Legal

Privacy Policy

Last updated: 12 May 2026

1. Data Controller

The controller responsible for the processing of personal data within the meaning of the GDPR is:

Sync UG (haftungsbeschränkt)
represented by its Managing Director Moritz Konsemüller
Langer Weg 106, 26629 Großefehn, Germany
Phone: +49 15679 401584
Email: support@syncmental.com

2. What data we collect

2.1. Registration data

  • Name
  • Email address
  • Password (stored encrypted)
  • Sport and performance level (if provided)

2.2. Usage data

  • Training exercises used
  • Progress and completed sessions
  • Interactions with the AI chatbot

2.3. Technical data

  • Device type (e.g. iPhone, Android)
  • IP address
  • Operating system

2.4. Payment data

Payment information is processed via Stripe / Apple In-App Purchases. We do not store credit card data.

3. How we use your data

  • Providing and improving the Sync app
  • Personalising content (e.g. recommended exercises)
  • Analysing usage behaviour to optimise the app
  • Customer service and support
  • Security and fraud prevention

We do not sell or rent your data to third parties.

Legal Bases for Processing

We process your personal data on the following legal bases:

  • To perform our user agreement and provide the app (Art. 6(1)(b) GDPR). This includes registration, personalisation of your training plan, and use of the app's features.
  • On the basis of your consent (Art. 6(1)(a) GDPR), for example when processing optional information. For users between 14 and 15 years of age, processing is based on the consent of their parents or legal guardians (Art. 8 GDPR).
  • To protect our legitimate interests (Art. 6(1)(f) GDPR), in particular to analyse and improve the app, ensure security, and prevent fraud.
  • To comply with legal obligations (Art. 6(1)(c) GDPR), such as retention periods under tax and commercial law.

You may withdraw any consent given at any time with effect for the future.

4. Sharing data with third parties

We only share your data when necessary:

  • Supabase (hosting and authentication)
  • OpenAI API (AI-powered chat feature, without storing sensitive data)
  • Payment processors such as Stripe or Apple for in-app purchases

All third-party providers comply with applicable data protection laws (e.g. GDPR, CCPA).

International Data Transfers

Some of the service providers we use process data in the United States, in particular the OpenAI API for the AI-powered chat feature. In these cases, personal data may be transferred to a third country for which an adequacy decision of the European Commission does not always exist. Such transfers are based on the European Commission's Standard Contractual Clauses pursuant to Art. 46(2)(c) GDPR, unless an adequacy decision (such as the EU-US Data Privacy Framework) applies. Where necessary, we obtain your explicit consent pursuant to Art. 49(1)(a) GDPR.

5. Data retention

  • Account and profile data: Until you delete your account.
  • Chat histories: Anonymised after 90 days.
  • Analytics data: Maximum 12 months.

You can request deletion of your data at any time by contacting us.

6. Your data protection rights

  • Access to your stored data
  • Correction of incorrect data
  • Deletion of your data ("right to be forgotten")
  • Data portability (e.g. export of your training history)

To exercise your rights, send a request to support@syncmental.com.

7. Data security

We protect your data through:

  • Encrypted storage (e.g. passwords via bcrypt)
  • Secure servers (Supabase, Vercel)
  • Access restrictions

Despite all measures, 100% security cannot be guaranteed.

8. Processing of Data of Minors

Sync is intended for users aged 14 and above. For users between 14 and 15 years of age, the processing of personal data is only permitted with the consent of their parents or legal guardians in accordance with Article 8 GDPR.

During onboarding, users are required to expressly confirm that such consent has been obtained. Sync reserves the right to request proof of this consent and to block access in case of doubt.

Parents and legal guardians may withdraw their consent at any time and request deletion of their child's data by contacting support@syncmental.com.

9. Changes to this Privacy Policy

If we make changes to our privacy policy, we will notify you in the app or by email.

Last updated: 12 May 2026

10. Contact

If you have any questions, you can reach us at:

support@syncmental.com