Privacy Policy
Last updated: 16 September 2026
1. Data Controller
The controller responsible for the processing of personal data within the meaning of the GDPR is:
Sync UG (haftungsbeschränkt)
represented by its Managing Director Moritz Konsemüller
Langer Weg 106, 26629 Großefehn, Germany
Phone: +49 15679 401584
Email: support@syncmental.com
2. What data we collect
2.1. Registration data
- Name
- Email address
- Password (stored encrypted)
- Sport and performance level (if provided)
2.2. Usage data
- Training exercises used
- Progress and completed sessions
- Interactions with the AI coach
2.3. Data from the AI coach
When you use the AI coach, we process the content of your messages as well as the results the two of you work out together. This includes a running summary of the conversation and individual points you have recorded, such as a strength, a guiding sentence or a step of a routine, each in your own words. These results remain stored so that the coach can build on them in later conversations instead of starting over every time.
The app contains two chat coaches operated by different providers. Section 4 sets out which provider receives which data.
If you use voice input, we also process the audio recording of your input in order to turn it into text. For this purpose the recording is transmitted to our speech recognition provider (see section 4). Only the resulting text is stored, not the recording.
2.4. Technical data
- Device type (e.g. iPhone, Android)
- IP address
- Operating system
- Error reports from the app (e.g. error message, app version and where the error occurred)
2.5. Payment data
Payment information is processed via Stripe / Apple In-App Purchases. We do not store credit card data.
2.6. Apple Health (optional)
If you allow it in the app settings, Sync reads only your completed workouts from Apple Health in order to remind you of your mental training shortly afterwards. That reminder is created on your device. Your health data never leaves your device, we do not store it and we do not share it with third parties. Sync never writes data to Apple Health. You can withdraw the permission at any time in the app settings or in Apple Health.
2.7. Sport profile on our website
When you take the sport profile on our website, your answers are stored only locally in your browser so you can pause and continue. They are deleted after 48 hours, never reach our servers and carry no identifier. The result is calculated in your browser. If you use the share function, the five scores are part of the link that you pass on yourself. For audience measurement we use Vercel Web Analytics, which works without cookies; it records how far visitors get in the test, not which result they receive.
3. How we use your data
- Providing and improving the Sync app
- Personalising content (e.g. recommended exercises)
- Analysing usage behaviour to optimise the app
- Customer service and support
- Security and fraud prevention
We do not sell or rent your data to third parties.
Legal Bases for Processing
We process your personal data on the following legal bases:
- To perform our user agreement and provide the app (Art. 6(1)(b) GDPR). This includes registration, personalisation of your training plan, and use of the app's features.
- On the basis of your consent (Art. 6(1)(a) GDPR), for example when processing optional information. For users between 14 and 15 years of age, processing is based on the consent of their parents or legal guardians (Art. 8 GDPR).
- To protect our legitimate interests (Art. 6(1)(f) GDPR), in particular to analyse and improve the app, ensure security, and prevent fraud.
- To comply with legal obligations (Art. 6(1)(c) GDPR), such as retention periods under tax and commercial law.
You may withdraw any consent given at any time with effect for the future.
4. Sharing data with third parties
We only share your data when necessary:
- Supabase (hosting, database and authentication)
- Anthropic PBC, San Francisco, USA (AI-powered coaching in the chat)
- OpenAI, USA (second chat coach in the app and turning your voice recordings into text)
- Vercel, USA (operating this website and our API, audience measurement without cookies)
- PostHog (product analytics, processed on servers in the EU)
- OneSignal, USA (push notifications)
- RevenueCat, USA (management of subscriptions and in-app purchases)
- Meta Platforms, USA (measurement and optimisation of our advertising)
- Capgo (delivery of app updates)
- Apple and Google (sign-in with Apple or Google and payment processing via the App Store and Play Store)
- Stripe (payment processing when purchasing through the browser)
Details on processing by Anthropic
For the AI-powered coaching we transmit the content of your messages and an extract of the information stored about you in the app:
- your sport, your age and age group, and your gender
- your subscription status, that is whether your account is free or paid, and for a paid account its term
- upcoming competitions and past competition results
- your self-assessments from the last 30 days and how they have developed
- information about your training: upcoming and completed exercises, the date of your last training, your preferred exercises, your streak and your satisfaction with recent sessions
- how long you have been registered and how many days have passed since your last login
- summaries of earlier and parallel conversations as well as the results worked out in coaching
We do not transmit your name to Anthropic. The text sent to the model contains a placeholder; we only insert your first name into the finished answer on our server, before it is sent to the app. If you mention your name yourself in a message, it is part of that message.
