The short version

SynthOS the app runs on your Mac. Your credentials and your receipts stay there — we never see them and don't want to.

Your vault is different, and we want to be exact about it. It lives on your disk, and by default it also syncs to private storage bound to your SYNTHOS account so your other Mac can pick it up. That copy is private and encrypted in transit, but it is not end-to-end encrypted: we hold the storage keys, so we could technically read it. We don't, and no part of the product does — but we won't tell you we can't. You can turn sync off per vault, and deleting your account deletes the synced copies.

The website, trusynth.com, is where it's different: to run a store and improve it, we use analytics and advertising tools. But nothing non-essential runs until you choose — until you accept cookies, only privacy-friendly, cookieless measurement is active.

Your account

Account: your email and sign-in identifiers, managed by Supabase (our auth provider). Internally we identify you by a random user id, never your email.

Billing: your subscription status and plan. Card details go directly to Polar Software, Inc., our merchant of record; we never see your card number.

Credits: a ledger of grants and usage amounts so your balance is correct.

On the website — always (no cookies, no consent needed)

Privacy-friendly measurement that runs for everyone and cannot identify a person: aggregate page views, where visitors come from (referrer + approximate country from IP, which we don't store), device type, page performance, and which pages and buttons are used. This is Vercel Web Analytics + Speed Insights and our own product events — no cookies, no cross-site identifiers, no profiles.

On the website — only after you accept cookies

Product analytics — PostHog, hosted in the EU (Frankfurt): how the site is used, including clicks, funnels, and session replays. Replays MASK every text input — we never capture what you type, your email, your sign-in code, or any key. We tie sessions to your account by your random user id (never your email) to understand your journey across the site.

Advertising — Meta, Google (Ads + Analytics), TikTok, Reddit, and X pixels: these measure whether our ads work and let us show you SynthOS ads on those platforms (retargeting). They set their own cookies and share a hashed, pseudonymous identifier with the platform. We also send sign-up and purchase events to these platforms server-side for accurate measurement.

Attribution: how you first arrived (the ad, link, campaign/UTM, and referring page), kept in a first-party cookie and, if you become a customer, saved to your account — so we can tell which channels actually work.

What we never collect

The contents of your vault. Your API keys (they live in your macOS keychain). The prompts you type or the outputs your agents produce. Your files.

We never put your email, sign-in code, clipboard, or API keys into any analytics event, and session replays mask all text inputs. Everything described here happens on the website — the SynthOS Mac app reports nothing to our analytics; the only data that leaves your Mac is what you choose to send when an agent uses the model.

Cookies & how to control them

Essential (always on, no consent needed): the cookie that remembers your choice (sx-consent), your sign-in/session cookies, a random no-PII id that keeps A/B tests consistent (sx-anon), your first-touch source with no personal data (sx-ft), and an inactivity timer (last-activity).

Analytics & advertising (only after you click Accept): PostHog and the advertising pixels above, each setting their own cookies.

You're in control: decline and only the essential, cookieless measurement runs. You can change your mind anytime from the cookie banner — withdrawing consent stops the analytics and ad tools and clears your analytics identity.

Who we share with

Infrastructure (always): Supabase (auth + database), Polar Software, Inc. (merchant of record — payments + tax), Vercel (hosting + cookieless analytics), Cloudflare (content delivery + security).

Analytics & advertising (only with your consent): PostHog (EU product analytics) and the advertising platforms — Meta, Google, TikTok, Reddit, X. Each receives only what its job requires.

We do not sell or rent your personal data.

The data controller for everything described here is George Trushevskiy, operating as TRU SYNTH, Prague, Czech Republic. We're a small operation, so there's no data-protection officer to route around — the privacy contact is [email protected] and it reaches the person responsible.

Your choices & rights

Consent: accept, decline, or change your cookie choice anytime via the banner; opt out of marketing data from your account.

Access & deletion: export or delete your account data by emailing [email protected] — we honor deletion within 30 days (we delete by your internal user id). EU/UK residents have GDPR rights (access, rectification, erasure, portability); California residents have CCPA rights, including opt-out of sharing for advertising. Send any of those requests to [email protected] — it goes straight to the data controller (George Trushevskiy, operating as TRU SYNTH, Prague, Czech Republic), with no DPO or ticket queue in between.

Changes & contact

If this policy changes materially we'll tell you by email before it takes effect. Questions: [email protected].