Syncky Health — Privacy Policy

Last updated: 25 October 2026

In one paragraph

Syncky Health moves Apple Health data from your iPhone to places you choose: your own servers, an AI agent you run, or a file. There is no account and no advertising. The only service we run is Relay, a mailbox between your iPhone and your agent. Relay carries your health data end-to-end encrypted, so we cannot read it. Relay sees some connection data, described below, and no health values. The app can also send usage events without health data, under a random per-install identifier, to Google Analytics for Firebase. This is off until you turn it on.

Who we are

The controller is Smirnovs Sergejs ("we"), the operator of Syncky Health and of the Relay service at relay.syncky.app. Our full details are in the Impressum at https://syncky.app/impressum. For privacy questions and requests, write to privacy@syncky.app. We have no data protection officer; the law does not require one for a business of our size and activity.

What the app does with Health data

The app reads the Health data types you allow in the iOS Health permission sheet. It sends them only where you have set up a connection, or into a file you export. There are three routes. You can use any of them, or none:

1. Your servers. The app posts data over HTTP or HTTPS from your iPhone to a server address you entered. That includes servers on your local network. We are not part of this route. Whoever runs that server controls the data from then on.
2. Relay and your agent. You pair an agent by scanning its QR code or pasting its link, and you confirm the pairing with a code. The app encrypts each batch on your iPhone for that agent and hands the sealed message to Relay. Relay keeps it until your agent collects it, for at most 7 days; the table below names the recovery copy Cloudflare keeps for 30 days more. Relay never has the key.
3. Files. When you export, the app writes a JSON or CSV file and you share it with the iOS share sheet. The file goes only where you send it.

The app can also write to Health. It writes entries your server replies with, commands your agent sends, and files you import. Writing works only for the types you allowed in the Health permission sheet and only for connections where you turned writes on. Every entry carries Syncky as its source. You can remove the entries Syncky wrote at any time under Settings › Data & Health access › Records Syncky wrote.

We never see your Health data on any of these routes. Health data is not used for advertising, is not sold, and is not shared with anyone we choose.

Data on your iPhone

The app keeps its own data on your iPhone only: the pairing keys and the secrets of your servers in the iOS Keychain, restricted to this device; the connection settings, the sync anchors and the activity log in files that iOS protects until you first unlock the phone after a restart and that are excluded from iCloud and iTunes backups; the usage-statistics switch in the app's settings. Health data itself stays in Apple's Health store. The app writes health values into its own files in two cases only: an export file you asked for, which it hands to the share sheet, and entries that a server or agent asked it to write into Health, which wait in the same protected, backup-excluded state file until they are written or rejected.

What Relay sees and keeps

Relay is the only part of Syncky that runs on our infrastructure. It runs on Cloudflare Workers and Durable Objects. When you pair an agent, your iPhone and the agent each get an identity in a mailbox (a "hub") on Relay. Relay keeps the data below. The three plan rows apply from the first version of the app that offers plans; version 0.1.0 is free, Relay keeps no plan data for it and applies no plan deadline, so a hub stays until its last member leaves or you delete your Relay data (see Purchases).

Relay cannot see your health values or which data types you share; it does see the size and timing of your messages. It never learns your name, your email or your Apple ID, unless you type them into a device or agent name. Relay's notices reach your iPhone through Apple's push service; Apple sees the device token and the notice, which carries no health data but can carry the name you gave an agent.

Delete Relay data is in Settings › Relay & new iPhone. It tells your agent that you are leaving, then removes your iPhone from Relay at once: Relay deletes the encrypted health data your iPhone sent and every message waiting for it, and your iPhone's Relay access ends, with its push token. The hub belongs to your agent and stays while your agent uses it. Until the hub is deleted, it lists your iPhone as a former member (its identifier, public key and name), and your iPhone's other encrypted messages to the agent, such as this notice and pairing or pause notices, wait at most 7 days for the agent to collect them. If your iPhone was the hub's last member, Relay deletes the hub with everything in it at once. The keyed hashes and daily totals in the table stay for the periods shown there; an erasure request from the app (below) also removes your former member's name, key and dates and its keyed hash, leaving only its identifier, role and a revoked mark.

