Privacy Policy

1. Introduction

Welcome to SyncUp. This Privacy Policy explains how we collect, use, and protect your personal data when you use our service. SyncUp is a synchronized video watching platform that allows users to watch content together in real-time.

SyncUp runs in a web browser and as an app for iOS and Android. This policy covers both. A few things only happen in the app (push notifications, crash reports, device permissions) and those are labeled where they come up.

We are committed to protecting your privacy and complying with the General Data Protection Regulation (GDPR) and other applicable data protection laws in the European Union.

2. Data Controller

SyncUp is operated by Roan de Graaf as an independent sole proprietor, acting as the data controller for the personal data collected through this service. The service is hosted within the European Union.

The fastest way to reach the data controller about anything in this policy is the contact form. Messages received there are monitored personally and are the appropriate channel for data subject requests.

3. Data We Collect

We collect minimal personal data to provide our service:

• Display name: A name you choose to identify yourself to other users in watch rooms. This is required to use the service.
• Email address: Required if you choose to create a registered account. Used for account authentication, recovery, and essential service communications.
• Profile picture (optional): If you upload a profile picture, we store it securely. We automatically remove metadata (EXIF data) from uploaded images for your privacy.
• Usage data: We collect information about your watch sessions (rooms joined, videos watched, session duration) to provide service features and improve our platform.
• Session security data: When you sign in, we automatically record your IP address and the user agent string your browser or the app sends. This data is stored as part of your authentication session for security purposes (detecting unauthorized access) and is deleted when your session expires.
• Notification token (mobile app): If you allow notifications on your phone, we store the registration token that Firebase Cloud Messaging issues to that install, plus whether it is an iOS or an Android device. The token is encrypted in our database and is the only way to send a notification to that specific install. Storing the token is not the same as sending you anything: friend room notifications are a separate setting that is off until you turn it on.
• Crash reports (mobile app): Release builds of the app send crashes to Firebase Crashlytics so we can find out what broke. A report contains the error and its stack trace plus the device and app details Crashlytics gathers with it, such as device model, operating system version, and app version. Debug builds send nothing. There is no in-app switch for this.
• Blocks and reports: If you block someone, we store that the block exists. If you report a user or one of their messages, we store the reason you picked, anything you typed, and a copy of the reported message text and both display names as they were when you filed it. The copy exists so the report still makes sense if the account or the message is gone by the time it is read.

You can use SyncUp without creating an account. Anonymous users have full access to watch party features but cannot recover their session if they lose access.

4. Legal Basis for Processing

We process your personal data based on the following legal grounds under GDPR Article 6:

• Contract performance: Processing your email and display name is necessary to provide you with our service.
• Legitimate interests: We may process data for security purposes and to improve our service.
• Consent: Where required, we will obtain your consent before processing data for specific purposes such as marketing communications.

5. How We Use Your Data

We use your personal data to:

• Create and manage your account
• Provide the synchronized video watching service
• Send essential service-related communications
• Send the notifications you have turned on
• Maintain the security of our platform
• Review reports and enforce blocks between users
• Diagnose crashes in the mobile app
• Improve and develop our service

6. Data Retention

We retain your personal data for as long as your account is active or as needed to provide you with our service:

• Account data: Retained while your account is active. Deleted immediately when you delete your account.
• Session data: Authentication sessions expire 30 days after they are last used, after which the session token is no longer valid. Session records (including the IP address and user agent captured for security) are deleted when the associated account is deleted.
• Usage data: Watch session history, in-room chat messages, and direct messages are retained for as long as your account is active so you can view your history. All of it is deleted when you delete your account.
• Consent records: Records of your cookie consent choices (whether you accepted or rejected analytics cookies, and the version of this policy in effect at the time) are retained for up to 3 years as required to demonstrate compliance with GDPR.
• Profile pictures: Deleted immediately when you remove them or delete your account.
• Notification tokens: Kept while the device is registered. Deleted when you sign out of the app and when you delete your account. If a token stops working (you uninstalled the app, or the device was issued a new one), the next send attempt comes back rejected from Firebase and we delete the record then.
• Crash reports:These live in Firebase Crashlytics, not in our database, so they follow Google's retention schedule rather than ours.
• Blocks: Kept until you unblock the person. Deleted when either account is deleted.
• Reports: Kept after they have been reviewed, so there is a record of what was reported and what was decided. Because a report carries its own copy of the display names and message text, that copy stays in the report even after the account it is about has been deleted.

