Legal

Privacy Policy

Last updated: 15 October 2026

1. Data Controller

The controller responsible for the processing of personal data within the meaning of the GDPR is:

Sync UG (haftungsbeschränkt)
represented by its Managing Director Moritz Konsemüller
Langer Weg 106, 26629 Großefehn, Germany
Phone: +49 15679 401584
Email: support@syncmental.com

2. What data we collect

2.1. Registration data

  • Name
  • Email address
  • Password (stored encrypted)
  • Sport and performance level (if provided)

2.2. Usage data

  • Training exercises used
  • Progress and completed sessions
  • Interactions with the AI coach

2.3. Data from the AI coach

When you use the AI coach, we process the content of your messages as well as the results the two of you work out together. This includes a running summary of the conversation and individual points you have recorded, such as a strength, a guiding sentence or a step of a routine, each in your own words. These results remain stored so that the coach can build on them in later conversations instead of starting over every time.

The app contains two chat coaches operated by different providers. Section 4 sets out which provider receives which data.

If you use voice input, we also process the audio recording of your input in order to turn it into text. For this purpose the recording is transmitted to our speech recognition provider (see section 4). Only the resulting text is stored, not the recording.

2.4. Technical data

  • Device type (e.g. iPhone, Android)
  • IP address
  • Operating system
  • Error reports from the app (e.g. error message, app version and where the error occurred)

2.5. Payment data

Payment information is processed via Stripe / Apple In-App Purchases. We do not store credit card data.

2.6. Apple Health (optional)

If you allow it in the app settings, Sync reads only your completed workouts from Apple Health in order to remind you of your mental training shortly afterwards. That reminder is created on your device. Your health data never leaves your device, we do not store it and we do not share it with third parties. Sync never writes data to Apple Health. You can withdraw the permission at any time in the app settings or in Apple Health.

2.7. Sport profile on our website

When you take the sport profile on our website, your answers are stored only locally in your browser so you can pause and continue. They are deleted after 48 hours, never reach our servers and carry no identifier. The result is calculated in your browser. If you use the share function, the five scores are part of the link that you pass on yourself. For audience measurement we use Vercel Web Analytics, which works without cookies; it records how far visitors get in the test, not which result they receive.

2.8. No cookies on our website

Our website sets no cookies and stores nothing in your browser, except for the sport profile described above while you take it. The language you see follows the address of the page. If you arrive from elsewhere, for example from a search engine, we send you to the matching version based on your country and your browser language. To keep a language you chose yourself while you click on, we only check whether you came from one of our own pages; your browser sends this information anyway. If you send us a request through a form, we note the same information so we know which page the contact came from. Our audience measurement (Vercel Web Analytics) also works without cookies. We serve the QR code for downloading the app ourselves, it is not loaded from a third party.

3. How we use your data

  • Providing and improving the Sync app
  • Personalising content (e.g. recommended exercises)
  • Analysing usage behaviour to optimise the app
  • Customer service and support
  • Security and fraud prevention
  • Emails and notifications about your training and Sync Pro (see "Emails and notifications from Sync")

We do not sell or rent your data to third parties.

Legal Bases for Processing

We process your personal data on the following legal bases:

  • To perform our user agreement and provide the app (Art. 6(1)(b) GDPR). This includes registration, personalisation of your training plan, and use of the app's features.
  • On the basis of your consent (Art. 6(1)(a) GDPR), for example when processing optional information. For users between 14 and 15 years of age, processing is based on the consent of their parents or legal guardians (Art. 8 GDPR).
  • To protect our legitimate interests (Art. 6(1)(f) GDPR), in particular to analyse and improve the app, ensure security, and prevent fraud.
  • To comply with legal obligations (Art. 6(1)(c) GDPR), such as retention periods under tax and commercial law.

You may withdraw any consent given at any time with effect for the future.

