This describes what Stephen Kobata, trading as Synapie (formerly Penaptic), collects when you use Synapie, what we cannot see, and who else is involved. It is written to be checkable against the product rather than to be reassuring.
The short version. Your notes, todos, lists, calendar entries and attachments are encrypted on your device before they reach us. We hold the ciphertext, its size, and when it arrived. We hold your sign-in identifier, a record of your devices, what you spend on the assistant, and your billing status. We do not hold the key, so we cannot read your content — and there is no “just this once” path that lets us.
The exception, stated plainly: when you ask the server-hosted assistant a question, the content of that request is readable by us and by the model provider that answers it, because it has to be. The on-device model sends nothing.
Synapie is run by one person: Stephen Kobata, trading as Synapie, in California, United States. He is the controller of the personal data described here, and there is no company, no data team and no one else with access. Contact: [email protected].
| What | Why, and what it actually is |
|---|---|
| Sign-in identifier | Your email address (Google sign-in) or phone number (SMS sign-in), and for Google an opaque account id from Google. This is how your devices find the same account. |
| Device records | One row per device you sign in on: an id, the name you or the OS gave it, a public key, when it enrolled, and when it was last seen. This is what the Devices panel shows and what lets you revoke a device. |
| Encrypted content | Ciphertext blobs, their size, a timestamp, which of your devices sent them, and an opaque workspace identifier. We cannot decrypt any of it. |
| Assistant usage | Per request: time, which model, how many tokens in and out, how long it took, and whether it succeeded. Not the text of the request or the answer. This is what meters your credit. |
| Credit ledger | Grants and charges against your balance, with amounts and the model involved. |
| Billing status | A Stripe customer and subscription identifier, and whether the subscription is active. Card details go to Stripe and never reach us. |
| Push tokens | If you enable notifications on iOS, the token Apple issues for that device. |
| Web session | When you sign in at synapie.com/account, a session record and a cookie. The cookie reaches the account pages only. |
| Server logs | Ordinary operational logs, including IP address and timing, kept short-term for security, abuse prevention and debugging. |
The content of your notes, todo text, list names, calendar entries, attachments, tags, folder names and titles, and the contents of any encrypted workspace. These are encrypted with a key generated on your device that is never sent to us in readable form.
This is a structural property, not a promise about our conduct: we could not produce your content in response to a request from you, from law enforcement, or from anyone else, because we do not have what it takes to read it. What we could produce is the ciphertext and the account-level records in the table above.
The on-device search index, memory and embeddings never leave your device at all.
Synapie can run its assistant two ways, and they differ completely here.
Included on every plan. It runs entirely on your machine. Nothing about the request leaves the device.
When you choose one of these, the content needed to answer — your question, and whichever of your notes the assistant decides it needs — is sent over an encrypted connection to our server and on to the model provider serving that model. Both can read it while processing it. We do not store the text of those requests or their answers; we store only the metering row described above.
The providers currently used are Anthropic, OpenAI and DeepSeek. Which one receives a given request depends on the model you pick, and on the fallback the server uses if that model is unavailable. DeepSeek processes requests on infrastructure in China — see section 11. Do not send anything to a server-hosted model that you are not willing to have processed this way.
Connecting Google Calendar is optional, off by default, and separate from signing in with Google. It is also a separate application as far as Google is concerned: signing in tells us only who you are, and grants us no access to your calendar.
If you connect it, Synapie asks Google for permission to see, edit and permanently delete the calendars you can access, and uses that permission for exactly four things:
We ask for write access because the app is not a viewer: creating and changing events on your behalf is a core feature. A read-only permission would disable it.
Where the connection lives. The token Google issues is stored in your device's own secure storage — the iOS Keychain, or the equivalent on desktop. It is never sent to our server, so we cannot reach your calendar from our side, and connecting on one device does not connect another.
Where the events go. Events fetched from Google are held on your device and are encrypted there before they sync to your other devices, exactly like your notes — our server holds only the ciphertext (sections 3 and 4). If you ask a server-hosted assistant model something that needs your calendar, the relevant events are sent to that model provider to answer it, on the same terms as any other content in section 4. The on-device model sends nothing anywhere.
Limited Use. Synapie's use and transfer of information received from Google APIs to any other app adheres to the Google API Services User Data Policy, including its Limited Use requirements. Concretely: your Google Calendar data is used only to provide the calendar features described above, it is never sold, never used for advertising or profiling, and never used to develop, train or improve generalised AI or machine learning models. No human at Synapie reads it.
Turning it off. Disconnect Google Calendar in the app to delete the stored token, or revoke Synapie's access at myaccount.google.com/permissions. Either way we keep no copy of the grant. Events already mirrored into Synapie stay in your own encrypted data until you delete them.
We use these providers to run the service. Each receives only what it needs.
| Provider | What it receives |
|---|---|
| Stripe | Payment processing: your card details (directly — they never reach us), email, and billing history. |
| Sign in with Google: Google confirms your identity to us and gives us your email address and an account id. Separately, if you connect Google Calendar, your calendar requests go to Google from your device — see section 5. | |
| Twilio | SMS sign-in: your phone number, to send a verification code. |
| Anthropic, OpenAI, DeepSeek | The content of server-hosted assistant requests, to answer them. |
| Tavily | Web search queries, when the assistant searches the web. The query text, not your notes. |
| Apple | Push notifications to iOS devices. |
| Cloudflare | Network routing and protection for synapie.com, penaptic.com and api.penaptic.com. |
We do not sell your personal data, and we do not share it for advertising. We may disclose data if we are legally required to — noting that what we are able to disclose is limited to the records above, not your content.
Where the GDPR or similar law applies, we rely on: performance of a contract for the data needed to run your account, sync and billing; legitimate interests for security, abuse prevention and operational logging; consent where you enable something optional, such as push notifications; and legal obligation for tax and accounting records.
Depending on where you live you may have the right to access, correct, export, delete or restrict processing of your personal data, to object to processing, and to complain to a data protection authority. If you are in California, you additionally have rights to know, delete, correct, and to opt out of sale or sharing — we do neither.
You can exercise most of these without asking us: the apps export everything as plain files, the Devices panel revokes a device, and your account page deletes your account. For anything else, contact [email protected] and we will respond within the period the law requires (30 days under the GDPR, 45 under the CCPA). We will not treat you differently for exercising a right.
One limit worth being straight about: a request to access your content is one we cannot fulfil, because we cannot read it. Your devices can.
Content is encrypted on your device before upload. Connections use TLS. Credentials are stored hashed, never in plaintext. Sessions expire. No system is perfectly secure, and we do not claim otherwise — but the design goal here is that a breach of our servers exposes ciphertext and account metadata, not your notes.
Our servers are located in the United States, and the providers listed above operate internationally. Where personal data is transferred out of the UK or EEA we rely on the appropriate safeguards, such as the European Commission's standard contractual clauses.
One transfer is worth naming rather than leaving to that sentence: requests routed to DeepSeek are processed in China, which has no UK or EU adequacy decision. If you would rather your requests were not processed there, use the on-device model, which sends nothing anywhere. The app's model picker lists routes, not providers, so it does not currently let you choose which provider answers.
Synapie is not intended for anyone under 18 and we do not knowingly collect data from children. If you believe a child has given us personal data, contact us and we will delete it.
We will publish any revised version here with a new date, and where the change is material we will ask you to review it the next time you sign in on the web.
[email protected]
Stephen Kobata, trading as Synapie — California, United States