Synqin Privacy Notice
Version 2026-09-24-r2
1. Who operates Synqin?
Synqin is a file transfer, storage and sharing service operated by İbrahim Kasapoğlu, based in İstanbul, Türkiye. He is the data controller for the account, security and service-management activities described here.
- Privacy and rights requests: privacy@synqin.com
- General and subscription enquiries: hello@synqin.com
- Security and abuse reports: security@synqin.com
This notice covers our apps, web services, account-free recipients and support. Reading it or accepting our Terms does not give consent to optional processing. Where a business determines how personal data is used and we process it on its instructions, its privacy notice and the applicable data processing agreement also apply.
2. Sources and categories of data
We receive data from you, your devices and connections, your sign-in and purchase providers, people who share with you, and people submitting support or abuse reports.
| Category | Examples |
|---|---|
| Account | Name, email, username, optional profile image and sign-in identifiers |
| Device and connection | IP address, device and operating-system information, session identifiers and activity times |
| Content and sharing | Encrypted files, content identifiers, sizes, expiry times, recipients and access permissions |
| Security and recovery | Encryption and recovery information, authorised devices and access records |
| Purchases | Purchase and subscription identifiers, plan, payment/renewal status and entitlements |
| Notifications and support | Notification identifiers, preferences, correspondence and reports |
| Usage and diagnostics | Feature interactions, crash/error reports and pseudonymous user or installation identifiers |
| Legal records | Terms/notice versions, timestamps, request and decision records |
Required account and transaction data enable the relevant functions. You choose optional profile details and content you share. Payment providers process card details entered into their interfaces.
3. What encryption protects
Files are encrypted on your device. In the normal service flow, our servers do not receive the keys needed to read them. Recovery depends on your authorised devices and recovery tools.
Account details, IP addresses, sharing permissions, timestamps, sizes, subscription records and support messages are not all protected by this content encryption. Pseudonymous data is not necessarily anonymous.
Recipients can retain their own copies. We cannot erase files they have independently downloaded. Keep access links and recovery tools private; do not send us private keys or recovery codes.
4. Purposes and legal grounds
| Purpose | Where GDPR applies | Where Turkish Law No. 6698 applies |
|---|---|---|
| Account, requested transfer/storage and subscription | Contract necessity, Article 6(1)(b) | Contract necessity, Article 5(2)(c) |
| Security, abuse and fraud prevention | Necessary and balanced legitimate interests, Article 6(1)(f); a specific legal obligation where applicable, Article 6(1)(c) | Balanced legitimate interests, Article 5(2)(f); a specific statutory/legal obligation where applicable, Article 5(2)(a)/(ç) |
| Support and service communications | Article 6(1)(b) where necessary for the user’s contract; documented legitimate interests for other requests | Article 5(2)(c) for the relevant contract; Article 5(2)(f) for other requests |
| Rights requests, statutory records and competent-authority requests | Applicable legal obligation, Article 6(1)(c) | Applicable statutory/legal obligation, Article 5(2)(a)/(ç) |
| Disputes and protection of rights | Legitimate interests to the extent necessary; an additional applicable condition for sensitive data | Establishment, exercise or protection of a right, Article 5(2)(e); an additional Article 6 condition for sensitive data |
| Optional usage analytics | Prior consent where required, together with applicable ePrivacy requirements | Separate explicit consent where required |
Our security interests are protecting accounts, users and service continuity. This does not automatically justify unnecessary tracking. Contract necessity does not automatically apply to employees or representatives who are not parties to the contract. Processing other people’s or sensitive data requires the relevant additional conditions.
5. Recipients and providers
We share data with your selected recipients and authorised workspace participants, and with providers for the functions below:
- Cloudflare: infrastructure, network and storage services.
- AWS: hosting, databases and service email.
- Google/Firebase: sign-in, notifications, app security, supporting data services and mobile analytics/diagnostics.
- RevenueCat: subscription and purchase-status management.
- Apple and Google: the sign-in or purchase services you choose; they may act as independent controllers for their own activities.
We may disclose necessary information to competent authorities and legal or financial advisers to meet specific obligations or protect rights. Provider changes remain subject to applicable data-protection, transfer and contractual notice requirements.
