SYNC Privacy Policy

Version 2026-09-25 · effective 25 September 2026

This policy explains what personal data SYNC collects, why, who receives it, how long we keep it and what your rights are. It covers the SYNC app for iPhone, this website (axiomic.app) and the SYNC web pages that open from our emails (account activation, password reset and invitations). It is the information we give under Articles 13 and 14 of the EU General Data Protection Regulation (GDPR).

1. Who is responsible

The controller of your personal data is AXIOMIC LTD, registered in the Republic of Cyprus under number HE 480260, Charalampou Mouskou & Grigori Afxentiou 20, Athinodorou Business Center, Floor 3, Office 306, 8010 Paphos, Cyprus. For any privacy question or request, write to [email protected].

2. What we collect

• Account: your email address, display name and profile photo if you add one; your password, stored only as a salted hash; the version of the Terms you accepted and when; your account ID and your SYNC (Matrix) user ID.
• Messages and content: the text of your messages, replies, edits and reactions; the photos, videos, files and voice messages you send; the names, photos and descriptions of groups; and the call events shown in chats.
• Voice transcripts: the text of a voice message, when a member of the chat asks for it (see Voice transcription).
• Contacts: who your contacts are and how each was added (QR code or link, Nearby, email invitation, search or a shared chat), and the invitations you send, including the email address of the person you invite. SYNC does not read or upload your phone’s address book.
• Activity: whether you are online and when you were last active, when you are typing, and which messages you have read.
• Calls: who called whom, voice or video, and when the call started, was answered and ended. Call audio and video pass through our call server in real time and are not recorded or stored.
• Device and technical data: the push notification tokens of your devices (for messages and for incoming calls), device names and session IDs, the IP addresses and app versions your devices connect with, and security records such as sign-ins, password changes and account deletion.
• Safety: the reports you send or that concern your messages (the reported message, the reason, and who reported whom, by name and SYNC ID); our moderators’ decisions and the emails that tell the sender about them; and the list of people you have blocked.
• Support: what you write to us and our replies.

We do not collect your location, your address book, health, financial or payment data, and SYNC contains no analytics, advertising or crash-reporting software. When you add a contact with Nearby, the distance between the two phones is measured on the phones and is not sent to us.

3. What other people see

• Anyone on SYNC can find you by searching for three or more letters of your name, or for your exact email address, and add you as a contact. Search results show your name, never your email address; searching for an exact address does tell the searcher that it has a SYNC account. When someone adds you, we email you.
• Your contacts and the people who share a chat with you see your name and profile photo, whether you are online and when you were last active, when you are typing, and which of their messages you have read.
• In a group, every member sees its messages. Members who join later can also read earlier messages.

4. Why we use your data, and on what legal basis

• To provide SYNC — your account, contacts and search, messages, media, calls, transcripts on request, notifications and support — because it is necessary to perform our contract with you (GDPR Art. 6(1)(b)).
• To keep SYNC safe — to prevent spam, fraud and abuse, protect accounts, handle reports and enforce the Terms of Use — on the basis of our legitimate interest, and our users’ interest, in a safe service (Art. 6(1)(f)).
• To send service emails — activation, password reset, security notices, the confirmation of an account deletion, and “someone added you” notices — as part of the contract (Art. 6(1)(b)). An invitation to someone who is not on SYNC yet is sent on the basis of the legitimate interest of the person inviting them (Art. 6(1)(f)); it is sent once and expires after 30 days.
• To comply with the law — for example to answer lawful requests from authorities or act on notices of illegal content (Art. 6(1)(c)).

Messages can reveal sensitive information, such as health or beliefs, if you choose to write about it. We do not read your messages or analyse them for advertising or profiling. A moderator sees a message only when someone reports it, when we investigate a serious breach of the Terms, or when the law requires it. We make no automated decisions that have legal or similarly significant effects on you.

Automatic content filter. Our servers automatically check every message (its text, the names of attached files, and reactions), every group name and description, the name you sign up with and any new name you take in a chat against a list of slurs, threats and terms linked to the sexual exploitation of children. Something that matches is refused: the message is not sent, or the name is not set, and the refused text is not stored. We keep only a log entry that a refusal happened, with the account, the chat and the list entry that matched. No person reads your messages for this check, and it is used for nothing else. We do this on the basis of our legitimate interest, and our users’ interest, in a safe service (Art. 6(1)(f)). If you think something was refused by mistake, write to [email protected].

