we," "our," or "us") is a privacy-first communication and multi-device coordination platform. This Privacy Policy describes how we collect, process, and protect your information when you interact with our mobile applications, web platform, and associated backend infrastructure (collectively, the "Service").

For the purposes of applicable data protection laws, the data controller is SYNC Global Technologies Pte. Ltd. (UEN 202628920N), 18 Ah Hood Road, #09-52, Singapore 329983. Contact privacy@syncsuperapp.com.

By using SYNC, you acknowledge our data practices as outlined in this policy. If you do not agree with these principles, please refrain from using the Service.

2. Information We Collect

2.1 End-to-End Encrypted Content (Zero-Knowledge)

Messages and calls on mobile use end-to-end encryption. Files and other media are encrypted in transit and at rest. These protection models have different scopes.

Message contents: end-to-end encrypted mobile messages are encrypted on your device. Photos, videos, voice memos, documents and other uploaded files are encrypted in transit and at rest.
Cryptographic Keys: We generate your X25519 identity and ephemeral keypairs locally on your device. Your private keys never leave your device unencrypted and are never accessible to our servers.
Message privacy: we do not possess the keys needed to read your end-to-end encrypted mobile messages. This statement does not extend to media protected by server-side encryption.

2.2 Account & Authentication Data

To establish and secure your account, we store minimal account metadata:

Account Identifiers: Username and optional display name. You may register using pseudonymous credentials.
Contact Information: Email address for account recovery and transactional system notices. Phone numbers are strictly optional and are never mandatory to establish an account or message contacts.
Authentication Hashes: Passwords are protected using memory-hard Argon2id cryptographic hashing with unique per-user salts. We never store, transmit, or have access to your cleartext password.
Public Keys: Your public identity and pre-keys are published to our key registry so other authenticated users can establish encrypted E2EE sessions with you.

2.3 Ephemeral Technical & Operational Metadata

To maintain network integrity, prevent abuse, and route encrypted traffic, we process:

IP Addresses & Connection Logs: Processed in volatile memory and retained in temporary security logs for up to 90 days solely for automated rate-limiting, DDoS mitigation, and anti-abuse defense.
Device & Session Tokens: Cryptographically signed session tokens (JWT) and client device platform info (OS type, application version) to manage multi-device sign-ins and session revocation.
Push Notification Tokens: Anonymous device push tokens (APNs/FCM) needed to ping your device when new encrypted payloads await retrieval.

2.4 What We Strictly Do NOT Collect

We cannot read your end-to-end encrypted mobile messages. Media and attachments use encryption in transit and at rest.
We do not track your precise real-time GPS location.
We do not harvest, upload, or scrape your mobile contact address book. Contact discovery, if chosen by you, is user-initiated and evaluated against hashed identifiers.
We do not embed third-party advertising tracking SDKs or cross-site analytics scripts.
We do not sell, rent, or monetize your personal information or contact graph.

3. Threat Model & Security Boundaries

This section explains our threat model and the limits of the protection described here.

Server Database Compromise: An adversary obtaining a database dump cannot decrypt your Mode 2 message payloads, stored vault records, or recovery passphrases (protected by client E2EE ciphertext and Argon2id).
Physical duress and coercion: a separate Duress PIN provides a personal-safety option if you are being robbed or threatened. Your real account stays protected while you get to safety. Contact local police if you are in danger.
Network Eavesdropping: All transport connections enforce TLS 1.3, with inner Mode 2 message payloads independently encrypted via AES-256-GCM.
Rogue Server Operators: Untrusted administrators or coerced server-side actors cannot read Mode 2 message contents without compromising physical endpoint devices.
Cloud storage: optional backups are encrypted before leaving your device. Media files use encryption in transit and at rest.

4. Cryptographic Primitives & Storage

SYNC uses established cryptographic primitives for the functions described below. For full protocol specifications and threat model evaluations, read our Security Architecture & Cryptographic White Paper.

Asymmetric Key Exchange

X25519 (Curve25519 ECDH): Used for device identity key generation and deriving shared secrets for peer-to-peer message encryption in Mode 2.

Authenticated Symmetric Encryption

AES-256-GCM: Deployed for client-to-client encrypted chat message payloads on mobile devices (Mode 2).

ChaCha20-Poly1305: Utilized for Encrypted Backup master key wrapping of E2EE private keys for cloud sync.

XChaCha20-Poly1305: Extended-nonce AEAD cipher utilized for GhostWire ephemeral message encryption.

Password & Vault Key Derivation

Argon2id: Configured with memory-hard parameters (m=64MiB, t=2, p=4) to resist GPU and ASIC-accelerated brute-force cracking.

5. Data Storage, Retention & Deletion

5.1 Storage Locations

Database Infrastructure: Account metadata, public keys, and encrypted ciphertext messages are stored in hardened PostgreSQL databases utilizing disk-level encryption at rest.
Object storage (media attachments): media is stored in Cloudflare R2 with encryption in transit and at rest. This is distinct from end-to-end encrypted mobile messages.
Client-Side Storage: On mobile devices, local message caches are stored in sandboxed SQLite databases protected by operating system hardware-backed file encryption.

5.2 Retention & Cryptographic Erasure

Account Data: Retained while your account remains active.
Ciphertext Messages: Retained in encrypted mailboxes until deleted by conversation participants or upon account termination.
Cryptographic erasure: deleting the relevant keys can prevent access to ciphertext protected by those keys.
Account Deletion: Submitting an account deletion request through Settings → Data & Privacy initiates immediate account disabling and permanent eradication of your records from our live databases within 30 days.

6. Subprocessors & Third-Party Infrastructure

We strictly limit third-party dependencies to essential network and media routing providers:

Cloudflare R2 (Object Storage): Storing user-uploaded encrypted media files and avatars with encryption in transit and at rest.
ZEGOCLOUD (Real-Time Calling): Low-latency WebRTC media routing for 1:1 and group audio/video calls. Call audio/video is not persisted.
Apple APNs & Google FCM: Delivering background wake-up notifications for incoming messages and calls using anonymous tokens.
Sentry (Error Diagnostics): Crash reporting with PII transmission disabled.

7. Your Rights & Data Control

You can export or delete your data directly inside the application under Settings → Data & Privacy. For inquiries, email privacy@syncsuperapp.com. We respond to verified data subject requests within 30 days without charge.

8. Cookies & Browser Storage

Our web client utilizes essential first-party session cookies and browser local storage strictly necessary to sustain authenticated sessions and client-side cryptographic keys. We do not employ tracking pixels or third-party advertising cookies.

9. Contact Information

For security disclosures: security@syncsuperapp.com
For privacy & legal inquiries: privacy@syncsuperapp.com