Privacy Policy

Version 2.0.0, effective 27 July 2026.

This policy explains what SynsIQ does with your data. It covers the app and the server services that go with it. Swiss data protection law applies. If you use SynsIQ from the European Economic Area, the GDPR applies as well.

1. Controller and contact

The controller responsible for this processing is:

Markus Kainer
Hagenholzstrasse 60
8050 Zurich
Switzerland

Privacy enquiries: privacy@synsiq.com
Support: support@synsiq.com

2. What SynsIQ processes

Without an account, nothing leaves your device. You can use SynsIQ without registering. Your training sessions are then stored locally and nowhere else: the time, exercise type and duration, along with reaction times, accuracy, errors, missed stimuli, consistency, fatigue index, score and focus score. The individual stimuli and responses within a session stay on the device too, as do your baseline results, your name, sport and level, your goals and reminders, and settings such as language, sound and haptics. None of it reaches a server.

An account adds data on the server. It holds your email address, your display name, your role as an athlete or a coach, a user id and timestamps. Your password is kept by the sign-in service as a cryptographic hash and nothing else. We never see it in clear text. Confirming your email address and resetting your password also involve messages and one-time tokens.

With an account, the app synchronises your training sessions as well, carrying the same measurements as above. Alongside them sit a device profile with model identifier, operating system version, refresh rate and time of last use, and your coach connections with their status, invitation route and either an invitation code or an invited email address. The training plans assigned to you are stored too, including their units, exercises and the exercises you have completed. We also record which version of the terms of use and this policy was shown to you. As a coach, you can add a specialty and an organisation.

Reaching our servers inevitably creates connection data, mainly an IP address, a timestamp and the endpoint requested. This arises at our cloud provider and serves operation and security. We do not mine it to watch what individual people are doing.

Several things deliberately do not happen. SynsIQ carries no advertising and no advertising identifiers. We use no third-party analytics or tracking components, and the app never touches your location, contacts, photos, camera or microphone. We neither sell data nor share it for advertising. There are no push notifications from our servers, because your device schedules your reminders on its own. The app is built on Apple frameworks alone, with no external libraries.

The scores and figures SynsIQ shows are feedback on your training. They are not medical measurements, and the app makes no automated decision that has legal effect.

3. Why we process it, and on what basis

We process your data to give you SynsIQ and the features you signed up for: training on the device, your account, synchronisation between your devices and working with a coach. Where the GDPR applies, this rests on Article 6(1)(b) GDPR. Under Swiss data protection law, the processing serves the performance of our agreement with you.

Connection data arises so that the services stay secure and usable. That is our legitimate interest in secure operation, and under the GDPR it rests on Article 6(1)(f) GDPR.

We ask for no data protection consent for any purpose. The prompt iOS shows when you turn reminders on is a different thing. It is a permission granted at device level.

Minors need their parent's or guardian's agreement before opening an account. Parents and guardians may ask at any time what we hold about a child and request that the account be deleted. An email to privacy@synsiq.com is enough.

4. Hosting and service providers

Supabase provides the database, the sign-in and the server functions. It acts as our processor and handles the data only on our instructions. The database sits in the European Union, in the Ireland region.

Apple distributes the app through the App Store and TestFlight. Apple is responsible in its own right for the data that arises there, and we have no access to it.

Your coach sees your training results only once you have accepted a coach connection. Before you accept, and after you revoke, there is no access at all.

No one else receives your data. We hand data to public authorities only where the law requires it.

5. How long we keep data, and deleting your account

We keep data for as long as the purpose behind it lasts:

• Local data stays until you delete it or remove the app from your device.
• Account data and synchronised training data stay while your account exists.
• A coach connection stays until one of the two accounts is deleted. Revoking it

ends the access immediately.

• The record of which version of these documents you were shown stays for the

life of your account.

You delete your account in the app under Settings. That removes the account and everything tied to it, including training sessions, device profiles, coach connections, plan assignments and the confirmation record. We ask you to sign in again first, because the deletion cannot be undone. To remove the data on your device, delete the app.

How long our cloud provider keeps logs and backups is for that provider to decide. We have agreed no separate period with it. Until a backup is overwritten, something you deleted may still sit inside it.

6. Your rights

You can ask what data we hold about you and have it corrected or deleted. You can also have the processing restricted and receive your data in a common electronic format. Where processing rests on our legitimate interest, you can object to it.

An email to privacy@synsiq.com is enough. We answer within the statutory deadlines, which under the GDPR normally means within a month.

You are also free to complain to a supervisory authority at any time. In Switzerland that is the Federal Data Protection and Information Commissioner, and in the European Economic Area the data protection authority where you live.

7. Security, and changes to this policy

Traffic to our servers is encrypted with TLS and travels no other way. Your sign-in tokens live in your device's keychain. On the server, access rules make sure an account can reach only its own data, and the app carries no privileged service key. No method is completely secure, so we take technical and organisational measures that match the risk.

SynsIQ is in a test phase through TestFlight. If the app or the law changes, we update this policy. You will find the current version in the app under Settings, with its version number and date. We announce material changes in the app.