Emails and notifications from Sync

We send the following to your email address and, if you allow it, as push notifications to your device:

  • Messages about your account, for example about signing up, your subscription or the end of a trial
  • Reminders and tips about your training in the app
  • Questions asking for your opinion of Sync
  • Offers for Sync Pro, for example a discount

Messages about your account are part of our user agreement (Art. 6(1)(b) GDPR). We send reminders, questions asking for your opinion and offers on the basis of your consent (Art. 6(1)(a) GDPR) or, if you have subscribed to Sync Pro, on the basis of our legitimate interest in informing you about our own similar services (Art. 6(1)(f) GDPR in conjunction with Section 7(3) of the German Act against Unfair Competition, UWG). We use OneSignal to send them (see section 4).

You can object to these emails and notifications at any time, without incurring any costs other than the transmission costs at the basic rates. The unsubscribe link in every email, the switch in the settings of the app or a short message to support@syncmental.com is enough. You can also turn off push notifications in the settings of your device. You will still receive messages about your account that are necessary for the agreement.

4. Sharing data with third parties

We only share your data when necessary:

  • Supabase (hosting, database and authentication)
  • Anthropic PBC, San Francisco, USA (AI-powered coaching in the chat)
  • OpenAI, USA (second chat coach in the app and turning your voice recordings into text)
  • ElevenLabs, USA (voicing our spoken exercises)
  • Vercel, USA (operating this website and our API, audience measurement without cookies)
  • PostHog (product analytics, processed on servers in the EU)
  • Sentry (error and crash reports from the app, processed on servers in the EU)
  • OneSignal, USA (sending push notifications and emails)
  • RevenueCat, USA (management of subscriptions and in-app purchases)
  • Meta Platforms, USA (measurement and optimisation of our advertising)
  • Capgo (delivery of app updates)
  • Apple and Google (sign-in with Apple or Google and payment processing via the App Store and Play Store)
  • Stripe (payment processing when purchasing through the browser)

Details on processing by Anthropic

For the AI-powered coaching we transmit the content of your messages and an extract of the information stored about you in the app:

  • your sport, your age and age group, and your gender
  • your subscription status, that is whether your account is free or paid, and for a paid account its term
  • upcoming competitions and past competition results
  • your self-assessments from the last 30 days and how they have developed
  • information about your training: upcoming and completed exercises, the date of your last training, your preferred exercises, your streak and your satisfaction with recent sessions
  • how long you have been registered and how many days have passed since your last login
  • summaries of earlier and parallel conversations as well as the results worked out in coaching

In the chat, we do not transmit your name to Anthropic. The text sent to the model contains a placeholder; we only insert your first name into the finished answer on our server, before it is sent to the app. If you mention your name yourself in a message, it is part of that message.

This is different for personal audio exercises written for you, for example to get started after onboarding, on a topic from coaching, or as an exercise of your own built from your answers. These exercises address you by name. For them we transmit your first name, your sport, your age, your gender and your self-assessments to Anthropic, and depending on the exercise also your answers from onboarding (such as goals, focus areas and experience with mental training), the topic from coaching together with your streak and the days since your last login, or your answers to the questions about the exercise.

Processing takes place in the United States. The basis is Anthropic's data processing addendum including standard contractual clauses, which forms part of its Commercial Terms of Service. Anthropic does not store the transmitted content permanently and does not use it to train models. One exception: if Anthropic's automated safety systems flag a conversation, or if there is a legal obligation, Anthropic may retain the affected content for up to two years.

Details on processing by OpenAI

We use OpenAI for two purposes.

First, for voice input. When you speak a message, we transmit the audio recording to OpenAI and receive the spoken text in return. The only additional information sent is the language you have selected, so that the recording is recognised correctly; we do not transmit any other details from your profile. We do not store the recording itself.

Second, for a second chat coach in the app that exists alongside the coaching provided by Anthropic. For that chat we transmit the content of your messages, your first name and an extract of the information stored about you in the app: your sports, upcoming and completed exercises and the date of your last training, your streak, your next competition and your most recent competition results, your recent mind checks including moods, needs and self-assessments, your satisfaction with recent sessions, your preferred exercises and extracts from your own messages in earlier conversations. Unlike the coaching provided by Anthropic, your first name is transmitted here.

In both cases processing takes place in the United States, see the section on international data transfers for details.

