Privacy policy

Who is responsible for your data

The data controller (responsable del tratamiento) is the person who operates Synapse, identified below. We apply Colombian data protection law (Law 1581 of 2012 and its regulations) and, where they apply to you, the data protection laws of your country.

Your account data

When you register, we store your email, a cryptographic representation of your password, creation date, adult confirmation and terms acceptance. We do not ask for a date of birth or identity document. We retain your language. We use this data to authenticate you, protect the account and give you access to your routes. Accepting registration does not authorize campaigns. Accounts created before September 25, 2026 also hold whether they asked for the subscription-opening notice and its date: that notice was retired when payments opened, will not be sent, and we will delete that data. Synapse is only for people 18 or older: if we learn that an account belongs to a minor, we close it and delete its data.

Session and account communications

Authentication uses a Better Auth session cookie. Sessions have a configured seven-day lifetime and may be refreshed during use. Session identifiers, expiry and, when available, IP address and browser information are stored for security. Signing out revokes that session. Resend sends your account emails (verification, password recovery and, if you turn them on, study reminders) and receives the recipient and the necessary content. We do not share passwords with Resend.

What we store about your learning

We store in your account what your learning needs: your routes and their progress, your goal, the text extracted from the materials you upload (we do not keep the original files), your attempts and their evaluation, the results of your closing challenges, and the questions you ask Gaby with their answers. For English we also store the transcripts of your conversations, your vocabulary and the evidence of your level. We do not store the audio of your voice.

We also keep usage counters per account (AI actions, questions to Gaby, voice seconds and pronunciation clips) to apply your plan's usage limits. We use this data only to provide the service and keep it secure.

Providers that process your data

To provide the service we use these providers. Each one receives only what its job needs.

OpenRouter routes our calls to text models. It receives your goal, the text of your materials, your answers, your questions to Gaby and your typed conversation turns. Through OpenRouter we use DeepSeek V4.1 Flash to create lessons, give you feedback and answer your questions, and Google Gemini Flash to transcribe photos of your notes. We configure it to use only providers that, according to OpenRouter, do not collect your data (data_collection: deny).

Jev, by TypeSafe, also through OpenRouter, receives short excerpts of what you write to check that they are safe and on topic, and to decide the next step of your route. We use it with zero data retention: the provider does not keep what it receives.

Google, through the Gemini Live API, processes your spoken English conversations. The audio goes straight from your browser to Google, without passing through our servers, under the paid-tier terms, under which Google does not use those conversations to train its models. We keep the transcript, not the audio.

Microsoft, through Azure AI Speech, receives the clips you record when you read aloud in pronunciation exercises. The audio goes straight from your browser to Microsoft to score your pronunciation, and Synapse does not store it.

Cloudflare hosts the site and its database (D1), and runs the Turnstile security check when you sign up, sign in or recover your password, to stop automated use.

Resend sends your account emails.

Paddle processes payments as Merchant of Record when you buy a plan. Paddle collects your billing details under its own privacy notice, and we receive only what we need to manage your subscription, such as your email, your country and the subscription status; we never receive your full card details.

• Paddle Privacy Notice

AI study companions

Gaby, Pil, Vera and Cala are study characters powered by AI; they are not people. What you write or say to them is handled like the rest of your learning: it goes through the safety check and the providers described above, and it is stored in your account with the same deletion options. Their answers can be wrong and are not professional advice (medical, psychological, legal or financial).

The companions do not handle emergencies. If you are in a crisis or in danger, do not wait for their answer: contact your local emergency services right away.

Fair use and usage limits

Each account has usage limits according to its plan, published on the pricing page; an account without a plan can only build and view its route. Daily limits reset at 00:00 UTC, and monthly limits every calendar month.

There is also a daily capacity shared by all accounts. If it fills up, we will tell you that the service is full for everyone today; your progress stays saved and you can continue the next day. To apply these limits we count your usage with the counters described above, and we use them for nothing else.

If your account has invitation access, we store when it started, when it ends, who gave it and a short note on why, so we can apply it and withdraw it.

International transfers

The providers in this policy process data outside Colombia, for example in the United States. That transfer is necessary to provide the service you ask for: without it we cannot create your lessons, evaluate your answers, process your voice or send you emails. We share only what each provider needs, and we choose providers with security and confidentiality commitments.

Language and appearance

The site stores a language preference in the brainy-locale-pref cookie for up to one year. It stores your theme choice in browser local storage (theme) until you change it or clear site data. You can remove both through your browser. They are not used to measure learning.

Technical site data

Loading a page sends the technical data needed to deliver it, such as your IP address, the requested URL and browser information, to Cloudflare, which hosts Synapse. Our application logs record a sample of requests to keep the service running and secure, and they are deleted after at most 7 days.

Analytics and advertising

The site includes no advertising or product analytics, and we do not sell your data. Your account and your learning use only the data described in this policy.

Before new features are enabled

Other subjects, tools for teachers and storage of original files are outside this alpha. Before enabling them we will document their purposes, providers, international transfers, retention and deletion. We do not use your answers or your conversations to train models.

Your rights and how to exercise them

You can know, update, correct and delete your data, ask for proof of the authorization you gave, withdraw it and be told how your data is used. Write to the privacy email (privacy@aisynapse.app) from your account email. We answer queries within 10 business days, extendable by 5, and claims within 15 business days, extendable by 8, as Law 1581 of 2012 sets out; if we need the extra time, we will tell you why. If you are not satisfied, you can complain to the Superintendencia de Industria y Comercio (SIC).

• Superintendencia de Industria y Comercio (SIC)

How to delete your data

You can delete any route from your study space: it is deleted with its steps, your attempts, your results and the questions you asked in it. For English you can delete one conversation or use “Delete all my learning data”, which deletes your conversations, your vocabulary and your level without closing your account. To delete your whole account and its data, write to privacy@aisynapse.app from your account email; we will confirm when it is done.

Retention and effective date

We keep your account while it exists so you can return to your routes. Your routes, attempts, results, questions to Gaby, English data and usage counters stay in your account until you delete them or close the account, as explained above. Nothing activates automatically: study reminders arrive only if you turn them on, and you can turn them off from My account. Support emails are kept as long as needed to answer them and to show how we handled them. The database remains in force while Synapse operates and the purposes in this policy apply. This policy is effective from September 26, 2026.