Privacy Policy

1. Age Restrictions

Our service is intended for users who are 13 years of age or older. We do not knowingly collect personal information from children under 13. If you are under 13, do not use our service or provide any information to us.

If we learn that we have collected personal information from a child under 13, we will delete that information as quickly as possible. If you believe we might have information from or about a child under 13, please contact us at [email protected].

By using our service, you represent that you are at least 13 years old. We reserve the right to terminate accounts that violate this age requirement.

2. Data We Collect

We collect the following types of information:

Account Information: When you create an account through our authentication provider, we collect your email address, name, username, and if you sign up using social media accounts, we may receive profile information including links to your social media profiles.

Learning Content: We store the educational content you create, including decks, notes, note templates, card types, and individual cards generated from your templates.

AI Processing: When you create or edit learning content, we send the relevant content to Google Cloud to create or update embeddings (numerical representations used to support search). When you search, we send your search query to Google Cloud to support search. The assistant and AI deck generation features send relevant learning content and prompts to Anthropic to generate responses and decks. We store embeddings. AI-generated learning content that you save remains subject to the learning-content provisions of this Policy. Provider processing and retention are described in Section 5.

AI Usage Diagnostics: We store AI usage diagnostic metadata, including the number of messages, context length, and tool-call names, counts and status. Tool-call logs are limited to names, counts and status metadata; they do not include tool arguments or results. These AI usage logs contain metadata rather than study content or prompt and response text. We use this metadata for the internal evaluation described in Section 3 and retain it under the Service Data provisions in Section 6.

Performance Data: We log your learning activity and performance during review sessions, including response times, accuracy, and study patterns to track your progress and optimize the spaced repetition algorithm.

Communications: We use your email address to send essential service communications such as password resets and account and security notices, as well as study reminders when you're due for review sessions. During the Alpha, necessary service communications also include data reset notices and changes to the Alpha Participation Agreement. We may send optional participation emails, including research invitations, surveys, requests for feedback sessions and Alpha release notes; you can opt out of these emails at any time. Taking part in the Alpha or in research does not enroll you in marketing. We send marketing and promotional messages only with your explicit consent.

Survey and feedback answers: Answering is always optional. If you choose to answer, we store your answers in our database: in the onboarding survey, how you heard about us, what you study and which tools you used before, with any short notes you add; and, when you cancel a subscription or ask to delete your account, the reason you pick and any comment you write, together with your plan, whether you belong to an organization, and a range for how old your account is. We never send the text you type in these answers to our analytics provider or to our payment provider. The one thing we pass on is the reason you pick when you cancel a subscription, which goes to our payment provider, Stripe, with the cancellation. If you cancel in Stripe's customer portal instead, the reason and comment you give there go to Stripe, and we copy them into our database. We store your answers even if you have turned product analytics off or your browser sends a Global Privacy Control signal, because you chose to give them; in that case we send no analytics record about them (see Section 8 for how we treat that signal). Your survey answers are deleted with your account. Your answers about leaving are kept after your account is deleted, unlinked from your account and from the payment record.

Diagnostics and Service Logs: We collect basic diagnostics, error reports and service logs to find and fix bugs, maintain service reliability and protect security. Reports and logs may contain the technical details needed to investigate a problem. This necessary operational processing is separate from optional product analytics and is not turned off by the analytics opt-out. We will not turn on session recording or other extra diagnostics for your account unless you opt in separately. Retention is governed by Section 6.

Product Analytics: When you use the signed-in app, we record which features you use — for example creating a deck, finishing a review session, or opening a page — so we can see what works and what to improve. These records use a pseudonymous identifier generated from your account ID using a secret cryptographic key; we do not send your name, email address, card or note content, or the text you type. They carry coarse properties such as counts, durations rounded into ranges, and which part of the app an action came from. When you give leaving feedback, the record carries the reason you picked and whether you wrote a comment, never the comment itself. Browser records also carry the kind of device (phone, tablet, computer), whether Synapdeck runs as an installed app, and a rough screen-size range. We also attach a few account-level properties to these records, such as your interface language, subscription plan, how you signed up, how your account arrived (an invitation, your organization adding you, an access code, a shared link, or directly), and your role in an organization, and, if you answered the onboarding survey, the coarse categories you picked in it (where you heard about us, what you study and which tools you used before), and we keep anonymous counts, with no identifier, of events such as failed sign-ins and account deletions. If you belong to an organization, records may also carry a pseudonymous identifier for that organization, generated the same way, along with its plan tier and a range for its number of members. We derive your approximate location (country and region) from your IP address. We do not retain your IP address as part of your product analytics records.

Website Analytics: Our public website, synapdeck.com, counts page views without cookies or any other storage on your device. To tell one visit from another, our analytics provider combines your IP address, your browser's user agent and the website's domain with a secret value that changes every day, computes a one-way hash, and then discards the IP address and user agent. The hash cannot be linked to you, to your Synapdeck account, or to your visits on other days. With each page view we record the page, the general kind of site that sent you (a search engine, a social network, another website, or none) and whether you came from one of our campaigns; we do not record the address of the site that referred you.

How You Found Us: When you follow a link from our website into the app, or join our waitlist, we pass along the same general categories, the website page you were on, and any campaign tags (utm_ parameters) in the link that first brought you to the website. If you then create an account, we store these with your account, and the general category also joins the account-level properties of your product analytics; campaign tags are never sent to our analytics provider. For a waitlist sign-up, we store them with your waitlist entry at our email provider, Loops. A Global Privacy Control signal turns off website analytics but not this record of how you found us, which we keep for ourselves and never sell or share for advertising.

3. How We Use Data

We use your personal information for the following purposes:

Service Provision: To provide and maintain our spaced repetition learning platform, including creating and managing your account, storing your learning materials, and delivering core platform functionality.

AI Features: To generate assistant responses and decks, support search, and create or update embeddings when learning content is created or edited, using relevant learning content, prompts and search queries with the providers described in Sections 2 and 5.

Internal AI Evaluation: To assess model and tool behavior using AI usage diagnostic metadata, for example to identify unusual tool use and assess whether changes to tool instructions improve that behavior. We do not use actual study content for these evaluations.

Model Training: We do not currently train or fine-tune AI models. Before using your data for any future model training or fine-tuning, we will update this Privacy Policy to explain that use, give the notice required by Section 13, and obtain any consent required by applicable law.

Learning Optimization: To track your study progress, calculate review schedules, and personalize the spaced repetition algorithm based on your performance data to optimize your learning experience.

Collaboration Features: To enable sharing and collaboration on study decks with other users, allowing you to share your educational content and access content shared by others.

Communication: To send essential service communications, including password resets, account and security notices and necessary Alpha data reset and agreement notices, as well as study reminders. We also use your email address for optional participation research and Alpha release notes, which you can opt out of at any time. Marketing and promotional messages require your explicit consent; participation in the Alpha or research does not provide that consent.

Service Improvement: To understand how features are used, find problems, and decide what to build next, using the product analytics described in Section 2 and voluntary feedback.

Debugging and Security: To investigate errors, fix bugs and maintain service reliability and security using basic diagnostics, error reports and service logs. To investigate a bug you report or one that affects your account, a small number of our staff may view the affected content. They will look only at what they need to investigate and fix the problem.

4. Legal Bases for Processing

We process your personal information based on the following legal grounds:

Contractual Necessity: We process your account information, learning content, prompts and performance data as necessary to provide the services you've requested, including AI features, and fulfill our contractual obligations to you.

Legitimate Interest: We have a legitimate interest in analyzing service usage to improve our platform, ensure security, and develop new features. These interests also include using necessary diagnostics to find and fix bugs and maintain reliability, evaluating model and tool behavior using the AI usage diagnostic metadata described in Sections 2 and 3, and learning from voluntary feedback in ways you would reasonably expect. We balance these interests against your privacy rights and do not use your data in ways you would not reasonably expect. Participation research is optional, and you can opt out of research invitations and Alpha release notes at any time. We process product analytics for our legitimate interests in understanding and improving our service. We limit the information collected for product analytics, exclude your learning content, and allow you to object to that processing at any time (see Section 8).

Consent: We process your email address for marketing communications only with your explicit consent. You can withdraw this consent at any time by unsubscribing from marketing emails or contacting us directly.

Legal Compliance: We may process your information to comply with applicable laws, regulations, and legal processes.