Processing takes place in the United States. The basis is Anthropic's data processing addendum including standard contractual clauses, which forms part of its Commercial Terms of Service. Anthropic does not store the transmitted content permanently and does not use it to train models. One exception: if Anthropic's automated safety systems flag a conversation, or if there is a legal obligation, Anthropic may retain the affected content for up to two years.
Details on processing by OpenAI
We use OpenAI for two purposes.
First, for voice input. When you speak a message, we transmit the audio recording to OpenAI and receive the spoken text in return. The only additional information sent is the language you have selected, so that the recording is recognised correctly; we do not transmit any other details from your profile. We do not store the recording itself.
Second, for a second chat coach in the app that exists alongside the coaching provided by Anthropic. For that chat we transmit the content of your messages, your first name and an extract of the information stored about you in the app: your sports, upcoming and completed exercises and the date of your last training, your streak, your next competition and your most recent competition results, your recent mind checks including moods, needs and self-assessments, your satisfaction with recent sessions, your preferred exercises and extracts from your own messages in earlier conversations. Unlike the coaching provided by Anthropic, your first name is transmitted here.
In both cases processing takes place in the United States, see the section on international data transfers for details.
Details on processing by Meta
The app contains Meta's software development kit. We use it to report individual events to Meta, such as a completed onboarding or a completed purchase, in each case together with information about your device and a pseudonymous identifier assigned by Meta. This is how we measure whether our advertising reaches the athletes it is meant for. Your device's advertising ID is only transmitted if you have consented to tracking on your device; you can withdraw that consent at any time in your system settings.
In addition, RevenueCat reports purchase and trial events to Meta so that they can be attributed to the right ad contact. For this we store your email address and the pseudonymous Meta identifier mentioned above with RevenueCat.
All third-party providers comply with applicable data protection laws (e.g. GDPR, CCPA).
International Data Transfers
Some of the service providers we use process data in the United States, in particular Anthropic for the AI-powered coaching, OpenAI for the second chat coach and for turning speech into text, OneSignal for push notifications, RevenueCat for subscription management, Meta for measuring our advertising and Vercel for operating the website and our API. In these cases, personal data may be transferred to a third country for which an adequacy decision of the European Commission does not always exist. Such transfers are based on the European Commission's Standard Contractual Clauses pursuant to Art. 46(2)(c) GDPR, unless an adequacy decision (such as the EU-US Data Privacy Framework) applies. For Anthropic, the basis is the data processing addendum including standard contractual clauses, which forms part of its Commercial Terms of Service. Where necessary, we obtain your explicit consent pursuant to Art. 49(1)(a) GDPR.
5. Data retention
- Account and profile data: until you delete your account.
- Chat histories and coaching results: until you delete the respective conversation or your account. The coach draws on earlier results so that it can support you better over time.
- You can delete individual conversations in the app at any time. The messages of that conversation are removed completely.
- Results you have worked out, such as strengths, guiding sentences and routines, are not affected by this so that the coach can keep using them. They are deleted when you delete your account.
- Voice recordings: processed only to turn them into text and not stored.
- Analytics data: maximum of 12 months.
You can request deletion of your data at any time by contacting us.
6. Your data protection rights
- Access to your stored data
- Correction of incorrect data
- Deletion of your data ("right to be forgotten")
- Data portability (e.g. export of your training history)
To exercise your rights, send a request to support@syncmental.com.
7. Data security
We protect your data through:
- Encrypted storage (e.g. passwords via bcrypt)
- Secure servers (Supabase, Vercel)
- Access restrictions
Despite all measures, 100% security cannot be guaranteed.
8. Processing of Data of Minors
Sync is intended for users aged 14 and above. For users between 14 and 15 years of age, the processing of personal data is only permitted with the consent of their parents or legal guardians in accordance with Article 8 GDPR.
During onboarding, users are required to expressly confirm that such consent has been obtained. Sync reserves the right to request proof of this consent and to block access in case of doubt.
Parents and legal guardians may withdraw their consent at any time and request deletion of their child's data by contacting support@syncmental.com.
9. Changes to this Privacy Policy
If we make changes to our privacy policy, we will notify you in the app or by email.
Last updated: 16 September 2026