Privacy Policy
The short version: We collect only what's needed to run the platform. We don't sell your data. You can delete your account and all associated data at any time. We use Stripe for payments — your card details never touch our servers.
1. Who We Are
SynkMind ("we", "us", "our") operates the SynkMind medical education platform at synkmind.com. This policy explains how we collect, use, and protect your personal information.
2. Information We Collect
| Category | Data | Why we collect it |
|---|---|---|
| Account | Email address, username, hashed password | Create and secure your account |
| Profile | Avatar URL, preferences, USMLE settings | Personalize your experience |
| Usage | Exam attempts, progress, streak, study activity | Track your learning progress |
| School | School enrollment (school name and slug) | Grant access to school-specific content |
| Payments | Stripe customer ID (no card numbers stored) | Process subscriptions and donations |
| Technical | Login timestamps, last login | Security and account integrity |
We do not collect: precise location data, browsing history outside our platform, or biometric data.
3. How We Use Your Information
- To provide and improve the platform and its features.
- To track your study progress and show you personalized analytics.
- To process payments and manage your subscription.
- To send transactional emails (email verification, password reset, subscription receipts).
- To provide study reminders and push notifications you opt into.
- To enforce our Terms of Service and prevent abuse.
- To improve platform performance and fix bugs.
4. Legal Basis for Processing (GDPR)
For users in the European Economic Area, we process personal data based on:
- Contract performance — to provide the services you've signed up for.
- Legitimate interests — for security, fraud prevention, and platform improvement.
- Consent — for optional push notifications and marketing communications.
- Legal obligation — where required by law.
5. Data Sharing
We do not sell, rent, or trade your personal information. We share data only with:
- Stripe — for payment processing. Stripe is PCI DSS compliant. See Stripe's Privacy Policy.
- Resend — for transactional email delivery (email verification, receipts).
- Railway — our cloud infrastructure provider where your data is hosted.
- AI providers — when you use Axon AI features, your questions (not your account info) are processed by our AI partners to generate responses.
All processors are contractually bound to handle your data securely and only for the purposes we specify.
6. Data Retention
We keep your data for as long as your account is active. If you delete your account, we delete your personal data within 30 days, except where we are required by law to retain certain records (such as payment records, which we keep for 7 years for accounting purposes).
7. Security
We implement industry-standard security measures including:
- Passwords are bcrypt-hashed — we never store plaintext passwords.
- All data is encrypted in transit using TLS/HTTPS.
- Payment processing is handled entirely by Stripe — card details never pass through our servers.
- Database access is restricted to authorized systems only.
- JWT tokens expire after 7 days and are invalidated on logout.
8. Cookies and Local Storage
SynkMind uses browser localStorage (not cookies) to store your session token and preferences. This data stays on your device. We do not use third-party tracking cookies or advertising networks.
If you use our web application, a service worker may cache certain assets locally to enable offline functionality. This cache contains only application files, not personal data.
9. Your Rights
You have the right to:
- Access — request a copy of the data we hold about you.
- Correction — update or correct your personal information in your profile settings.
- Deletion — delete your account and all associated data from your profile settings at any time.
- Portability — request your data in a machine-readable format.
- Objection — object to certain types of processing.
- Opt-out — unsubscribe from push notifications at any time from your device settings.
To exercise any of these rights, contact us at privacy@synkmind.com or use the account deletion feature in your profile settings.
10. Children's Privacy
SynkMind is intended for users 18 years of age or older. We do not knowingly collect personal information from users under 18. If you believe a minor has created an account, please contact us immediately and we will delete the account.
11. International Data Transfers
Our servers are located in the United States. If you access SynkMind from outside the US, your data may be transferred to and processed in the US. We ensure appropriate safeguards are in place for international transfers.
12. Push Notifications
If you opt into push notifications, we store a push subscription token on our servers to deliver notifications. You can revoke this at any time by disabling notifications in your browser or device settings, or from the notification settings within SynkMind.
13. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy with a new "Last updated" date. For significant changes, we will also notify you via email.
14. Contact
For privacy-related questions or requests, contact us at privacy@synkmind.com.
For general support, contact support@synkmind.com.