Where Relay runs: your hub's mailbox, Relay's rate-limit counters and its statistics are stored on Cloudflare's infrastructure in the European Union (the EU jurisdiction of Cloudflare's Durable Objects). Relay's code runs on Cloudflare's worldwide network at the data centre nearest to you, and Relay's logs and operational statistics have no region setting. Cloudflare, Inc. in the United States operates the platform under the EU-US Data Privacy Framework and standard contractual clauses. What is stored is the sealed data and the connection data in the table above.

The agent you run

The agent is a program you install on your own computer or server. It is not a service of ours, and no AI service receives data from Syncky. The agent stores the Health data it receives in its own database. That data is under the control of whoever runs the agent. If you run it for yourself, that is your own household use; if someone runs it for you, that person is responsible for the data under the data protection laws that apply to them.

• When you tap Delete Relay data, the app tells the agent that you are leaving. The agent still has the Health data it received from your iPhone; whoever runs it decides what happens to it and can delete it with syncky-agent forget <member_id> --yes --commands. An erasure request also leaves received Health data with the agent; when the agent learns that a previously confirmed iPhone left without an earlier leaving notice, it tells its operator. Its local log keeps the event with your member identifier, never health values, until its operator deletes the agent's database.
• Once a day, the agent tells Relay its version and its operating system family. The call is authenticated with the agent's Relay identity and refreshes the last-seen day of its keyed hash (see the table). Of the call itself, Relay stores only the version and platform, as daily counts and as data points without any identifier. The operator can turn this off with SYNCKY_HEARTBEAT=off or "heartbeat": "off" in the agent's configuration.

Optional usage statistics

On the "Where your data goes" screen during setup, and in Settings, you can turn on Help improve Syncky. It is off until you turn it on. Until then, the app does not start Google Analytics and sends nothing to Google.

When it is on, the app sends usage events to Google Analytics for Firebase (Google Ireland Limited / Google LLC). These events record which setup steps you saw, which kind of connection you added, whether a pairing or purchase worked, and daily sync counts in ranges. With them, Google receives a Firebase app instance identifier (a random, pseudonymous id per install) and your device model, iOS version, app version and language. Google also derives a coarse location (country, region, city) from your IP address. The events never carry health data, data types, names, server addresses, tokens or error messages. There is no advertising identifier, no ad personalisation and no sharing with ad networks. The app does not include a crash-reporting component, so no crash reports go to Google.

Turning it off stops collection at once and resets the app instance identifier. Google keeps the events for 2 months, the retention set in our Google Analytics property.

Purchases

Version 0.1.0 of the app is free and has nothing to buy, so nothing in this section happens yet; it applies from the first version that offers plans, which we announce in the app and in the App Store release notes.

Plans and the tip are sold through Apple's App Store. Apple processes the payment and holds your billing details, and we never see them. To confirm a Sync + Relay plan, your iPhone sends Relay the signed transaction Apple issued. Relay checks it and keeps the plan, its expiry date and the App Store environment, as described above. If usage statistics are on, Google Analytics also records that a purchase happened. Apple's privacy policy applies to the purchase itself.

Support mail

If you write to support@syncky.app or privacy@syncky.app, we keep your message and our answer for 12 months after your case is closed, and the record of a privacy request for 3 years, so we can show how we handled it. Mail to these addresses is delivered to our mailbox at Google Workspace, which stores it for us under Google's Cloud Data Processing Addendum. A diagnostics report you attach holds identifiers and sync results, never health values; we use it only for your case.

Feedback

You can send us feedback without an account, on the feedback form linked in the footer of syncky.app or in the app under Settings › Send feedback: a message, an optional topic and, if you want a reply, an optional email address. In the app you can also choose to attach a few details about your installation: app version and build, environment, iOS version, your plan, and how many servers and agents you connected. They are off until you turn them on, and the app shows you exactly what it will attach. Please leave health data and secrets out of the message.

