Legal

Privacy Policy

Effective September 29, 2026

Who we are

Synapse is an open-source project that makes the Synapse app for Mac and this website. In this policy, "we" and "us" mean the Synapse project. The code is public at github.com/nyfeblade/synapse.

To reach us about privacy, use the feedback page. For bugs that aren't private, you can also open a GitHub issue.

What the app collects

Nothing, except what you choose to send us as feedback. There is no Synapse account, no Synapse server your Bots run on, no analytics and no crash reporting to us.

What stays on your Mac

• Your Bots, their memory, chats, schedules, settings and files live in ~/Library/Application Support/Synapse and in the Bots' computer, a sandboxed Linux machine that runs on your Mac through OrbStack.
• Your API key and other secrets are encrypted on your Mac.
• Logs stay in ~/Library/Logs/Synapse unless you attach them to feedback.
• Voice calls are transcribed and spoken on your Mac.
• 👍 and 👎 ratings stay on your Mac.

What leaves your Mac, and where it goes

• Your AI provider. Your Bots send your messages, and whatever they need to do the work (such as file contents, web pages or screenshots), straight to the AI provider you choose, using your own API key. Today that's Anthropic. That use is under your agreement with the provider and its privacy policy, not ours.
• Services you connect. If you connect Google, GitHub, Slack, Composio or another service, or add a tool server, your Bots send data to that service when they use it, under its terms.
• The web. When a Bot visits a website or downloads something, that site sees the request, as with any browser.
• Updates. The app checks GitHub Releases for new versions and downloads them from GitHub, so GitHub sees your IP address.
• Setup and downloads. Setting up the Bots' computer downloads software from public sources, such as Linux package mirrors, nodejs.org, npm and GitHub. Optional voice or speech models come from Hugging Face.
• Phone access. If you turn it on, it runs over your own Tailscale network, under Tailscale's terms.
• Replies to your feedback. After you send feedback from the app, it checks this website now and then for replies to it, using the thread's secret code.

What the website collects

• Server logs. The site is hosted on Vercel. Like any web host, Vercel receives your IP address, browser details and the page you asked for, and keeps short-lived logs for security and to keep the site running.
• Visit counts. We use Vercel Web Analytics to count page views. It sets no cookies and shows us only totals, such as pages, countries and browsers, never who you are. Pages that show a shared Bot, and the private feedback conversation page, load no analytics.
• Release info. Your browser asks GitHub's API for the latest version, the download link and the star count, so GitHub sees your IP address for that request.
• Fonts are served from this site. No font service sees your visit.
• Your browser's storage (localStorage) holds your theme choice; a feedback message you just sent, until its conversation page has loaded it or for 7 days; and a shared Bot you're adding, with whether Synapse opened for it, for up to 7 days. It never leaves your browser and isn't used for tracking.

The website sets no cookies of its own.

Feedback

You can send feedback from the app or from the feedback page. Only what you send is sent: its preview shows everything before it goes.

What's sent

• The type (bug, idea, something confusing, or love it) and your message.
• From the app, also: the app version, the macOS version and the Mac model.
• From the app, only if you choose: a screenshot of the Synapse window, and recent logs.

We never ask for your name or email address, and the website form has no field for them.

Personal details are hidden first

Before your message is stored, these are replaced with placeholders, in the app or browser and again on our server:

• API keys, access tokens and passwords in auth headers;
• email addresses;
• card numbers;
• US social security numbers;
• phone numbers;
• street addresses.

Attached logs are cleaned on your Mac of keys, tokens, auth headers, secret web-address parameters, email addresses, your saved secrets, and your macOS user name and home folder name. Hidden and invisible characters are removed from everything.

This is automatic and can miss things, such as a person's name. Please leave out anything you don't want us to have.

Where it's stored

Each message becomes an issue in a private GitHub repository that only the Synapse maintainers can see, so GitHub stores and processes it for us. Screenshots are stored in the same private repository. Our server doesn't keep your IP address with your feedback. To slow down abuse, it keeps a scrambled, shortened form of it in memory for about 10 minutes.

Replies

When you send feedback, you get a private conversation: in the app under Your feedback, or at a link the website gives you. The link holds a secret code after the #, which browsers don't send to servers. We store only a one-way hash of the code, so only you can open the conversation. Anyone you give the link to can read it too, so keep it private.

Posting in public

If you choose Post on GitHub in the app, or open a GitHub issue yourself, it's public and under your GitHub account and GitHub's terms.

Shared Bots

A shared Bot link carries the whole Bot after the # in the link. Browsers don't send that part to any server, so opening a Bot link doesn't send the Bot to us or to Vercel. The /bot and /bots pages load no analytics.

Third parties

These services handle data when you use Synapse or this site. Each has its own privacy policy:

Legal bases

Where the EU or UK GDPR applies, we rely on:

• Consent for feedback. You choose to send it, and you can ask us to delete it at any time.
• Legitimate interests for the website's server logs, to keep the site secure and working, and for its aggregated visit counts, to understand which pages help people.

Retention

• Feedback is kept until it's no longer needed to improve Synapse or answer you, then deleted. You can ask us to delete yours sooner at any time: see Your rights.
• Server logs are kept by Vercel for a short time under its own policy.
• Visit counts are aggregated and hold nothing that identifies you.
• Data on your Mac is yours: delete it any time, as the docs explain.

Your rights

Depending on where you live, including under the EU and UK GDPR and California's CCPA/CPRA, you can ask us to:

• tell you what we hold about you and give you a copy;
• delete it;
• correct it;
• stop or limit using it, or object to how we use it.

We don't sell or share personal information, and we don't use it for targeted advertising. We won't treat you differently for using these rights.

How to ask: send a message through the feedback page and include your conversation link, or reply in the conversation itself (in the app under Your feedback, or at your link). The link is how we know the feedback is yours, since we don't know your name or email. You can also complain to your local data protection authority.

International transfers

Vercel, GitHub and Anthropic are based in the United States, so your data may be processed there and in other countries where they operate. They use safeguards such as the European Commission's Standard Contractual Clauses and, where they take part, the EU-U.S. Data Privacy Framework.

Security

The website is served over HTTPS with strict security headers. Feedback is stored in a private repository, reached with a key that only has access to it, and every message is checked and cleaned before it's stored. In the app, secrets are encrypted on your Mac, and your Bots work in a sandbox. No system is perfect: to report a security issue, see SECURITY.md.

Children

Synapse and this website aren't directed at children under 13, or under 16 in the EU and UK. We don't knowingly collect their personal information. If you think a child has sent us some, tell us through the feedback page and we'll delete it.

Do Not Track

We don't track you across sites, so "Do Not Track" and Global Privacy Control signals don't change anything here. You're treated the same either way.

Changes to this policy

If we change this policy, we'll update it here with a new effective date. The history of every change is public on GitHub. If a change matters, we'll say so in the changelog.

Contact

Questions or requests about privacy: use the feedback page. For bugs that aren't private: GitHub issues. See also the Terms of Use.