Synheart ("we," "our," "us") builds technologies that help people understand their emotional, cognitive, and physiological state using biosignals, behavioral patterns, and AI-powered interpretation. This Privacy Policy explains how we collect, use, store, and protect personal information across the Synheart ecosystem, including Synheart Wear, Synheart Core SDK, Syni, Syni Life, Synheart Dashboard, and all related services ("Services").
By using Synheart products, you agree to this Privacy Policy.
Information We Collect
We collect three categories of data:
1.1Biosignal Data (Physiological Data)
When you use Synheart Wear, participate in Syni Life sessions, or enable integrations with supported wearables (e.g., WHOOP, Garmin), we may collect:
- Heart rate (HR)
- Heart rate variability (HRV)
- Respiratory rate
- Sleep stages & duration
- Movement & accelerometer data
- Skin temp (if supported by device)
- Stress markers
- Focus-related metrics
1.2Behavioral Signals (Device Interaction Data)
If you enable the Synheart Behavioral SDK, we may collect:
- Keystroke cadence (timing, not content)
- Scroll velocity and interaction patterns
- App interaction bursts and idle gaps
- Focus patterns and task switching frequency
- Motion and device orientation
We never collect message content, keystroke content, or personal text. Only timing-based signals.
1.3App, Account & System Data
- Name, email, phone (if provided)
- Device information (OS, version, model)
- IP address (for security)
- Crash logs and analytics
- Subscription or billing info (if applicable)
- Usage analytics in the Life app (optional, off by default)
If you turn on usage analytics in the Life app (Settings → Privacy & Consent → App Improvement, or during onboarding), we use Google Analytics for Firebase to learn which screens you open and how often you use the app. This includes screen views, session information, an app-instance identifier, device and app version, and approximate location (country or city) derived from your IP address. It never includes your typing, health data, or human-state readings.
How We Use Your Data
We use data to deliver and improve Synheart features:
2.1To Generate Cognitive & Emotional Insights
- Focus estimation
- Emotion & stress modeling
- Flow state detection
- HRV-based cognitive readiness
2.2To Operate Our Platform
- Account creation & authentication
- Cloud synchronization (if consented)
- Developer integrations
- Wearable device linking
2.3To Improve Our Models (Only With Consent)
- Model training and enhancement
- Anonymous benchmarking
- Quality improvement
2.4To Communicate With You
- Product updates
- Support requests
- Security notifications
We do not sell personal data.
We do not use data for advertising.
Where Data Is Processed
Depending on the Service:
- On-device: Core behavioral signals, some biosignal processing, HSI fusion.
- Cloud (with consent): Synheart Cloud, Syni, and model inference by third-party AI providers (see Section 5.4).
- Regions: AWS (US/EU/Canada regions depending on your country).
Raw Data Policy
Raw data never leaves the device unless you opt in.
Raw data includes:
- High-resolution HRV windows
- PPG/accelerometer streams
- Behavioral sequences
- Keyboard timing samples
If you grant permission:
- Data is encrypted before leaving your device.
- Only necessary segments are transmitted for the selected feature.
- You can disable cloud upload at any time.
Data Retention
We retain data only as long as necessary:
- Account data: while account is active
- Biosignals: configurable in app
- Behavioral data: typically 30–90 days (for rolling window models)
- Logs & telemetry: 30 days
- Usage analytics (Life app, if turned on): event-level data is kept for 2 months and user-level data for 12 months, then deleted automatically by Google Analytics.
- Backups: encrypted, limited access
You can request complete deletion at any time (see Section 9).
Your Rights
Depending on your region (GDPR, CCPA, PIPEDA), you have the right to:
- Access your data
- Correct your data
- Delete your data
- Export your data (portable export)
- Withdraw consent
- Restrict processing
- Object to profiling
- Submit a complaint
We will respond within the legally required time frame.
Security Measures
We use strong security methods including:
- End-to-end encryption for sensitive data
- On-device processing wherever possible
- Strict access controls
- Secure key management
- Encrypted backups
- Regular penetration testing
Despite best efforts, no system is 100% secure.
Your Choices & Controls
You can control:
- Whether raw data leaves your device
- Whether behavioral signals are collected
- Whether cloud inference is used
- Whether wearable data syncs
- Whether usage analytics is enabled (Life app: Settings → Privacy & Consent → App Improvement)
You may also delete your account at any time, which removes all personal data from our systems.
Turning usage analytics off stops collection immediately and resets the analytics identifier on your device. We do not collect the advertising identifier (IDFA/AAID), and analytics data is not used for advertising.
Children's Privacy
Synheart is not intended for children under 16.
We do not knowingly collect data from children.
Google User Data in Synapse
Synapse (synapse.synheart.ai) can connect to a member's own Google account. This section describes exactly what it reads and why.
11.1What We Access
Only what each feature needs:
- Account email and Google account ID (openid, email): to verify which Google account is yours, so activity and meetings can be attributed to you.
- Google Calendar (calendar.readonly), only if you connect your calendar: the start and end times of your own events, used to compute your meeting load. We never read event titles, descriptions, attendees or locations.
- Google Drive (drive.readonly), only if you link your Drive and only for shared drives your organization's administrator has added to Synapse: the names, links and text of Google Docs, Google Slides, plain-text and Markdown files. We never index My Drive, and we never modify, create, share or delete anything in your Google account.
11.2How We Use It
Drive text is split into passages and indexed so that you can search it in Synapse and through AI tools you connect to Synapse. A file is returned only to members of your organization who can open it in Google Drive and have linked their own Drive. Calendar times feed your own meeting-load metrics.
11.3How We Store, Share and Delete It
How your Google data is kept:
- OAuth tokens are stored encrypted. Indexed text is stored in our database, separate for each organization.
- To index text for search, passages are sent to our embedding provider (DeepInfra), which processes them solely to return search vectors.
- Unlinking Google Drive removes your access to every Drive file immediately. When your administrator removes a shared drive, its indexed text is deleted. A file you can no longer open is removed at the next sync. Erasing your account deletes your Google tokens.
11.4Limited Use
Synapse's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements. We do not use Google user data to serve advertisements, we do not sell it, we do not use it to train generalized AI or machine-learning models, and people at Synheart do not read it except with your permission, for security purposes, to comply with law, or where it has been aggregated and anonymized for operations.
Changes to This Policy
We may update this Privacy Policy to reflect improvements, legal changes, or new features.
If changes are significant, we will notify users.