If you delete your account, all your personal data is deleted immediately, except where we are required to retain it for legal purposes or to protect our legitimate interests (such as defending against legal claims).

7. Third-Party Services

We use the following third-party services to operate our platform. These services may process your data according to their own privacy policies:

• Google Analytics: We use Google Analytics to understand how visitors use our service. This data is collected only if you consent to analytics cookies. Google Analytics collects anonymized usage data such as pages visited and session duration. See Google's Privacy Policy.
• Polar (payments): All subscription and one-time payments are processed by Polar, who acts as the Merchant of Record. Polar processes your payment details, billing address, and purchase history. See Polar's Privacy Policy.
• Brevo (email service): We use Brevo to send all service emails, including email verification messages, password reset messages, and contact form submissions. When you contact us or receive an account email, your email address and message content are processed through Brevo. See Brevo's Privacy Policy.
• Cloudflare: Real-time voice chat and peer-to-peer video streaming are relayed through Cloudflare Realtime. This includes a video file you pick off your own device to stream to your room. Audio and video streams are processed during active sessions only and are not recorded or stored, by Cloudflare or by us. See Cloudflare's Privacy Policy.
• Firebase Cloud Messaging (Google), mobile app only: Delivers push notifications to the app. Google receives the device's notification token and the text of the notification, which names the friend who started watching and the room they are in. Nothing is sent through Firebase unless you have both allowed notifications on the device and turned friend room notifications on. See Google's Privacy Policy.
• Firebase Crashlytics (Google), mobile app only: Collects crash reports from release builds of the app. Google processes and stores these reports on our behalf. See Google's Privacy Policy.
• DiceBear: Used to generate default avatar images. Only your display name is used to generate a unique avatar. See DiceBear's Privacy Policy.
• YouTube / Google:Videos are embedded using YouTube's player. YouTube may set cookies when you interact with embedded videos. See Google's Privacy Policy.
• Twitch / Amazon:Twitch streams are embedded using Twitch's player. Twitch may collect viewing data when you watch embedded streams. See Twitch's Privacy Policy.
• Klipy:Used for GIF search functionality in chat. Search queries are sent to Klipy's API. See Klipy's Privacy Policy.
• S3-compatible storage: Profile pictures you upload are stored on an S3-compatible storage service hosted in the EU.

We do not sell your personal data to third parties. All third-party processors we use are compliant with GDPR and process data only as necessary to provide their services to us.

8. Your Rights Under GDPR

Under the General Data Protection Regulation (GDPR), you have the following rights regarding your personal data:

• Right of access: You can request a copy of all personal data we hold about you. Contact us via our contact form and we will provide your data within 30 days.
• Right to rectification: You can update your display name and email address directly in your account settings. For other corrections, please contact us.
• Right to erasure: You can delete your account at any time through your account settings. This will permanently delete all your personal data. Alternatively, contact us and we will delete your data within 30 days.
• Right to restrict processing: You can request that we limit how we use your data while we address any concerns you have. Contact us to make this request.
• Right to data portability: You can request a copy of your data in a structured, machine-readable format (JSON). Contact us via our contact form and we will provide your data export within 30 days.
• Right to object: You can object to processing based on legitimate interests. Contact us to raise an objection and we will review your request.
• Right to withdraw consent:Where we process data based on your consent (such as analytics cookies), you can withdraw consent at any time by clearing your browser cookies and selecting "Reject All" on the cookie consent banner. In the mobile app, turn friend room notifications off in Settings, or revoke the notification permission in your device settings, and we stop sending them.

