Syncd
Privacy policy
Last updated: 2 October 2026
This policy explains what data the Syncd app (“Syncd”, “the app”) handles, why, and what your rights are. Syncd is made by Zdravko Andonov, an individual developer based in Bulgaria, who is the controller of the personal data described here. Contact: [email protected].
In short
- Everything you log stays on your phone. Periods, cycles, symptoms, energy, focus, mood and notes are never sent to us. There are no accounts.
- To show moon data, the app sends an approximate location — a point a few kilometres from you, never your exact position — plus a random install identifier that isn't linked to who you are.
- No ads, no analytics, no tracking. We don't sell or share your data.
1. Data that stays on your phone
What you log in Syncd — period days and cycles, symptoms, daily energy, focus and mood, and any notes — is stored only in the app's database on your device. It is never sent to us, and we have no way to access it.
Device backup. If Android's backup is turned on, Android may include the app's data in your device backup, which is stored in your own Google account under Google's terms. We can't access these backups. You can turn backup off in your phone's settings.
Notifications. Lunar-day notifications are scheduled on your phone. No notification service of ours receives any data about you.
Deleting it. Uninstalling the app, or clearing its storage in Android settings, deletes this data from your phone. A copy in your Google backup, if any, is managed in your Google account.
2. Data the app sends to our server
Moon phases, zodiac signs, lunar days and their timing are calculated on our server and depend on where you are. To get them, the app sends:
- An approximate location. The app asks Android only for your approximate location, never your precise location. Before sending it, the app replaces it with a fixed point for your area: the map is divided into squares of about 11 km, and each square has one point placed just outside it. The app sends your square's point, so it is always more than 1 km from your real position, and everyone in your square sends exactly the same one. It never pinpoints you. If you don't allow location access, the app uses a fixed default location instead and its moon timings are less precise.
- The dates you're looking at.
- A guest token. On first launch, our server gives the app a token containing a randomly generated identifier. It isn't linked to your name, email, phone number or any device identifier, and we use it only to limit how many requests one installation can make, so the service stays available and can't be abused. The token is kept in secure storage on your phone; our server doesn't keep a list of issued tokens.
- Technical request data. Like any internet service, our server and hosting provider receive your IP address and the app's technical identifier (user agent) with each request.
What our server keeps
- Our server's own logs record the type and path of each request, but not your IP address or location.
- To enforce rate limits, the server counts requests per IP address and per guest token, in memory only and as one-way, salted codes rather than the addresses themselves. These counts are discarded within a few minutes and whenever the server restarts.
- Calculated moon data is cached per area of about 110 km, with no record of who asked.
- Daily totals of requests, with no link to any person or device.
Our hosting provider, Railway, keeps standard request logs that include your IP address, the app's technical identifier and the requested address (which contains the approximate location). Railway keeps these logs for up to 30 days, to operate and secure the service.
Why we process this data
We process this data on the basis of our legitimate interests (Article 6(1)(f) GDPR): to provide the moon features you use in the app, and to keep the service secure and available. You can object to this processing at any time — see section 7. If you prefer not to share even an approximate location, you can deny location access and the app will use the default location.
3. Service providers
| Provider | What for | Where |
|---|---|---|
| Railway | Hosting our server; its request logs (section 2) | EU West — Amsterdam, Netherlands |
| Neon | Our database, which holds only the moon-data cache and daily request totals | AWS Europe Central — Frankfurt, Germany |
| Expo | App updates: the app checks Expo's update service for new versions of its code. These checks include your IP address, a random installation identifier created by the update system, and technical details such as the app version and platform. | May be outside the EU — see Expo's privacy policy |
| Distributing the app through Google Play, which may give us aggregated statistics and crash reports. Android's own location and backup services are provided by Google under its terms. | See Google's privacy policy | |
| Cloudflare | Our domain's DNS, and forwarding emails you send to our support address | See Cloudflare's privacy policy |
Where a provider processes data outside the European Union, it relies on the safeguards described in its own privacy policy, such as the EU–US Data Privacy Framework or the European Commission's standard contractual clauses.
4. Emailing us
If you email [email protected], we receive your email address and your message, and use them only to reply to you. Emails pass through Cloudflare's email forwarding to our inbox. We keep them only as long as needed to deal with your request.
5. How long data is kept
| Data | Kept |
|---|---|
| What you log in the app | On your phone until you delete it or uninstall the app |
| Guest token | On your phone until you uninstall the app; not stored by our server |
| Rate-limit counts (salted codes) | A few minutes, in memory only |
| Railway's request logs | Up to 30 days |
| Moon-data cache and daily totals | Indefinitely — they don't identify anyone |
| Support emails | As long as needed to deal with your request |
6. Children
Syncd is intended for people aged 13 and over and is not directed at children under 13. The app doesn't ask for your age and doesn't collect information that identifies you.
7. Your rights
Under the GDPR you have the right to access, correct and delete your personal data, to restrict or object to its processing, and to data portability where it applies. The data you log is entirely on your phone and under your control. The data our server handles isn't linked to who you are, so we usually can't tell which requests were yours — but write to [email protected] with any question or request and we'll help as far as we can.
You also have the right to complain to a data protection authority: in Bulgaria, the Commission for Personal Data Protection (cpdp.bg), or the authority in the EU country where you live.
8. Security
All communication between the app and our server is encrypted with HTTPS. The guest token is kept in Android's secure storage on your phone.
9. Changes to this policy
If this policy changes, we'll update this page and the date at the top. If a change affects how your data is handled, we'll also say so in the app or its store listing.
10. Contact
Zdravko Andonov, Bulgaria — [email protected]