Synchronize
  • Things to do
  • For Practitioners
  • For Businesses
  • Mission
  • Get the app
  • Things to do
  • For Practitioners
  • For Businesses
  • Mission
  • Get the app
Privacy Policy

Your data is yours.
We are stewards of it — not buyers.

A plain-language privacy policy. No dark patterns. No 14,000-word PDF. Read in under five minutes.

Last updated: 22 September 2026  ·  Applies to: synchronize.life and the Synchronize mobile apps

The short version

"We don't track your location. We don't run ads. We don't sell your data. We collect what is necessary to make the platform work — and nothing more. The only personalisation here is your friends."

1 — Who we are

Synchronize is operated by The Connection Catalyst LLC ("we", "us"), a limited liability company registered in the State of Delaware, United States.

Postal address: 108 West 13th Street, Wilmington, Delaware 19801, United States
Get in touch: use our contact form — for privacy questions or data requests, select "Data or privacy request" and it reaches the right person.

We are the data controller for the personal information described in this policy. Where we use third-party services for hosting, form handling, message delivery and similar, we treat those vendors as data processors under our instruction. The full list is at the end of this document.

2 — What we collect, and why

When you sign up on the website

  • Your name and email — so we can reply to your application or send you the app.
  • Your country and city — to plan launch markets. We use the structured city catalogue, not free-text, so your data is comparable in aggregate without identifying you.
  • Your audience type — explorer, practitioner, or business (stored in our systems as seeker, practitioner, or business) — and any optional details you provide, so we can tailor onboarding when you join.
  • Friends you invite — name and email, only if you tick the consent box. We send each one a single email from you. We do not email them again unless they sign up.

When you use the platform

  • Your account — name, email, and a hashed version of your phone number (used only to match contacts, never to log in).
  • What you post — plans, gatherings, trips, events, RSVPs and comments — so the friends you've chosen can see them.
  • Your messages — delivered through Stream (see section 12).
  • Your connections — the people you've chosen to match from your contacts, and who they're connected to — so we can show you who's nearby, who's travelling and who's going where.
  • Basic device and session info — IP address and app version, used for security and debugging.

Bookings and reviews are coming. When they launch, we'll add them here before we switch them on.

When you test the beta app

If you join our closed beta, the email address you give us is passed to Apple (via TestFlight, for iOS) or Google (via Firebase App Distribution, for Android) so they can deliver the build to your device. Those services also send us crash and installation diagnostics — enough to know a build is broken, not enough to know who you are. Both are listed in the vendor list at the end.

What we do NOT collect

We do not track your location in the background. When you post a plan, it shows a place and a time, and it disappears after 24 hours.

  • We never receive your actual phone contacts. No names, no numbers, no address book. What we do keep is explained in full below — see How contact matching works.
  • No continuous location tracking, ever.
  • No advertising identifiers, no third-party ad cookies.
  • No selling of any personal data to anyone.
  • No analytics tools that profile individuals — only aggregate, privacy-respecting analytics.

How contact matching works

This is the one part of Synchronize where we ask for something genuinely sensitive, so it is worth explaining properly rather than in a single reassuring line.

On your phone, before anything is sent. When you allow contact matching, your device takes each phone number in your address book and turns it into a scrambled code — a one-way hash. The real numbers never leave your device. Neither do names, photos, or anything else from your address book. We could not reconstruct your contact list if we wanted to.

What reaches us. Only the codes. Your own number is stored the same way — as a code, not a number.

How a connection is made. We look for matches in both directions. You are only connected to someone when your codes contain theirs and theirs contain yours — when you genuinely already have each other's number. A one-way match creates nothing.

We keep the codes. We do not delete them after checking. We keep them so that when someone you already know joins months later, the connection surfaces — without asking you to re-share your contacts every time. That is the whole reason for keeping them.

What that means honestly. A code is not the same as a phone number, but we will not pretend it is anonymous either. Phone numbers follow predictable patterns, so a code should be treated as personal data about you — and we treat it that way. It is covered by every right in this policy, including deletion.

Never sold, never shared. These codes are not sold, not shared with advertisers, not handed to data brokers, not used to build advertising profiles. They do one job: connecting people who already know each other.