5. Data Sharing

We share your personal information with the following third parties:

Service Providers: We use trusted third-party service providers to operate our platform:

• Authentication Services: Handle user authentication and account management
• Email Delivery Services: Deliver service communications, optional participation research emails and Alpha release notes. Marketing or promotional messages are sent only to users who have explicitly consented to them
• Payment Services: Stripe, Inc. processes payments and subscriptions for paid plans
• Cloud Infrastructure Providers: Host our platform and databases
• AI Model and Embedding Providers: Google Cloud processes relevant learning content to create or update embeddings when content is created or edited, and search queries when you search. Anthropic processes relevant learning content and prompts for assistant responses and AI deck generation. These providers process this information on our behalf under their standard business agreements. We do not authorize these providers to use your content to train their models. Provider processing and retention are separate from our own retention practices: providers may retain data for specified service, security or legal purposes under their applicable terms and agreements. International transfers for this processing are subject to the safeguards described in Section 11, including Standard Contractual Clauses where required.
• Analytics Provider: PostHog, Inc. (PostHog Cloud, United States) processes our product analytics on our behalf under a data processing agreement. It processes the pseudonymous analytics records described in Section 2, which do not include your name, email address, or learning content, and the website analytics described there, which carry no identifier.

User Collaboration: When you share educational content (decks, notes, templates) with other users, that content becomes accessible to those users and may be used in their own learning activities.

Legal Requirements: We may disclose your information if required by law, regulation, legal process, or governmental request, or to protect our rights, property, or safety, or that of others.

Business Transfers: In the event of a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction.

We do not sell, rent, or trade your personal information to third parties for their marketing purposes.

6. Data Retention

We retain your personal information for as long as necessary to provide our services and fulfill the purposes described in this Privacy Policy:

Account Data: We retain your account information, learning content, and performance data while your account is active and for a reasonable period after account deletion to allow for account recovery.

Embeddings: We retain embeddings with the source learning content they represent and delete them when that source content is deleted. The account recovery provisions above apply to this content and its associated embeddings. If shared content remains available under Section 7, its associated embeddings remain with it.

Survey and Feedback Answers: We keep your onboarding survey answers while your account exists and delete them when your account is deleted. We keep the answers you gave about leaving (the reason, any comment, and the plan, organization and account-age range recorded with them) after your account is deleted, unlinked from your account and from the payment record.

Marketing Communications: If you've subscribed to marketing emails, we retain your email address until you unsubscribe or delete your account.

Service Data: We retain operational and service data as needed to maintain platform functionality, security, and compliance with legal obligations. AI usage diagnostic logs follow this same retention approach.

Product Analytics: We keep analytics records while your account exists. When your account is deleted, we ask PostHog to delete them (see Section 7).

Legal Compliance: We may retain information longer if required by law, to resolve disputes, or enforce our agreements.

You can request deletion of your account and associated data at any time. Specific deletion procedures are outlined in Section 7 below.

7. Account Deletion

You can delete your account at any time through your account settings or by contacting us at [email protected].

Personal Data Deletion:

• Your account profile and authentication information
• Your individual learning progress and performance data
• Embeddings associated with learning content that is deleted with your account. Embeddings for shared content retained under the Shared Content Handling provisions below remain with that content
• Your onboarding survey answers
• Your email from our marketing lists
• Your product analytics records. We ask PostHog to delete them when the rest of your account's personal data is deleted. PostHog processes deletion requests asynchronously, so removal of the underlying event data may take additional time.

Feedback About Leaving: The reason and any comment you gave when cancelling a subscription or asking to delete your account are not deleted with your account. We unlink them from your account and from the payment record, and keep them, along with the plan, organization and account-age range recorded with them. If your comment includes information that identifies you, it will still contain that information.

Shared Content Handling: When you delete your account, educational content you've shared with other users will remain accessible to those users to preserve their learning experience. We remove system-level identifiers (such as your username and account ID) from this shared content, but we cannot remove identifying information you may have included within the content itself (such as your name in descriptions or personal references in study materials).

Important Note: Before sharing content, consider that it may persist after account deletion and could still identify you through information you've included in the materials themselves.

Timeline: We process account deletion requests promptly, typically within 30 days. Some data may be retained longer where required by law or for legitimate business purposes.

8. Your Analytics Choices

You can turn product analytics off at any time under Settings → Privacy. When it is off, the app sends no product analytics about you, and records already queued in your browser are discarded. This choice does not disable the necessary diagnostics, error reports and service logs described in Section 2. Session recording or other extra diagnostics require a separate opt-in.

If your browser sends a Global Privacy Control signal, we automatically disable product analytics in that browser. While you are signed in, we also treat the signal as your own analytics opt-out and store it, so it also covers analytics events about your subscription that come from our payment provider. If you turn analytics back on in Settings while your browser still sends the signal, we switch it off again the next time the signal reaches us.

