Privacy Policy

1. What we collect

Account information

We collect your username, email address, and password. Your password is never stored as-is; we keep only an Argon2 hash of it. We also store your display name, bio, avatar, and account settings. If you sign in with Google, once that option is available, Google shares your name, email address, and profile picture with us. We don't get your Google password or access to anything else in your Google account.

Your writing and activity on Synth

We store what you create on Synth:

• Stories, chapters, and passages, including the history of who wrote what.
• Your chats with your AI Scribe.
• Story Bible, lore, and outline notes.
• Grades and style analysis of your writing.
• Forum posts, comments, likes, and follows.
• Progress in WyrmRail.

Usage information

We track how many AI tokens your account uses, for your weekly allowance, and when your account was last active.

Sign-up protection

When you create an account, we save two things with it:

• A scrambled code (a one-way hash) made from the IP address you signed up from. It isn't the IP address itself, and it can't be turned back into one.
• Your browser's user-agent string, a short line of text describing your browser and operating system.

We use these only to spot automated or mass sign-ups. The sign-up form may also run Cloudflare Turnstile, a check that tells people from bots, usually without you seeing anything.

Visitor analytics

To count visitors, we make a scrambled code (a one-way hash) from your IP address, a secret key, and the date. We can't turn that code back into your IP address, and it changes every day, so we can't follow you from one day to the next. Alongside that daily code, we record which Synth pages were viewed, roughly how long a visit lasted, and the website that referred you (the site name only, not the full link).

Connected AI services

If you connect your own AI provider key, we store it encrypted with AES-256-GCM. If you connect a webhook endpoint, we store its address and the security token for it.

Billing

If you subscribe, Stripe collects and processes your payment details. We receive and store your Stripe customer ID, your plan, its status, and renewal dates. We never receive your full card number.

Messages you send us

If you use the contact form or email us, we keep your message, the email address you gave, and, if you were signed in, your username, so we can help you. To prevent spam, the form also stores a one-way hash of your IP address and your browser's user-agent string.

2. How we use it

We use this information for the following:

• Running Synth: showing your work, running the editor and AI features, grading, and keeping your drafts safe.
• Enforcing weekly allowances and preventing abuse.
• Handling subscriptions.
• Answering your messages.
• Sending account emails, like security notices, billing receipts, and renewal reminders.
• Understanding, in aggregate, how Synth is used so we can improve it.

We don't sell personal information. We don't use it for advertising. We don't use your writing to train AI models. We won't send you marketing emails unless you opt in.

3. Who else sees it

We share information only with the services Synth needs to run, and only what each one needs:

• DeepSeek is our AI provider. It processes text for AI requests; see section 4.
• DigitalOcean provides our servers, located in the United States.
• Cloudflare sits in front of the site for security and speed, so your connection passes through it. It also runs the Turnstile bot check on the sign-up form.
• Stripe handles payment processing for subscriptions.
• Google handles sign-in, only if you choose "Sign in with Google."
• Your own AI provider or endpoint receives requests if you connected one; section 8 of the Terms covers this.

We may also disclose information if the law requires it, to protect someone's safety, or to investigate a serious violation of our Terms. If Synth were ever sold or merged, your information would move with it under this policy, and we'd tell you first.

4. AI processing

When you use Synth's built-in AI, we send the text needed for that request to DeepSeek, a company based in China, through its API. That text can include your passage, recent chat, and relevant Story Bible notes. DeepSeek may process and store that data in the People's Republic of China. DeepSeek's handling of it is governed by DeepSeek's own policies.

We send only what the request needs, not your email, password, or payment details. If you'd rather your writing not go to DeepSeek, you can connect your own AI provider in Settings. Your requests then go to the provider you picked instead.

5. What's public

The following are visible to anyone:

• Your username, display name, bio, and avatar.
• Published stories and chapters, including their AI-contribution labels.
• Grades you choose to show.
• Forum posts and comments.
• Likes and follows.

Drafts, your AI chats, Story Bible notes, your email address, and your token usage are private.

6. Cookies and local storage

We use only the cookies Synth needs: one that keeps you signed in, one that protects forms from forgery (CSRF), and, for trial drafts, the cookie that is the draft. Your browser's local storage keeps a few small interface preferences. We don't use advertising or cross-site tracking cookies, and we don't run third-party analytics scripts.

7. How long we keep it

• Your account and writing are kept while your account exists. When you delete your account in Settings, it's deleted at once (see Deleting your account). If you ask us to do it instead, it's deleted within 30 days.
• Trial drafts: empty ones are deleted after about 12 hours, and ones with writing after 30 days if no account is created.
• Visitor analytics are deleted after 90 days.
• Backups may keep deleted data for up to 90 days before they cycle out.
• Billing records may be kept as long as tax and accounting law requires.

8. Your choices and rights

You can edit your profile and delete your writing yourself. For anything else, contact us using your account's email address and we will:

• Tell you what personal information we hold about you.
• Correct anything that's wrong.
• Give you a copy of your writing and data.
• Delete your account and personal information.

We'll respond within 30 days, and we won't treat you differently for asking. Depending on where you live, laws like the GDPR or the California Consumer Privacy Act may give you additional rights, and we'll honor them.

Deleting your account

You can delete your account yourself: Settings, then Delete my account. You confirm with your password (or, if you signed up with Google, your email address), and it happens at once. It can't be undone. Your account, profile, companion and settings are deleted, along with every story and chapter you wrote, your WyrmRail characters and everything they carried, your forum posts, comments, likes and follows, your saved API keys, your sign-in links, and your usage records. A paid plan is cancelled straight away and won't renew. A few things stay, without you attached. Canon that the shared WyrmRail world already remembers stays, so other players' stories still make sense, but your name and your characters' names are taken off it and it is told of “someone the Lull has forgotten”. If other people replied to a forum topic you started or to one of your comments, their replies stay, and your part shows as “(deleted)” by “a former writer”. Billing records that tax law requires are kept with your account taken off them, and backups cycle out within 90 days.

9. Security

Our protections include the following:

• Passwords are hashed with Argon2.
• API keys are encrypted.
• All traffic uses HTTPS.
• Forms are protected against forgery.
• Login attempts and AI usage are rate-limited.

No system is perfectly secure. If we learn of a breach that affects your information, we'll tell you promptly.

10. Children

Synth isn't meant for children under 13, and we don't knowingly collect their personal information. If you believe a child under 13 has given us information, contact us and we'll delete it.

11. International users

Synth is run from the United States. If you use it from elsewhere, your information will be processed in the United States. The AI requests described in section 4 may also be processed in China.

12. Changes and contact

If we change this policy in a meaningful way, we'll show a notice on the site and update the date at the top. Questions or requests: [email protected].