Details on processing by ElevenLabs

ElevenLabs voices the texts of our audio exercises. Only the finished text of the exercise is transmitted, without an identifier and without any other details from your profile. For personal audio exercises this text contains your first name and content derived from your information (see Anthropic). Exercises that are the same for all athletes contain no information about you. Processing takes place in the United States, see the section on international data transfers for details.

Details on processing by Sentry

If an error occurs in the app or it crashes, the app sends an error report to Sentry (Functional Software, Inc.). It contains the error message, the place in the code where the error occurred, the app version, device type and operating system, as well as your user ID from our database so that we can recognise related errors. We do not send your name or your email address; email addresses and access keys in error messages are made unrecognisable before sending. Sentry also counts how many app sessions end without a crash. Reports are processed on servers in the EU.

Details on processing by Meta

The app contains Meta's software development kit. We use it to report individual events to Meta, such as a completed onboarding or a completed purchase, in each case together with information about your device and a pseudonymous identifier assigned by Meta. This is how we measure whether our advertising reaches the athletes it is meant for. Your device's advertising ID is only transmitted if you have consented to tracking on your device; you can withdraw that consent at any time in your system settings.

In addition, RevenueCat reports purchase and trial events to Meta so that they can be attributed to the right ad contact. For this we store your email address and the pseudonymous Meta identifier mentioned above with RevenueCat.

All third-party providers comply with applicable data protection laws (e.g. GDPR, CCPA).

International Data Transfers

Some of the service providers we use process data in the United States, in particular Anthropic for the AI-powered coaching, OpenAI for the second chat coach and for turning speech into text, ElevenLabs for voicing spoken exercises, OneSignal for push notifications and emails, RevenueCat for subscription management, Meta for measuring our advertising and Vercel for operating the website and our API. In these cases, personal data may be transferred to a third country for which an adequacy decision of the European Commission does not always exist. Such transfers are based on the European Commission's Standard Contractual Clauses pursuant to Art. 46(2)(c) GDPR, unless an adequacy decision (such as the EU-US Data Privacy Framework) applies. For Anthropic, the basis is the data processing addendum including standard contractual clauses, which forms part of its Commercial Terms of Service. Where necessary, we obtain your explicit consent pursuant to Art. 49(1)(a) GDPR.

5. Data retention

  • Account and profile data: until you delete your account.
  • Chat histories and coaching results: until you delete the respective conversation or your account. The coach draws on earlier results so that it can support you better over time.
  • You can delete individual conversations in the app at any time. The messages of that conversation are removed completely.
  • Results you have worked out, such as strengths, guiding sentences and routines, are not affected by this so that the coach can keep using them. They are deleted when you delete your account.
  • Voice recordings: processed only to turn them into text and not stored.
  • Analytics data: maximum of 12 months.

You can request deletion of your data at any time by contacting us.

6. Your data protection rights

  • Access to your stored data
  • Correction of incorrect data
  • Deletion of your data ("right to be forgotten")
  • Data portability (e.g. export of your training history)
  • Restriction of processing
  • Objection to processing (see below)
  • Lodging a complaint with a data protection supervisory authority, for example in the country where you live

Right to object: Where we process your data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you can object at any time on grounds relating to your particular situation. You can object to processing for advertising, including emails with offers for Sync Pro, at any time without giving reasons. We will then no longer use your data for that purpose (Art. 21 GDPR).

To exercise your rights, send a request to support@syncmental.com.

7. Data security

We protect your data through:

  • Encrypted storage (e.g. passwords via bcrypt)
  • Secure servers (Supabase, Vercel)
  • Access restrictions

Despite all measures, 100% security cannot be guaranteed.

8. Processing of Data of Minors

Sync is intended for users aged 14 and above. For users between 14 and 15 years of age, the processing of personal data is only permitted with the consent of their parents or legal guardians in accordance with Article 8 GDPR.

During onboarding, users are required to expressly confirm that such consent has been obtained. Sync reserves the right to request proof of this consent and to block access in case of doubt.

Parents and legal guardians may withdraw their consent at any time and request deletion of their child's data by contacting support@syncmental.com.

9. Changes to this Privacy Policy

If we make changes to our privacy policy, we will notify you in the app or by email.

Last updated: 15 October 2026

10. Contact

If you have any questions, you can reach us at:

support@syncmental.com