Turning it off. You can switch off Auto-sync contacts in Settings at any time, which stops any further syncing. To have the codes we already hold deleted, ask us and we will remove them.

3 — How we use it

We use your information to: provide the platform, communicate with you about your account, prevent fraud and abuse, comply with legal obligations, and (with your consent) send you product updates.

We do not use your data to train AI models. There is no algorithmic feed. We don't suggest strangers: who you see comes from the contacts you chose to match, and their friends — nothing else.

We run no behavioural analytics in the app. On the website we use Simple Analytics (section 5) — aggregate only, never who you are.

4 — Our legal basis for using it

Under GDPR and UK GDPR we have to tell you why we are permitted to process your data — not just what we do with it. In plain terms:

  • To provide the platform — your account, your bookings (once they launch), your messages, your network. We need this to deliver the service you asked for. Legal basis: performance of a contract.
  • To connect you with people you already know — matching contact codes, and keeping them so later joiners surface. You choose whether to switch this on, and you can ask us to delete the codes at any time. Legal basis: consent.
  • To send you occasional product updates — only if you asked us to. You can change your mind at any time. Legal basis: consent.
  • To email a friend you invited — because you asked us to, and told us they would want to hear from you. One email, from you, never a second one unless they sign up. Legal basis: consent.
  • To keep the platform secure and prevent fraud or abuse — because a platform built on trust has to be defensible. Legal basis: legitimate interests.
  • To meet legal, tax, and regulatory obligations. Legal basis: legal obligation.

5 — Cookies (or rather, the absence of them)

This website sets no cookies. Not for analytics, not for advertising, not for tracking of any kind. That is also why you have not seen a cookie banner — we have nothing to ask consent for.

We use Simple Analytics, a privacy-first analytics tool that works without cookies and without local storage. It does not build a profile of you, does not follow you between sessions or devices, and does not collect anything that identifies you personally. It briefly reads your IP address to work out which country you are in, then hashes it — the address itself is never stored. Its servers are in the EU.

What we learn from it is aggregate: how many people visited a page, which site sent them, roughly what screen size they used. Never who you are.

6 — Who else sees it

Other members see what you choose to share with them — your posts, your RSVPs, your reviews (once they launch), the friends you've connected to. The defaults are conservative; you can tighten or loosen any of these in your settings.

We share with third parties only when:

  • You ask us to (e.g. exporting your data to a connected service, such as add to calendar).
  • It is necessary for the platform to function (vendors, listed below — operating under data processing agreements).
  • The law requires it (in which case we'll tell you, unless legally prohibited from doing so).

7 — Your rights (GDPR / UK GDPR / CCPA)

Wherever you live, you have the right to:

  • Access a copy of everything we hold on you, in a common machine-readable format.
  • Correct anything that is inaccurate.
  • Delete your data. Ask us and we will delete your account and the personal data attached to it — including the contact codes you uploaded and the code for your own number. We do this on request rather than through a button in the app; contact us and we will confirm when it is done. We aim to complete deletion requests within 30 days. Some records may be retained where the law requires it — tax and transaction records, for example — and we will tell you if that applies.
  • Withdraw consent for any processing based on consent (e.g. marketing emails) at any time.
  • Object to processing or restrict it.
  • Complain to a regulator. If you think we have got this wrong, you can lodge a complaint with your local data protection authority — in the UK that is the Information Commissioner's Office (ico.org.uk); in the EU it is the supervisory authority in your country of residence. We would rather you told us first so we can fix it — but that right is yours regardless.

To exercise any of these, use our contact form. We respond within 30 days. There is no charge.

8 — How long we keep it

  • Active account data — for as long as you have an account.
  • Contact codes — kept for as long as your account is open. They have no expiry date, because their purpose is long-term: to surface a connection when someone you know joins later. Switch off Auto-sync contacts to stop new codes being added; ask us to delete the ones we hold. When your account is deleted, your codes go with it, along with the code for your own number — which means any code someone else holds for your number can never match you again.
  • Closed account data — removed when you ask us to delete your account. Once payments exist, basic financial records will be kept as long as the law requires, and we'll say so here first.
  • Website sign-up data — until you ask us to remove it.

9 — Children & young people

Synchronize is currently for people 18 and over. We do not knowingly collect data from anyone under 18. If you believe a child has signed up, please use our contact form and we will act promptly.

