Privacy Policy
How SyncWide Solutions collects, uses, and protects your personal data.
Last updated: 2026-09-27
1. Data controller
The data controller responsible for processing your personal data is:
SyncWide Solutions
Email:
2. Data we collect
Account data
When you register for a SyncWide account, we collect:
- First name and last name (required)
- Email address (required)
- Username (optional)
- Profile picture (optional)
- Phone number (optional)
- Address details: street, house number, postal code, city, state/region, country (optional)
Authentication data
To secure your account, we store:
- A hashed and salted password (Argon2id — the original password is never stored)
- Passkey credential data (public key credentials only, no private keys)
- Hashed one-time code records (codes themselves are never stored)
- Session tokens (stored as SHA-256 hashes)
Usage and log data
When you use our services, we may collect:
- IP address (for security, rate limiting, and session records)
- Browser and device information (user agent string)
- Timestamps of login, logout, and account changes
- Security audit events (login attempts, password changes, etc.)
Support ticket data
When you open a support ticket, we process the content of your messages and any files you attach. This data is used solely to handle your support request.
3. Purposes and legal basis
| Purpose | Legal basis (GDPR) |
|---|---|
| Providing account services (login, authentication, account management) | Art. 6(1)(b) — Performance of a contract |
| Email verification and security notifications | Art. 6(1)(b) — Performance of a contract |
| Handling support tickets | Art. 6(1)(b) — Performance of a contract |
| Security logging and fraud prevention | Art. 6(1)(f) — Legitimate interest |
| OAuth2 single sign-on to third-party services | Art. 6(1)(a) — Consent (explicit per service) |
| Legal obligations (e.g. tax records where applicable) | Art. 6(1)(c) — Legal obligation |
4. Data retention
- Account data is retained for as long as your account is active. Upon deletion, personal data is removed or anonymised within a reasonable period, subject to legal retention requirements.
- Session records expire automatically and are deleted after 30 days or on logout.
- Security audit logs are retained for up to 12 months.
- Support ticket records are retained as long as needed to resolve the matter and for reasonable follow-up periods.
- Password reset and verification tokens expire within 1 hour and 24 hours respectively and are deleted after use.
5. Your rights
Under applicable data protection law, you have the following rights:
-
Right of access (Art. 15 GDPR)
You can request confirmation of whether we process your personal data and, if so, a copy of that data.
-
Right to rectification (Art. 16 GDPR)
You can request that inaccurate or incomplete personal data be corrected. You can update most profile data directly from your account dashboard.
-
Right to erasure (Art. 17 GDPR)
You can request deletion of your personal data where it is no longer necessary for the purposes it was collected, or where you withdraw consent.
-
Right to restriction (Art. 18 GDPR)
You can request restriction of processing in certain circumstances.
-
Right to data portability (Art. 20 GDPR)
You can request your data in a structured, machine-readable format.
-
Right to object (Art. 21 GDPR)
You can object to processing based on legitimate interest.
-
Right to withdraw consent
Where processing is based on consent (e.g. OAuth2 authorisation), you can withdraw it at any time from your account settings.
-
Right to lodge a complaint
You have the right to lodge a complaint with a supervisory authority, in particular in the member state of your habitual residence.
To exercise any of these rights, contact us at the address in the privacy contact section below.
7. Third parties and OAuth2
SyncWide operates an OAuth2 identity provider that allows you to sign in to third-party services using your SyncWide account. When you authorise a third-party application:
- You will be shown a consent screen listing the specific data the service is requesting
- Only the data you explicitly approve will be shared
- You can revoke access to any connected application at any time from your account dashboard
- We do not sell or otherwise disclose your data to third parties for marketing purposes
Currently integrated services include: swscdn.com, tiltchat.com, and waveno.de — all operated by SyncWide Solutions.
8. Security
We implement technical and organisational measures to protect your personal data, including:
- Passwords hashed with Argon2id — never stored in readable form
- HTTPS for all data transmission
- Secure, HttpOnly session cookies
- CSRF protection on all forms
- Rate limiting on authentication endpoints
- Security audit logging for account changes
- Private file storage outside the web root
9. Contact for privacy matters
For any questions about this privacy policy or to exercise your rights, please contact:
SyncWide Solutions
Email: