Privacy policy
This policy explains what Synthay (synthay.com and the exam practice app at synthay.com/exam/) stores about you, why, and what you can do about it. We collect as little as the service needs, and we do not track you.
Who is responsible
AppCraft, Dokter Bolkesteinstraat 130, 2132 JV Hoofddorp, the Netherlands. Chamber of Commerce (KvK) number 34267628, VAT number NL002170032B56.
We are the controller of your personal data under the General Data Protection Regulation (GDPR). For anything in this policy, email sander@synthay.com.
What we store and why
Your study progress
The first time you open the app, we create an anonymous account for your browser. It holds your progress: answers and attempts, bookmarks, flashcard reviews, questions you write yourself, an exam in progress, your difficulty filter and your music settings. This needs no name or email address.
We store this to provide the service you asked for (GDPR art. 6(1)(b), performance of a contract).
Your email address, if you sign in
Signing in is optional. If you request a sign-in link, we use your email address only to send that link and to recognise your account next time. We do not send newsletters or marketing.
Your address is stored encrypted (AES-256-GCM). To look it up we keep a keyed hash, not the address itself. Sign-in links are single-use and expire after 15 minutes.
When you sign in from a browser that already has anonymous progress, that progress is merged into your account and the anonymous account is deleted.
When you last used the service
We record when your account was created and when it was last used, to run the service and to clean up accounts nobody uses any more.
IP addresses
Our server necessarily sees your IP address to answer each request. The application does not store it.
Cookies and local storage
We set one cookie, sid. It keeps you signed in to your (anonymous or email) account for up to one year. It is strictly necessary for the service, so we do not ask for consent for it. We store only a hash of its value on the server.
We use no analytics, advertising or tracking cookies, and load no third-party scripts, fonts or trackers.
The app also uses your browser's local storage for things that never leave your device, such as interface preferences.
Your own Anthropic API key
Some features let you use your own Anthropic API key. That key stays in your browser, encrypted with a passphrase you choose, and is never sent to us. Requests made with it go directly from your browser to Anthropic (api.anthropic.com). Anthropic's own privacy policy and terms apply to that traffic.
Who processes data for us
| Processor | What for | Where |
|---|---|---|
| netcup GmbH | Hosting of the website, app and database | Nuremberg, Germany |
| Resend (Plus Five Five, Inc.) | Sending sign-in emails | United States |
Both act on our instructions under a data processing agreement (GDPR art. 28). Our agreement with netcup was concluded on 15 October 2026. Resend's is part of its terms of service. A copy of either is available on request. Resend receives your email address and the sign-in link only when you request one. Resend is certified under the EU–US Data Privacy Framework, and its agreement also includes the European Commission's standard contractual clauses for the transfer to the United States.
We do not sell your data or share it with anyone else, unless the law requires us to.
How long we keep it
- Sign-in links: until used, or 15 minutes.
- Sessions: up to one year, or until you sign out.
- Progress and account: until you delete them. Anonymous accounts that have not been used for 24 months may be deleted.
Your rights
You have the right to access, correct, delete and export your data, to restrict or object to its processing, and to withdraw any consent you gave.
- Delete: use Delete my data in the app. It removes your account, your progress and your sessions from our server immediately. This cannot be undone.
- Everything else: email sander@synthay.com. We answer within one month.
You may also complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens.
Security
All traffic is encrypted with HTTPS. Email addresses are encrypted at rest. Sign-in tokens and session identifiers are stored only as hashes, so a copy of the database cannot be used to sign in as you.
Changes
If we change this policy, we update the date below. Material changes are announced on the site.
Last updated: 15 October 2026.