We will respond to all data rights requests within 30 days. If your request is complex, we may extend this by up to 60 additional days, but we will inform you of any extension and the reasons for it.

If you believe we have not handled your request appropriately, you have the right to lodge a complaint with your local data protection authority.

9. Cookies

We use cookies to provide and improve our service. We categorize cookies as follows:

• Essential cookies: Required for authentication and basic functionality. These cannot be disabled.
• Analytics cookies: Help us understand how you use our service. Only set with your consent.

When you first visit our site, you will see a cookie consent banner where you can accept or reject non-essential cookies. To change your preferences later, clear your browser cookies for our site and the consent banner will appear again on your next visit.

This section is about the website. The mobile app does not show a cookie banner and sets no cookies of its own. The YouTube and Twitch players embedded in it still run in a web view, so those two can set their own cookies inside the app the same way they do in a browser.

For detailed information about the cookies we use and how to manage them, please see our Cookie Policy.

10. Mobile App Permissions

The iOS and Android apps ask for a few device permissions. Each one is requested at the point you use the feature behind it, not on first launch, and the app still works if you say no (with that feature switched off):

• Microphone: Used for voice chat with the people in your room. Your audio goes to them through Cloudflare Realtime while the call is running and is not recorded or stored. On Android the app runs a foreground service while voice chat is active, so the call survives you locking the screen or switching apps.
• Photos and files: Used when you pick an image for your profile picture, or pick a video off your device to stream to your room. On iOS this goes through the photo library, which is why the app asks for access to it. On Android it goes through the system file picker, which needs no permission and only hands the app the one file you chose. A profile picture is uploaded to our storage with its metadata stripped, as described in section 3. A video you stream is sent to the room through Cloudflare Realtime and is never uploaded to our servers or stored by us.
• Notifications: Used to send friend room notifications. Allowing the permission is what lets us store a token for the device. Whether we actually send anything is the separate friend room notifications setting, which is off by default.
• Camera: The app never uses your camera. The iOS build declares a camera usage string only because the WebRTC library behind voice chat includes camera support, and iOS requires the string to be present when that library is linked. No code in the app opens the camera, so iOS will not prompt you for camera access. The Android app does not declare the camera permission at all.

11. International Data Transfers

Our service is hosted within the European Union. Some of our third-party service providers (such as Google) may process data outside the EU. Where this occurs, we ensure appropriate safeguards are in place, such as:

• Standard Contractual Clauses approved by the European Commission
• Adequacy decisions by the European Commission
• Other legally recognized transfer mechanisms

You can contact us if you would like more information about the specific safeguards applied to the transfer of your personal data.

12. Data Security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. These measures include:

• Encryption of data in transit using TLS/HTTPS
• Secure password hashing using industry-standard algorithms
• Regular security reviews and updates
• Access controls limiting who can access personal data
• Automatic removal of metadata from uploaded images

13. Children's Privacy

SyncUp is intended for users aged 13 and over. We do not knowingly collect personal data from children under 13. If you become aware that a child under 13 has provided us with personal data, please contact us and we will delete it.

If you are based in a European country where the age of digital consent under GDPR Article 8 is higher than 13, you must have permission from a parent or legal guardian to use the service until you reach that age. Parents or guardians can contact us at any time to request deletion of a minor's data.

14. California Residents (CCPA/CPRA)

If you are a California resident, the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), gives you specific rights regarding your personal information. The rights described in section 8 (access, deletion, correction, portability) apply to you and you can exercise them through the same contact form.

We do not sell your personal informationand we do not "share" it for cross-context behavioral advertising as those terms are defined by the CCPA/CPRA. You therefore do not need to submit a "Do Not Sell or Share My Personal Information" request, but you may still contact us if you have any concerns. We do not use sensitive personal information for any purpose that would trigger the right to limit its use.

We will not discriminate against you for exercising any of your CCPA/CPRA rights.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any significant changes by posting the new Privacy Policy on this page and updating the "Last updated" date. We encourage you to review this Privacy Policy periodically.