DRAFT — requires legal review before launch. Placeholders marked [LIKE THIS] must be filled in before this page goes live.

Legal

Privacy Policy

Effective date: [EFFECTIVE DATE]

This Privacy Policy describes how [LEGAL ENTITY NAME] ("Synap", "we", "us", or "our") collects, uses, and protects information about you when you use getsynap.app and the Synap mobile applications (collectively, the "Service"). If you have questions, reach us at [CONTACT EMAIL].

1. Information we collect

Information you provide directly

Email address. We collect your email when you sign in or subscribe. We use it to send you a magic-link sign-in email (no password is ever set or stored) and to send transactional notices such as receipts and account changes.
Free-response answers. When you complete a lesson, you write a short answer that our AI evaluates. That response and its score are stored so you can review your history and maintain your streak.

Information generated by your use of the Service

Lesson completions and streaks. We record which lessons you have completed and your current and longest streak so the Service can function.
Purchase and entitlement records. When you purchase a subscription or a content pack, we store which products you own and their expiry or status. Card numbers and full payment details are handled entirely by Stripe and are never transmitted to or stored on Synap infrastructure.

Information we do NOT collect

We deliberately collect as little data as possible. We do not use advertising networks, analytics SDKs, social-login providers, session-recording tools, or any third-party tracker. This is enforced in our CI pipeline — code that introduces such SDKs cannot ship. We do not collect device fingerprints, precise location, or any inferences about you beyond your learning activity on this platform.

2. How we use your information

To operate the Service: authenticate you, deliver lessons, record completions, and maintain your streak.
To process payments and manage your subscription or content-pack entitlements via Stripe.
To send you transactional emails (magic-link sign-in, receipts, service notices). We do not send marketing email without your separate consent.
To improve the Service by reviewing aggregate, anonymised patterns in lesson completion rates.

3. Who we share your information with

We share your information only with the processors listed below and only as necessary to provide the Service.

Stripe. Payment processing. When you purchase a subscription or pack, you are interacting with Stripe's payment surface. Stripe may use your information per its own privacy policy. Synap receives a Stripe customer ID, subscription status, and purchase records.
Amazon Web Services (AWS). Our API server and PostgreSQL database run on AWS infrastructure (EC2). AWS acts as an infrastructure processor; it does not receive or process your data independently.
Cloudflare. DNS and network-layer protection for getsynap.app. Cloudflare may see connection metadata (IP addresses) per its own privacy policy.

We do not sell, rent, or trade your personal information to any third party for advertising or any other commercial purpose.

4. Data storage and security

Your data is stored in a PostgreSQL database hosted on AWS infrastructure in the United States and is protected by Cloudflare at the network layer. We take daily encrypted backups. Access to production data is restricted to authorised personnel. No storage or security system is perfectly impenetrable; we will notify you promptly if a breach affects your personal information.

5. Data retention

We keep your account data — email, lesson history, streaks, and entitlements — for as long as your account exists. If you delete your account (see Section 6), we delete your personal data promptly, subject to any retention required for legal or fraud-prevention purposes. Stripe retains payment records per its own policies and legal obligations.

6. Your choices and rights

You have the following rights in relation to your personal data:

Access. You can request a copy of the personal data we hold about you by emailing [CONTACT EMAIL].
Correction. If your data is inaccurate, contact us and we will correct it.
Deletion. You can delete your account and all associated personal data at any time — from within the app or web interface (Account → Delete account), or by emailing [CONTACT EMAIL]. A deletion request cancels any active subscription (via Stripe's Customer Portal) and permanently removes your Synap data.
Unsubscribe from emails. You can stop transactional emails by deleting your account. We do not send marketing emails unless you explicitly opt in.

Synap currently serves users in the United States. If you are located in a jurisdiction with specific data-rights laws (such as California's CCPA or the EU's GDPR), please contact us — we will honour verifiable requests to the extent required by applicable law. Note to legal reviewer: expand this section once jurisdiction is confirmed.

7. Children's privacy

The Service is not directed to children under [13 / 16 — confirm with counsel]. We do not knowingly collect personal information from minors. If you believe a minor has provided us personal information, contact us and we will delete it.

8. Changes to this policy

We may update this policy periodically. If the changes are material, we will notify you by email or by a prominent notice on the Service before the changes take effect. The effective date at the top of this page will always reflect the current version.

9. Contact

Questions or requests: [CONTACT EMAIL]
[LEGAL ENTITY NAME]