5. Encryption: what SYNC does and does not protect

Every connection between the app and our servers uses TLS (HTTPS), and calls are encrypted between your device and our call server.

SYNC does not use end-to-end encryption. Your messages, media and group details are stored on our servers in a form our systems can read, so that they can reach all your devices and the people you write to, including members who join a group later. Our providers that carry the traffic (Cloudflare) and store data (Cloudflare R2 and our hosting provider, Contabo) process it on our behalf under contract. Please do not use SYNC for information that needs end-to-end encryption.

6. Notifications and message previews

Our push server sends notifications to your iPhone through the Apple Push Notification service (APNs), which Apple operates.

Message previews are on by default. The notification then carries the sender’s name, the chat’s name and the text of the message, so that content passes through Apple’s servers on its way to your iPhone. You can turn previews off in SYNC › Settings › Notifications › Show notification text; notifications then say only “New message”.

An incoming call reaches your iPhone as an Apple VoIP push, with the caller’s name, and is shown by iOS’s own call screen.

7. Voice transcription

Any member of a chat can ask for a voice message in that chat to be turned into text, including a voice message you sent. The recording is then sent from our server to our speech-recognition service, which runs on cloud servers rented from RunPod (USA).

The text is kept in our server’s memory for at most 24 hours, so that other members who ask for it do not make us send the recording again. It is not written to our database and is never added to the chat. RunPod processes the recording and the text only to return the text to us; its service logs, which only we can read, may keep the text for up to 90 days, and the recording may remain on the RunPod server until that server restarts. Recordings and transcripts are not used to train any model.

For the member who asks for the text, the legal basis is our contract with them (Art. 6(1)(b)). For the person who sent the voice message, it is the legitimate interest of the chat’s members in reading a voice message when they cannot listen to it (Art. 6(1)(f)); you may object (see Your rights), and if you do not want your voice to be transcribed, send text instead.

8. Who receives your data

Your messages and content go to the people you send them to: the members of the chat.

We use these service providers (processors). They process data only on our instructions and under a data processing agreement:

• Contabo GmbH (Germany): hosts, in the European Union, the servers that run our database, message server, call server and push server.
• Cloudflare, Inc. (USA): network and security. All traffic to our servers and to this website passes through Cloudflare, which terminates the TLS encryption as a proxy and so processes the content of requests and your IP address in transit.
• Cloudflare R2 (Cloudflare, Inc.): stores photos, videos, files, voice messages, and profile and group photos.
• RunPod (USA): speech-recognition servers, only for the voice messages someone asks to transcribe.
• Apple (Apple Push Notification service): delivers notifications and incoming calls to your iPhone, including the message text in notification previews while they are on.
• Resend (USA): sends our emails, including the emails that tell our moderators about a report; it receives the recipient’s email address and the email’s content.

We disclose data to authorities or courts when the law requires it, and when it is needed to protect someone’s safety. We never sell personal data and never share it for advertising. If our business is reorganised or sold, data may pass to the successor, which remains bound by this policy.

9. Transfers outside the European Economic Area

Some of our providers are based in the United States, and Cloudflare and RunPod may process data in data centres outside the European Economic Area. Such transfers rely on the European Commission’s adequacy decision for the EU–U.S. Data Privacy Framework, for providers certified under it, or on the European Commission’s Standard Contractual Clauses. You can ask us for a copy of these safeguards at [email protected].

10. How long we keep data

• Messages (text, replies, edits, reactions, call events): 730 days (two years) after they are sent, then deleted automatically. A message you delete disappears from the chat for everyone at once, and its content is erased from our server within 7 days.
• Photos, videos, files, voice messages and profile photos: until the account that uploaded them is deleted, even if the message that carried them was deleted or has expired. They can only be downloaded by a signed-in SYNC user. Within 30 days of the account’s deletion they are deleted from our servers and from our storage provider, Cloudflare R2 (see section 11).
• Voice transcripts: at most 24 hours in our server’s memory; up to 90 days in the service logs of our speech-recognition provider, RunPod (see section 7).
• Account data and contacts: while your account exists. Invitation links expire after 7 days (Nearby: 10 minutes) and email invitations after 30 days; the record of an invitation, including the invited address, is kept until the account that sent it is deleted.
• IP addresses and device details of your sessions: up to 28 days on the message server. Other server logs, including the logs of this website, are kept for a limited time to run and secure the service.
• Emails we sent: the content of an email, which can hold a one-time link, is erased from our database 7 days after it was sent. The email confirming an account deletion keeps neither your address nor your name once it has been sent.
• Push tokens: until you sign out, turn notifications off on the device, or delete your account.
• Call records: while your account exists; after a deletion, only records that no longer show your name or email address remain.
• Reports: for as long as we need them to handle the report and any dispute or legal claim that follows. They refer to people by SYNC ID; the emails to our moderators about them, which also give names, are erased 7 days after they are sent, and at once when the account of the reporter or of the sender is deleted.
• Security audit log: records of security-relevant actions (such as sign-up, sign-in, account deletion and moderation decisions), with the IP address and device details where available, are kept as a lasting security record. They never contain the content of messages.

11. Deleting your account

You can delete your account in the app: Settings › Account › Delete account, confirmed with your password. Then:

• at once: you can no longer sign in, you are signed out on every device and all your sessions end, your contacts, invitations and notification registrations are removed, chats show you as “Deleted account” without your photo, and your email address, name and profile are removed from your account record, so the address can be used again;
• in the background, normally within 24 hours and at the latest within 30 days: the messages you sent are removed from every chat, the photos, videos, files and voice messages you uploaded are deleted from our servers and from our storage provider (Cloudflare R2), and your SYNC (Matrix) account is closed and erased;
• we send a confirmation to your email address; once it has been sent, we keep only the record that it was sent, without your address or name.

What remains: the security audit log (without message content); call records and reports that refer to the deleted account without your name or email address; the reactions you added to messages, shown as “Deleted account”; and copies that other people made themselves, such as screenshots or forwarded messages.

If you can no longer sign in, write to [email protected] from the account’s email address and we will delete the account for you.

12. Your rights

Under the GDPR you have the right to access your personal data and get a copy of it; to have it corrected (you can change your profile photo in the app; to correct your name, write to us); to have it erased (you can delete your account in the app); to restrict its processing; to receive the data you gave us in a portable format; to object to processing based on legitimate interests; and to withdraw a consent at any time, without affecting what was done before.

To use these rights, write to [email protected], if possible from your account’s email address. We answer within one month and may ask you to confirm your identity.

You may also complain to a supervisory authority: in Cyprus, the Commissioner for Personal Data Protection, 1 Iasonos Street, 1082 Nicosia (P.O. Box 23378, 1682 Nicosia), phone +357 22 818 456, email [email protected], www.dataprotection.gov.cy; or the authority of the EU country where you live or work.

13. Children

SYNC is only for people aged 16 or older. We do not knowingly collect data from anyone younger; when we learn that an account belongs to someone under 16, we close it and delete its data. If you think a child is using SYNC, tell us at [email protected].

14. Permissions on your iPhone

SYNC asks for access only when you use a feature that needs it: the camera (photos, videos, video calls and scanning QR codes), the microphone (voice messages and calls), your photos (to send or save them), the local network and Nearby Interaction (only while Add contact › Nearby is open), and notifications. You can change these in the iOS Settings app at any time.

15. This website

axiomic.app sets no cookies and runs no scripts, analytics or advertising. Cloudflare, which delivers it, and our web server process your IP address and the details your browser sends in order to deliver and protect the pages; Cloudflare may set strictly necessary security cookies.

16. Changes to this policy

We update this policy when SYNC, our providers or the law change. The version and date at the top show the current version, and we tell you in the app about important changes.

17. Contact

AXIOMIC LTD (HE 480260), Charalampou Mouskou & Grigori Afxentiou 20, Athinodorou Business Center, Floor 3, Office 306, 8010 Paphos, Cyprus.
Email: [email protected]