We keep each item for 12 months from the day we received it, then it is deleted; write to privacy@syncky.app if you want it deleted earlier, and we remove it from our inbox at once. Feedback is stored on Relay's infrastructure in the European Union, in the same recovery copy as the rest of Relay's storage (30 days). Only we read it: it is never passed to an AI service, written to logs or put into our alerts, which carry counts only. Your IP address is used for a sending limit (5 an hour, 20 a day) and is not stored with the feedback. Offline, the app keeps your draft and shows "Not sent" until you try again.

Our website

syncky.app sets no cookies, runs no scripts and loads nothing from third parties. Cloudflare serves the site and, like every web host, processes your IP address and browser details to answer the request.

On launch, at most once a day, every installation requests the legal notice list from syncky.app (development builds use dev.syncky.app). As for any page of the site, Cloudflare receives the HTTP request, including your IP address and User-Agent (the app's fixed, generic request header), to answer it; the request carries no app identifiers or other app data, has retention as for other site requests and leaves no page-view record. The notices your app receives stay on your iPhone under Settings › You › Legal notices, unchanged, and are included in your backups so that you keep them on a new phone.

The site counts page views on its server, with no cookies, no scripts and no identifiers, and nothing is stored on or read from your device. For each page view it records only the page, the host name of the site that linked to it (not the full address), the country Cloudflare derives from the request, the campaign tag of the link if it has one (utm_source, utm_medium, utm_campaign), whether the device is a phone or a computer, and whether the request looks automated. A click on our link to the App Store or to our open-source repository is counted the same way. Your IP address, your full browser details, the full address of the page and anything that identifies you or connects one visit to another are never recorded. We read these records only as totals per day, page, referring site, country and campaign; Cloudflare keeps them for three months.

What we do not collect

• No accounts, sign-in or passwords; an email address only when you give one for a reply to your feedback or write to us.
• No advertising, no advertising identifiers, no tracking across apps or websites.
• No crash reporting of our own. If you turned on "Share with App Developers" in iOS Settings, Apple may share crash reports with us under Apple's terms.
• Send diagnostics in Settings prepares a sync report without any health values. It goes only where you send it, and nothing is uploaded automatically.
• The agent guide at docs.syncky.app keeps no logs of its own.

Your choices and rights

• Choose the data types in the Health permission sheet, and change them at any time in the Health app or in Syncky › Settings › Data & Health access.
• Remove a server, unpair an agent or delete Relay data in Settings. Removing a connection stops all sending to it at once.
• Data already delivered to a server or an agent is under the control of whoever runs it. Ask that operator to delete it. For your own agent, see "The agent you run".
• Turn usage statistics on or off in Settings at any time.
• Under the GDPR you have the right to access, correct, delete and export the personal data we hold about you, to restrict or object to its processing, and to withdraw consent at any time without affecting what happened before. Because we hold no identity data, we need your hub identifier to find Relay data. The easiest way is Settings › Relay & new iPhone › Privacy requests: it asks Relay for a code for the kind of request you choose, which only your iPhone can obtain, and opens a mail to privacy@syncky.app with that code and your identifiers. With it we can send you a copy of your Relay records, erase them (if your iPhone was the hub's last member, the whole hub), or stop delivery of the data messages your iPhone sent while a restriction applies; control notices still pass through; the code is valid for 90 days, so ask for it before you give up the phone. Without the code, your hub identifier from the report that Settings › Send diagnostics prepares finds the data but does not prove that you control the iPhone behind it, so before we disclose anything beyond what your own report shows, we ask you to perform a step in the app at a time we agree, such as unpairing and pairing your agent again, which Relay records; because that step shows control of your hub rather than of one particular iPhone, we disclose only what every member of your hub can already see. We answer within one month. The quickest way to delete your Relay data is the Delete Relay data button; if you can no longer use the app and have no code, write to us and we will tell you what we can delete from our side and when the rest expires under the table above; we cannot hand Relay records to someone we cannot verify. You can also complain to a supervisory authority. Ours is the Austrian Data Protection Authority (Datenschutzbehörde, Barichgasse 40-42, 1030 Wien, dsb.gv.at); you may also complain to the authority of the country where you live. In Switzerland that is the Federal Data Protection and Information Commissioner (edoeb.admin.ch). For Quebec, the person in charge of the protection of personal information is the owner named in the Impressum, reachable at privacy@syncky.app; for Singapore, the same address is our data protection officer contact. People in the United States also have our Consumer Health Data Privacy Policy.