We do not sell personal data, use it for targeted advertising, send marketing emails or use user content to train AI models. Account, security and subscription messages are service communications.
6. Processing locations and international transfers
Synqin is operated from Türkiye and uses international service providers. Encrypted files are currently stored in the European Union. This does not mean all account, support and usage data, or all access to that data, stays in the EU.
International transfers are subject to the applicable data-protection requirements. Information about transfer safeguards and how to obtain copies can be requested at privacy@synqin.com.
7. Retention and deletion
File retention depends on your plan, selected transfer expiry and the recovery periods disclosed for the service. Free storage is not indefinite. Content deletion, account closure and subscription cancellation are separate actions; deletion cannot retrieve recipients’ independent copies.
Account closure initiates content cleanup. Some account, subscription and legal records can remain afterwards. A specific legal obligation or dispute may require preservation of relevant records; this does not justify retaining unrelated information indefinitely. Contact us to request erasure or an explanation of retention affecting your account.
| Record | Retention |
|---|---|
| IP address and user-agent associated with acceptance | 365 days from acceptance, or earlier following completed account-content erasure; the core acceptance record is separate |
| Unverified or dismissed abuse reports | 30 days from receipt for unverified reports, or from the decision for dismissed reports, unless legally preserved |
| Reports closed following action | 90 days from the decision, unless legally preserved |
| Reports under review or legal preservation | While necessary for the specific review or preservation requirement |
| Analytics events covered by the retention setting | 2 months |
| Analytics user records covered by the retention setting | 14 months; new activity restarts the user-identifier period |
Expiry starts the applicable deletion process rather than guaranteeing every copy disappears at that instant. Analytics settings do not cover all aggregate reports or separately exported records. Providers may have additional deletion processing and backup cycles; Firebase’s published retention information describes its product-specific periods.
8. Cookies, SDKs and choices
Our web service uses cookies and local storage for sign-in and session security. Sign-in preparation cookies expire within 15 minutes; session cookies have a maximum life of 30 days and may end earlier. Browser settings allow you to manage cookies, but blocking necessary storage can prevent sign-in.
Mobile Google Analytics helps us understand feature use; Firebase Crashlytics helps diagnose failures. These records may be associated with pseudonymous identifiers. They are not used for targeted advertising. Browser cookie settings do not control mobile analytics or crash reporting.
The privacy contact handles applicable objections, restrictions and other rights requests. This notice and the service Terms do not replace any separate consent required for processing.
9. Your rights
Under Turkish Law No. 6698, you may learn whether and how data is processed, its purpose and proper use, and domestic/foreign recipients; request correction and qualifying erasure/destruction; request notification of correction/destruction to recipients; object to adverse results arising solely from automated analysis; and claim compensation for unlawful processing. Requests are handled promptly and within 30 days, subject to statutory fee exceptions.
Submit Turkish-law requests from your registered email to privacy@synqin.com, or through another legally recognised method. Contact us for a suitable postal correspondence address; the residential street address is not published here. Include the legally required information; identity verification should not request unnecessary documents. A request to the controller must precede a complaint to the Turkish Board. The applicable complaint limits are 30 days after learning the response and, in all cases, 60 days after the initial request.
Under GDPR, rights also include access/copies, correction, erasure, restriction, qualifying portability, objection to legitimate-interest processing and prospective withdrawal of consent. You may object to direct marketing. We normally respond within one month; a necessary extension of up to two further months must be explained within the first month. You may complain to a competent data protection authority without first contacting us.
We may be unable to decrypt content for you, but this does not remove your rights regarding accessible account/transaction data. Other people’s rights and valid retention obligations also apply.
10. Automated decisions, children and changes
Automated security controls may restrict access.
Synqin is intended for people aged 16 and over and is not offered to children under 16. If you have not reached the age of majority in your country, use requires the permission and supervision of a parent or legal representative where required by local law. Report a suspected account belonging to a child under 16 to privacy@synqin.com. Store content ratings do not change this minimum age.
We notify material changes appropriately and identify the current version/date. Changing this notice alone does not authorise a new processing activity requiring separate consent.
The English source text and its Turkish and other translations maintain equivalent scope. Translations support access to information; language priority does not restrict your right to understandable information about your data or mandatory local-law protections.