Syna privacy policy

1. What you give us

• Your phone number, to sign up and sign in with an SMS code. It is required and never shown to other members.
• A password, if you set one. We store only a hash of it.
• An email address, if you add one. We use it so you can sign in with your password, and to send you a link that verifies it or a code that confirms deleting your account. We never send you marketing mail.
• Your profile: handle, display name, bio and avatar. These are public, and so are your join date, your post, follower and following counts, and whether your account is suspended. We keep a record of your earlier handles.
• What you post: posts, replies, quotes and reposts, with their images and videos. When you edit a post, its earlier versions stay readable, under "edited", by anyone who can see the post. Drafts are kept on our server until you publish or discard them.
• What you do on Syna: follows, likes, reposts, bookmarks, blocks, mutes, reports you send (with any text you add), and your notification and language settings. Who you follow and who follows you are public, and a post shows who liked and who reposted it.

2. What we collect automatically

• Sessions: for each device you sign in on, the IP address it signed in from and its browser and system. We use the address for security and to stop abuse, and never show it to you or anyone else; Settings lists your sessions by browser and system so you can revoke them.
• Country: we estimate your country from your IP address, on our own server with DB-IP's database, to choose your language before you sign in and your phone number's default country code when you sign up. We keep the country estimated at sign-up with your account.
• Limits: your IP address is used, in memory only, to limit how often codes and email links can be requested and how many requests can be made without signing in.
• Mail that cannot be delivered: if mail to your email address bounces, or you mark it as spam, we record the address and stop sending to it.
• Cookies: one keeps you signed in (30 days, renewed while you use Syna) and one remembers your language (400 days). There are no advertising or tracking cookies, and no third-party scripts run in your browser.
• Your browser keeps a copy of each draft you open, with your unsaved changes; publishing the draft in that browser removes the copy, and discarding it or signing out does not. If you turn on push notifications, your browser also keeps your push subscription and which account turned it on.

3. Who else handles your data

These services run parts of Syna for us. Each receives only what its part needs.

• Tencent Cloud: our server, which every visit to Syna passes through; SMS, which receives your phone number and each sign-in or account-deletion code; and object storage, image processing and the CDN, which store, resize and deliver the images and videos you upload and see the IP address of anyone who loads them.
• Amazon Web Services, through Amazon SES: your email address and each message we send you, and a notice when a message to you bounces or is reported as spam.
• Sentry: error reports from our servers and from your browser. A report can include the request that failed and our answer to it, with what you entered (such as a phone number, an email address, a code, or a password, which Sentry masks when it receives it), your IP address and your browser's details.
• PostHog: records of what happens on Syna, sent from our server, such as a sign-in, or a post published with its length and its number of images and videos. Each carries your public account id.
• Your browser's push service (Google, Apple, Mozilla or Microsoft), if you turn on push notifications: each notification, encrypted. It names who acted and the title of the post.

We do not sell your data or use it for advertising.

4. Where your data is stored

Syna's servers are in mainland China.

5. How long we keep it

• Your account and posts: until you delete them. Deleting a post removes it from Syna at once; its content and media stay on our server until your account is deleted.
• Deleting your account: you have 14 days to change your mind. Then we delete your phone number, email address, password, profile, the content of your posts, your drafts, images and videos, sessions, push subscriptions, likes, reposts, bookmarks, mutes and settings. Your handle stays reserved and is never given to anyone else, and these records remain: who followed or blocked whom, reports you sent or received, and moderation records. Copies of your images and videos can stay in storage and in the CDN's cache for up to 30 days. Error reports and usage records already sent to Sentry and PostHog stay there.
• Sessions: a session you sign out of or revoke in Settings is deleted, with its push subscription. A session that expires after 30 days without use is kept until your account is deleted.
• Undeliverable addresses: an address whose mail bounced or was reported as spam stays on our list of addresses we do not send to, also after the account that held it is deleted.
• Codes and links: sign-in and deletion codes last 5 minutes, email verification links 3 days.
• Server logs: a few files per service, replaced as they fill or within a week.
• Backups: a full copy of the database is taken before each update of Syna and kept on our server. A copy holds what the database held when it was taken, including data deleted since.

6. Your choices

• Edit or delete your posts, discard drafts, and block or mute anyone.
• Turn each kind of notification on or off, turn push on or off on each device, and change your language.
• Review and revoke your sessions, set a password, and add or change your email address.
• Delete your account in Settings.
• Ask for a copy of your data, or anything else about it, at contact@syna.social.

7. Children

Syna is not for children under 16.

8. Changes

When this policy changes, we update it here and change the date at the top.

9. Contact

contact@syna.social