Turning analytics off stops future collection but does not automatically delete previously collected records. You can request deletion of those records by contacting us at [email protected].

Analytics in the app uses no cookies or local storage for tracking. Website analytics uses none either, and is off in any browser that sends a Global Privacy Control signal.

9. Your Rights (CCPA)

California residents may have additional rights under the California Consumer Privacy Act (CCPA), where applicable, including:

Right to Know: You can request details about the personal information we've collected about you in the past 12 months, including:

• Categories and specific pieces of personal information collected
• Sources from which we collected it
• Business purposes for collection
• Categories of third parties we've shared it with

Right to Delete: You can request deletion of personal information we've collected from you, subject to certain exceptions.

Right to Correct: You can request correction of inaccurate personal information we maintain about you.

Right to Opt-Out: You can opt out of the "sale" or "sharing" of your personal information. We do not currently sell personal information.

Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA rights by denying services, charging different prices, or providing different service quality.

Authorized Agents: You may designate an authorized agent to make requests on your behalf with proper verification.

To exercise these rights, contact us at [email protected]. We'll verify your identity and respond within 45 days.

10. Your Rights (GDPR)

If you are in the European Economic Area, UK, or Switzerland, the General Data Protection Regulation (GDPR) gives you the following rights:

Right of Access: You can request a copy of the personal data we hold about you and information about how we process it.

Right to Rectification: You can request correction of inaccurate or incomplete personal data.

Right to Erasure ("Right to be Forgotten"): You can request deletion of your personal data in certain circumstances, such as when it's no longer necessary for the original purpose.

Right to Data Portability: You can request your personal data in a structured, machine-readable format to transfer to another service.

Right to Object: You can object to processing based on legitimate interests, including direct marketing (which you can opt out of at any time).

Right to Restrict Processing: You can request we limit how we use your personal data in certain circumstances.

Right to Withdraw Consent: Where processing is based on consent, you can withdraw it at any time.

Right to Lodge a Complaint: You can file a complaint with your local data protection authority.

To exercise these rights, contact us at [email protected]. We'll respond within one month. These rights are subject to the conditions and exceptions provided by applicable law.

11. International Transfers

We may transfer your personal information to countries outside your home country, including the United States where our servers are located.

Transfer Mechanisms:

• Standard Contractual Clauses: Where required, we use appropriate contractual safeguards, including European Commission-approved Standard Contractual Clauses, for international transfers of personal data
• Adequacy Decisions: We may transfer data to countries deemed to have adequate protection by relevant authorities
• Your Consent: In some cases, we may rely on your explicit consent for specific transfers

Safeguards: When transferring data internationally, we implement appropriate safeguards including:

• Contractual protections requiring recipients to protect your data
• Technical and organizational security measures
• Regular assessment of transfer arrangements

Third-Party Services: Some of our service providers may be located in different countries. We ensure they provide adequate protection through binding agreements and compliance with applicable data protection laws.

Your Rights: International transfers don't affect your rights under applicable privacy laws. You can contact us for more information about specific transfers or safeguards.

12. Contact Information

For all privacy questions, data requests, or concerns:

• Email: [email protected]
• We aim to respond within 5 business days

Data Controller: Synapdeck, Inc.

Mailing Address: Synapdeck 447 Sutter St., Ste 405, #223 San Francisco, CA 94108

If you're unsatisfied with our response, you may contact relevant regulatory authorities in your jurisdiction.

13. Policy Updates

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors.

Notification of Changes:

• Material Changes: We'll notify you at least 30 days before material changes take effect via email (to your registered address) and prominent notice on our website
• Minor Changes: Non-material updates will be posted on our website with an updated "Last Modified" date
• Legal Requirements: Changes required by law may be implemented immediately with appropriate notice

What Constitutes Material Changes:

• New purposes for data collection or use
• Sharing data with new categories of third parties
• Significant changes to your rights or our retention practices
• Changes to international transfer arrangements

Your Options: If you disagree with changes:

• You may close your account before changes take effect
• If you disagree with a policy change, you may stop using the service and close your account. Where applicable law requires your consent for a change in processing, we will obtain it separately
• Some changes may be required for continued service provision

Review Recommendation: We encourage you to review this policy periodically to stay informed about how we protect your information.

Last updated: November 13, 2026. Effective: November 13, 2026.