We're thinking about this carefully — and we want your input.

Loneliness among teenagers is one of the most significant and under-addressed wellbeing crises of our time. We believe a platform built around trust, in-person connection, and community could be genuinely meaningful for young people — not just adults.

But opening Synchronize to under-18s is not something we would do lightly. It carries serious responsibilities: around data protection, safeguarding, parental consent, practitioner suitability, and the nature of the spaces and events young people could access. We'd want to get this right before we get it at all.

Some of the questions we're working through:

  • What age floor makes sense? We're considering 16+ as a starting point, with parental consent required under 18.
  • Should under-18 access be local community only — no travel sync, no connections outside a defined radius — to reduce risk?
  • Should practitioners who work with under-18s be separately vetted, with additional safeguarding requirements?
  • Should parents have visibility of their child's activity on the platform?

We don't have all the answers yet. If you're a teenager who feels the loneliness of not knowing how to find your people — or a parent thinking about what safe, meaningful connection looks like for your child — we'd genuinely love to hear from you. Your perspective will shape whether and how we build this.

Should Synchronize be available to young people (16+)?

This poll is anonymous — we record only your vote and who you are answering as.

Thank you — your view has been noted.

10 — Cross-border transfers

Our application database (Supabase) and sign-in emails (Resend) are hosted in London, UK, and the EU. Simple Analytics stores its data in the EU. Some vendors — Apple, Google, Stream and Expo — may process data in the United States. Where personal data leaves the EU or UK, we rely on Standard Contractual Clauses or another lawful transfer mechanism agreed with each vendor.

11 — Changes to this policy

We will email you at least 30 days before any material change takes effect. Minor clarifications (typo fixes, structural improvements) are noted in a changelog at the bottom of this page.

12 — Vendors and data processors

We keep this list short on purpose. Every vendor here operates as a processor under our instruction, under a data processing agreement.

Website and sign-ups

  • Netlify — hosting and form handling
  • Simple Analytics — cookieless, aggregate analytics (EU-hosted)
  • Make.com — workflow automation for forms and application processing
  • Airtable — waitlist and application processing
  • Proton Mail — operational email, including documents you email to us

Beta app (closed testing)

  • Supabase — application database and authentication, hosted in London (UK)
  • Resend — transactional email (sign-in codes and account emails), EU region
  • Stream (GetStream.io) — in-app messaging; messages are processed by Stream to deliver them
  • Expo (EAS) — app builds and update delivery to test devices
  • Apple — TestFlight, iOS beta distribution
  • Google — Firebase App Distribution, Android beta distribution

From public launch

  • Stripe — payments, under a data processing agreement

If we add a new vendor, we name it here and note it in the changelog below.

13 — How to reach us

For any question about your data, this policy, or how to exercise your rights — use our contact form and select "Data or privacy request". We respond within 30 days. We treat every message as a person, not a ticket.

One last thing

If anything in this policy is unclear, ambiguous, or feels evasive — that is a bug. Tell us. A privacy policy you can't understand is a privacy policy you can't trust. Write to us and we'll fix the wording.

Changelog

  • 22 September 2026 — Accuracy pass: corrected contact-matching description; data-collected list rewritten to match the beta app; removed retention timings that are not yet automated; hosting regions stated; portability folded into access; behavioural-analytics wording corrected.
  • 23 August 2026 — Vendor list updated: added Resend (transactional email, live in beta), Expo (EAS), and Proton Mail; clarified Airtable and Make.com descriptors.
  • 12 August 2026 — Added registered address and direct email; new sections on lawful bases and on cookies; regulator-complaint right added; vendor list restructured to reflect the beta app (Supabase, Stream, Apple TestFlight, Firebase App Distribution) and to name Simple Analytics.
  • 12 July 2026 — Initial public draft.
Synchronize™

The emotional nutrition platform.
Your friends are the algorithm.

LinkedIn

For You

  • For Explorers
  • Modalities
  • For Practitioners
  • For Businesses
  • Vetting

About

  • Mission
  • A letter from the founder
  • Press & Investors
  • Contact us

Legal

  • Privacy Policy
  • Terms & Conditions
  • Code of Conduct

© 2025 The Connection Catalyst LLC. All rights reserved.

Sync online, thrive offline