Personal information you disclose to us

We collect personal information that you voluntarily provide when you register on Syncwork, express interest in our products, use features on the Services, or contact us. Depending on how you interact with us, this may include:

• Names
• Phone numbers
• Email addresses
• Usernames
• Passwords
• Contact preferences
• Billing addresses
• Debit / credit card numbers
• Mailing addresses
• Contact or authentication data
• Company name
• Country
• Profile picture
• Timezone
• Language preference

Sensitive information. We do not process sensitive information.

Payment data. Payments are processed by Dodo Payments, our merchant of record. We do not directly collect or store your full card details — Dodo Payments handles this in accordance with card network security standards (PCI DSS). See their privacy policy.

Social login data. If you register using an existing social account, we collect the profile information you authorize from that provider.

Information automatically collected

Some information — such as your IP address, browser and device characteristics — is collected automatically when you use the Services. This is used primarily to maintain security, diagnose issues, and understand usage patterns. It includes:

• Log and usage data — IP address, device and browser type, pages viewed, actions taken, timestamps, crash reports.
• Device data — hardware model, OS, carrier, system configuration.
• Location data — approximate location inferred from IP address. You can opt out via device settings, though some features may stop working.

Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Information collected from other sources

We may obtain limited data about you from public databases, marketing partners, and similar outside sources — for example, mailing addresses or social profile information — to keep our records accurate and improve relevant communications.

We process personal information to provide, improve, and administer the Services, to communicate with you, for security and fraud prevention, and to comply with law. Specific purposes and retention periods include:

Account creation & authentication

For as long as the account is active, and up to 12 months after deletion.

Delivering the Service

For as long as the account is active, and up to 12 months after deletion.

Responding to support requests

Up to 24 months after the inquiry is resolved.

Sending administrative information

For as long as the account is active.

Fulfilling & managing orders

Up to 7 years, for financial recordkeeping and tax compliance.

Enabling user-to-user communication

For as long as the account or workspace membership is active.

Requesting feedback

Up to 12 months from the date of collection.

Protecting the Services (fraud monitoring)

Up to 12 months, or longer during an active investigation.

Identifying usage trends

Up to 24 months from the date of collection.

Generating invoices, timesheets & reports

Names, billing addresses, and workspace/project data are used to generate invoices, timesheets, and profitability reports on behalf of users and workspaces.

Improving product features & reliability

Aggregated usage and performance data is analyzed to fix bugs and prioritize development.

If you're in the EU or UK — we rely on consent, performance of a contract, legitimate interests (e.g. improving the Services, preventing fraud), legal obligations, and vital interests, as applicable.

If you're in Canada — we rely on your express or implied consent, which you may withdraw at any time, except in limited cases such as fraud detection, legal investigations, or business transactions where consent isn't required by law.

We share data with vendors and service providers under written contracts that limit what they can do with it. We work with:

• Third-party account connections — Google account, GitHub account
• Invoicing & billing — Dodo Payments
• Authentication — Clerk, Google OAuth 2.0, GitHub OAuth
• Hosting — Vercel
• Infrastructure & testing — Cloudflare, Vercel

We may also share information during a business transfer (merger, acquisition, sale of assets) or when you interact with other users through public or shared areas of the Services.

Yes — to maintain security, remember preferences, and support basic functionality. We also allow select third parties to use tracking technologies for analytics. Details are in our Cookie Notice. Where required, you can opt out of tracking treated as a "sale" or "sharing" under applicable US state law — see Section 13.

If you register using a third-party account (e.g. Facebook or X), we receive the profile information that provider makes available — typically name, email, and profile picture. We use it only as described in this notice; their handling of your data is governed by their own privacy policy.

Our servers are located in the United States and Singapore. Wherever you're located, your data may be processed in these facilities and those of our third-party providers. For transfers from the EEA/UK, we rely on the European Commission's Standard Contractual Clauses, available on request.

Only as long as necessary for the purposes set out in this notice, unless a longer period is required by law (tax, accounting, etc.). See Section 2 for purpose-specific retention periods. When there's no ongoing need, we delete or anonymize the data, or securely isolate it if immediate deletion isn't possible.

We maintain reasonable technical and organizational safeguards. No method of transmission or storage is 100% secure, so we can't guarantee absolute protection — access the Services only within a secure environment.

We do not knowingly collect data from anyone under 18. By using the Services you confirm you meet this threshold, or that you're a parent/guardian consenting on a minor's behalf. If we learn we've collected data from a minor, we deactivate the account and delete the data — contact support@syncwork.app.

Depending on where you live — including the EEA, UK, Switzerland, and Canada — you may have the right to access, correct, delete, or port your personal information, and to object to certain processing. Requests go to syncwork.app/contact.

UK residents can also complain to the Information Commissioner's Office — ico.org.uk/make-a-complaint, or by phone at 0303 123 1113.

You can withdraw consent at any time by contacting us. This doesn't affect processing that already occurred lawfully.

No uniform standard for DNT signals exists yet, so we don't currently respond to browser DNT signals.

Residents of California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, and Virginia may have rights to know, access, correct, delete, obtain a copy of, and limit use of their personal information — plus a right to opt out of targeted advertising, sale, or profiling.

We have not sold personal information to third parties for a business purpose in the preceding 12 months. To exercise these rights, visit syncwork.app/contact or email support@syncwork.app. We verify identity before acting on any request, and you can appeal a declined request at privacy@syncwork.app.

Australia & New Zealand — processed under the Privacy Act 1988 (AU) and Privacy Act 2020 (NZ). Complaints go to the OAIC or the NZ Privacy Commissioner.

South Africa — complaints regarding POPIA can be directed to the Information Regulator at enquiries@inforegulator.org.za.

Yes. We'll update the "Last updated" date above whenever this notice changes, and notify you directly for material changes.

Visit syncwork.app/contact to request access, correction, or deletion of your personal information.