Privacy Policy
This policy names every outside company that touches your data and says what each one receives. Two of the things below are the kind most products leave out, so they are near the top rather than near the bottom.
The two you should read first
Our AI runs on servers in China. Every AI feature — the tutor, question generation, the Live Patient simulator — is powered by DeepSeek, a company based in the People's Republic of China. What you type into an AI feature, and the passages of your own material it is answering from, are sent to DeepSeek's servers to produce the answer.
Your AI conversations are stored, not just passed through. We keep the questions you ask and the answers you get, so you can reopen a conversation and so an answer can still show which passage it came from. You can delete them.
1. Who we are
SynkMind ("we", "us", "our") operates the SynkMind study platform at synkmind.com. If you have a question about anything here, support@synkmind.com reaches a person.
2. What we hold
| What | Specifically | Why |
|---|---|---|
| Account | Email address, username, bcrypt-hashed password, sign-up and last-login timestamps | To create and secure the account |
| Profile | Display name, avatar, language, exam date, study preferences | To set the product up the way you asked |
| Study record | Exam attempts and answers, flashcard schedules, streaks, readiness, planner entries | To schedule your revision and show your progress |
| AI conversations | The full text of your questions and the answers, plus which passages each answer used | So a conversation can be reopened and an answer can still cite its source |
| School | Which school you are enrolled at, and your enrolment status | To unlock the content your school has licensed |
| Payments | Stripe customer and subscription IDs, plan, renewal date. No card numbers. | To run your subscription |
| Usage meters | Per-request counts and cost: which feature, which model, how many tokens or characters. Never the content of the request. | To meter plan limits and to know what the service costs us |
| Push | A push subscription token, only if you turn notifications on | To send the study reminders you asked for |
What we do not hold
Card numbers. Precise location. Biometric data. Browsing history outside SynkMind. Advertising identifiers. Device fingerprints — we built one to stop trial abuse, found it was blocking real customers, and removed it. IP addresses — your IP is used in memory to rate-limit requests and is never written to our database.
3. Who else receives your data
These are all of them. Each is a processor acting on our instructions, not a party we sell to — we do not sell, rent or trade your data to anyone, for any purpose.
| Company | What they receive | When |
|---|---|---|
| DeepSeekPeople's Republic of China | The text of your prompt and the passages of your material being answered from. Not your name, email or account identifier. | Every AI feature: the tutor, generated questions and notes, the contradiction finder, the Live Patient simulator |
| RailwayUnited States | Everything in the table above — this is where the application and database run. | Always |
| Cloudflare R2United States | The original files you upload, and our own course media. Stored privately and served only to accounts entitled to them. | When you upload material, and when you open a lecture |
| StripeUnited States | Your email and payment details. Card numbers go to Stripe directly and never pass through our servers. | When you subscribe, renew, or change a plan |
| ResendUnited States | Your email address and the message. Verification, receipts, and reminders you opted in to. | When we send you email |
| Deepgram · Cartesia · ElevenLabs · Google CloudUnited States | The text to be spoken. Used for lecture narration and the Live Patient's voice; which one runs depends on the feature. | When you play narration or speak to a simulated patient |
| Your browser's makerGoogle · Microsoft · Apple | Two things we do not control. Dictation and lecture recording use the browser's own speech recogniser, which in Chrome and Edge sends the audio to that vendor. Push notifications are delivered through the vendor's push service. | When you dictate, record a lecture, or enable notifications |
| Google FontsUnited States | Your IP address and browser version, as a side effect of loading a typeface. Some older pages still request a webfont from Google's CDN. Newer pages, including this one, do not. | On page load, on the pages that still request it |
4. Material you uploaded to Engram
Engram — the part of SynkMind where you could upload your own lectures — has been withdrawn. You can no longer upload material, and nothing new is being collected under this heading. The commitments made about what was uploaded while it existed still stand:
- It was never used to train anything. Not our models, not anyone else's.
- It was never shown to other students, including students at your own school.
- Deleting your account deletes those files — the originals in storage as well as the database records. That sweep is still in place and still runs.
If you want anything you uploaded removed before then, email support@synkmind.com and it will be deleted.
5. What your school can see
If you joined through a school, the school knows you are enrolled, and staff there can see the grades and progress for the courses they run. They cannot see your AI conversations, or anything from products outside their own.
SynkMind staff can see account records and aggregate usage in an internal admin panel — this is how support requests get answered and how we find out that a feature is costing more than it earns. Access is limited to accounts with a staff role.
6. Legal basis (GDPR / UK GDPR)
- Contract — to provide the service you signed up for.
- Legitimate interests — security, abuse prevention, and understanding what the service costs to run.
- Consent — push notifications and any marketing email. Withdrawable at any time, without losing the product.
- Legal obligation — retention of payment records.
7. International transfers
Our application and database are in the United States. AI requests go to DeepSeek in China. If you are in the EEA or the UK, both are transfers outside your jurisdiction and China has no adequacy decision. We rely on your consent to use AI features and on standard contractual terms with our processors. If that transfer is not acceptable to you, every part of SynkMind except the AI features works without it — you can use the question banks, lectures, flashcards, planner and progress tracking and never touch an AI feature.
8. How long we keep it
- While your account is open — your account, study record, material and conversations.
- 30 days after you delete your account — everything above is erased, including uploaded files.
- 7 years — payment records, because accounting law requires it.
- Usage meters are kept as aggregates for cost analysis; they contain no content and are not linked to anything you wrote.
9. Security
- Passwords are bcrypt-hashed. We cannot read them and neither can anyone who steals the database.
- Everything is encrypted in transit with TLS.
- Card details are handled entirely by Stripe and never reach our servers.
- Session tokens expire after seven days and are revoked on logout and on password change.
- Uploaded files are stored privately and served only after an entitlement check.
No system is perfect. If we ever have a breach that puts you at risk, we will tell you what happened and what was taken, in plain words, without waiting to be asked.
10. Cookies and local storage
We use browser localStorage — not cookies — to hold your session token and preferences on your own device. There are no third-party tracking cookies and no advertising networks anywhere in SynkMind. If you install the app, a service worker caches application files so it works offline; that cache holds code and assets, not your data.
11. Your rights
- Access — a copy of everything we hold about you.
- Correction — change it yourself in settings, or ask us.
- Deletion — delete your account and everything with it, from settings, without asking anyone.
- Portability — your data in a machine-readable format.
- Objection and restriction — object to processing based on legitimate interests.
- Withdraw consent — turn off notifications, or stop using AI features, at any time.
- Complain — to your local data protection authority, if we have not resolved something to your satisfaction.
Email support@synkmind.com. We answer within 30 days and usually much sooner.
12. Age
SynkMind is for users aged 18 or over. We do not knowingly hold data on anyone younger. If a minor has created an account, tell us and we will delete it.
13. Changes
When this policy changes we update the date at the top. If a change is material — a new processor, a new category of data, a new place your data goes — we will email you rather than rely on you noticing.
14. Contact
Privacy questions, data requests, and everything else: support@synkmind.com.