Legal bases (EU and UK)

• Relay metadata, push notifications and the plan check: to provide the service you asked for (Art. 6(1)(b) GDPR).
• Rate limiting, abuse monitoring, statistics and logs: our legitimate interest in keeping Relay secure and available (Art. 6(1)(f) GDPR), with hashing and short retention to protect you.
• Health data: reaches Relay only as ciphertext we cannot decrypt, and we hold no key, so we do not process readable health data. On your iPhone, it is processed with the permission you give in iOS. Should the sealed messages nevertheless count as health data processed by us, our basis is your explicit consent (Art. 9(2)(a) GDPR): you give it when you tap Pair on the pairing screen, which shows the consent statement together with the Pair button ("By pairing I agree that Syncky Relay carries my health data to this agent, encrypted so that only the agent can read it."), for an agent you set up yourself, after the app has shown you what Relay can and cannot see, and you withdraw it by unpairing or deleting your Relay data.
• Website page view counts: our legitimate interest in knowing which pages are read and where visitors come from (Art. 6(1)(f) GDPR), without identifiers.
• Legal notices: delivering changes of the terms and of the service in a form you can keep, as our terms promise and consumer law requires (Art. 6(1)(b) and (c) GDPR); the daily request carries nothing that identifies you.
• Usage statistics: your consent (Art. 6(1)(a) GDPR, and § 165 Abs. 3 TKG 2021 for storing and reading the identifier on your device). You can withdraw consent at any time in Settings.
• Support mail and privacy requests: performing our contract with you and our legal duty to document requests (Art. 6(1)(b) and (c) GDPR).
• Feedback: our legitimate interest in learning what works and what does not (Art. 6(1)(f) GDPR), and, when you give an email address for a reply, answering you (Art. 6(1)(b) GDPR).

Processors and transfers

• Cloudflare, Inc. runs Relay, the feedback inbox, the website and the agent guide on its global network under its data processing addendum. Data may be processed outside the EU.
• Google (Google Ireland Limited, Google LLC) processes the optional usage statistics under the Google Ads Data Processing Terms, and hosts our support mailbox (Google Workspace) under the Cloud Data Processing Addendum.
• Apple processes purchases as an independent controller, and carries push notifications.

Transfers outside the EU rely on the EU-US Data Privacy Framework, where the recipient is certified, and on the European Commission's Standard Contractual Clauses.

Children

As a product choice, Syncky Health is not directed at children under 16. We do not knowingly process their data. Under Austrian law, the usage-statistics consent of a person aged 14 or older is valid.

United Kingdom

If you use Syncky in the United Kingdom, the UK GDPR and the Data Protection Act 2018 apply to what we process about you, with the same rights as above. We have not appointed a representative in the UK. Send any request about your data, including access and deletion, to privacy@syncky.app with "UK" in the subject line; we answer within one month, in English, and the Delete Relay data button in the app works for you as for everyone. You can complain to the Information Commissioner's Office (ico.org.uk). Transfers of your data out of the UK to Cloudflare and Google rely on the UK Addendum to the EU Standard Contractual Clauses and, where the recipient is certified under the UK Extension to the EU-US Data Privacy Framework, on that certification. In the UK, a child's consent to the usage statistics is valid from the age of 13.

US state health-data laws

Laws such as the Washington My Health My Data Act treat health-related data broadly. Syncky is built so that we never hold readable health data. Relay holds only encrypted messages for at most 7 days (plus Cloudflare's 30-day recovery copy), plus the connection data above. Delete Relay data removes your iPhone from Relay at once. We do not sell health data or share it for advertising, and we do not use geofencing. Our Consumer Health Data Privacy Policy for the United States states the categories, sources, sharing, consent, rights and appeal process those laws require. If such a law gives you additional rights, write to privacy@syncky.app.

Changes

We post changes on this page with a new date. A material change applies no earlier than 14 days after we post it, and we also announce it in the App Store release notes of the next app version.

Contact

privacy@syncky.app · Smirnovs Sergejs · https://syncky.app/impressum