Privacy Policy

2.1 Information You Provide Directly

When you create an account and use Sync, you provide us with:

• Account Information: Email address, username, full name, and password (stored securely using Argon2 hashing—we never store your actual password)
• Profile Information: Profile picture (avatar) and optional phone number for contact discovery
• Communications: Messages, media files (images, videos, documents), and voice/video call participation
• Contact Preferences: Friend lists, blocked users, and privacy settings you configure

2.2 Information Collected Automatically

When you use our Service, we automatically collect certain information:

• Device Information: Device type, operating system, and browser type (for session management)
• Session Data: IP address (for security and fraud prevention), login timestamps, and device identifiers
• Push Notification Tokens: Device tokens required to deliver notifications (only if you enable notifications)
• Usage Patterns: Feature usage for improving the Service (never linked to message content)

2.3 Information We Do NOT Collect

We respect your privacy and explicitly do not:

• Read, analyze, or mine your message content for advertising
• Track your location (we do not request location permissions)
• Collect contacts from your device without explicit permission
• Use third-party analytics that track individual users
• Sell any personal data to third parties

3.1 Core Service Functionality

• Account Management: Create and manage your account, authenticate your identity
• Messaging: Deliver your messages, media, and reactions to intended recipients
• Calls: Enable audio and video calls between users
• Notifications: Send push notifications for new messages, calls, and friend requests
• Contact Discovery: Help you find friends by username or phone number (based on your privacy settings)

3.2 Security & Safety

• Detect and prevent fraud, abuse, and unauthorized access
• Monitor for suspicious login attempts and protect your account
• Enforce our Terms of Service and community guidelines
• Rate limiting to prevent spam and abuse

3.3 Service Improvement

• Diagnose technical issues and fix bugs
• Understand aggregate usage patterns to improve features
• Develop new features based on user needs

4.1 Where We Store Your Data

• Account & Message Data: Stored on secure servers with encryption at rest
• Media Files: Stored in Amazon Web Services (AWS) S3 with server-side encryption
• Backups: Encrypted backups for disaster recovery

4.2 Security Measures

• Encryption: All data transmitted using TLS 1.3 encryption
• Password Security: Passwords are hashed using Argon2, the industry-leading algorithm
• Session Security: JWT tokens with short expiration, secure cookie attributes
• Access Controls: Strict internal access controls and audit logging
• Regular Audits: Security assessments and vulnerability testing

4.3 Data Retention

• Account Data: Retained while your account is active
• Messages: Stored until you delete them or delete your account
• Session Logs: IP addresses retained for 90 days for security purposes
• Deleted Data: Permanently removed within 30 days of deletion request

8.1 Essential Cookies

We use strictly necessary cookies for authentication and security:

• Authentication Token: Keeps you logged in securely
• Session Identifier: Maintains your session state
• Security Tokens: CSRF protection and fraud prevention

These cookies are essential for the Service to function and cannot be disabled.

8.2 Functional Storage

We use browser local storage to enhance your experience:

• User Preferences: Theme choice (light/dark mode), UI preferences
• Cookie Consent: Your cookie preferences

8.3 No Tracking Cookies

We do not use any third-party tracking cookies, advertising cookies, or analytics that track individual users across websites.

For European Users (GDPR)

If you are in the European Economic Area, you have additional rights including:

• Right to withdraw consent at any time
• Right to lodge a complaint with your local data protection authority
• Right to object to processing based on legitimate interests

Our legal basis for processing your data includes: contract performance, legitimate interests (security, service improvement), and your consent where required.

For California Users (CCPA)

California residents have the right to:

• Know what personal information we collect and how it's used
• Request deletion of personal information
• Opt-out of the sale of personal information (we do not sell your data)
• Non-discrimination for exercising your privacy rights