Privacy
Policy

1. Who we are

SYNC (“we”, “us”) is a dating app for gay, bi and queer men. SYNC is operated from Melbourne, Australia by Diarmuid Dunne. We are the entity responsible for the personal information handled through the SYNC website and app.

You can reach us about anything in this policy at privacy@syncdatingapp.com.

2. Who this policy covers

This policy covers everyone who uses SYNC, wherever you are. Australian privacy law is our primary regime. If you’re in the EU, the EEA or the UK, the GDPR also applies to you — see section 16.

SYNC is strictly 18+. We ask for your date of birth when you sign up and check your age on our servers, not in the app. If you’re under 18 you’re blocked and no profile is created for you. We don’t knowingly collect information about anyone under 18. If you believe a minor has an account, email us immediately at privacy@syncdatingapp.com and we’ll act on it.

3. What we collect

Your account

• Email address and password (we store a hash of your password, never the password itself)
• Date of birth — used to confirm you’re 18 or over, and to show your age on your profile

Your profile

• Display name, bio and tagline
• Tags you pick (interests, identity, lifestyle)
• Which intent mode you’re in
• Photos: your profile photos (public and private albums are switched off during the beta)

What you do on SYNC

• Messages and conversations, including the Reveal level a conversation has reached
• Who you’ve favourited, blocked or reported
• Trust signals that help our moderators, such as whether you’ve confirmed your age, completed your profile, or been reported, and an energy counter used by wellbeing features that aren’t shown during the beta

Location

• Your coordinates, when you use location-based discovery. How this works, and what other people can and can’t see, is in section 5 — it matters, so please read it.

Technical information

• Our hosting and database providers keep short-term server logs that include IP addresses, device and browser type, and the time of a request. We use these to keep the service running and to investigate abuse.

Payments

We don’t currently take payments and we don’t collect or store card details. If we add paid features, we’ll use a payment provider that handles card data itself, and we’ll update this policy before that goes live.

4. Sexual orientation is sensitive information

Under the Privacy Act, information about a person’s sexual orientation is sensitive information, and it gets a higher standard of protection than ordinary personal information. We can only collect it with your consent, and only where it’s reasonably necessary for what we do.

SYNC is a dating app for gay, bi and queer men, so by creating a profile you’re telling us something about your sexual orientation. You give that consent knowingly when you sign up, and you can withdraw it by deleting your account.

We treat it accordingly. It’s used to run the service and nothing else. It is not sold, not shared with advertisers, and not used to build a profile of you for anyone outside SYNC. Access inside our systems is restricted to what the service actually needs — the database is set up so one user account cannot read another user’s email address, date of birth or coordinates, and staff access is limited to the moderation tools.

We know what’s at stake here. For a lot of our users, being identified as a SYNC member is the risk, not the data inside the profile. That shapes how the product is built.

5. Your location

SYNC shows you people near you, so we need to know roughly where you are. Here is exactly what happens.

• When you use location-based discovery, your device sends your coordinates to our server, and we store them against your profile.
• Your precise coordinates are never shown to another user. They aren’t sent to anyone else’s device at all. Our database blocks other user accounts from reading those fields.
• What other people see is a position snapped to a grid of roughly 550 metres, with a small fixed offset unique to your profile. Your pin sits somewhere inside that square rather than on your front door.
• The snapping happens on our server, inside the query that builds the map — not as a blur drawn by the app. That matters: it means it holds even for someone talking to our API directly instead of using the app.
• We keep only your most recent position. It’s overwritten each time it updates. We don’t build a location history or a movement trail.
• We don’t collect location in the background, and we don’t take location from any other app on your device.
• You can turn location off. If you do, you won’t appear on the map.

6. Your photos and the Reveal

Photos live in three places, and they behave differently.

• Profile photo and public album — visible to people who can see your profile.
• Private album — stays locked. It never opens on its own: only you, the owner of the album, can unlock it, one conversation at a time, and you can lock it again whenever you like.

The private album rule is enforced on our servers, not in the app’s interface. The unblurred file is only handed out through a short-lived signed link, and only after the server has checked that you, the owner, have unlocked your album for that conversation. Copying an image link, or querying our API directly, doesn’t get around it.

Unlocking is per conversation. Unlocking your private album for one person doesn’t unlock it for anyone else.

7. Child safety and image scanning

There is no version of SYNC where child sexual abuse material is tolerated.

• Every photo uploaded to SYNC goes through automated image moderation (Amazon Rekognition), which holds back images that break our rules.
• Reports from users are reviewed by a person.
• Child sexual abuse material means the account is suspended immediately and permanently.
• We preserve the evidence without viewing or sharing it, and report it to Australian law enforcement together with the account and technical details we’re required to provide.
• Images flagged as suspected child abuse material are never displayed in our moderation tools.

We’ll also preserve and disclose account information where we’re legally required to, or where it’s necessary to prevent serious harm to someone.

8. Why we collect it

• To run your account and let you sign in
• To show you other people and show you to them, based on intent, tags and rough distance
• To carry your messages
• To enforce the Reveal, so your private album stays private
• To generate AI Wingman suggestions, if we switch that feature on (it’s off during the beta)
• To work out trust signals that help our moderators prioritise
• To keep people safe: age checks, image moderation, blocking, reports and moderation
• To detect and stop fraud, spam and abuse
• To fix things when they break
• To meet our legal obligations and respond to lawful requests

We do not use your data for advertising. SYNC has no ad model. We do not sell personal information, and we don’t disclose it for anyone else’s marketing.

9. Who we share it with

We share personal information only with the service providers we need to run SYNC:

• Supabase — our database, sign-in system and photo storage. Almost everything we hold about you lives here.
• Vercel — hosting for the website, the app and our server code.
• Resend — transactional email, such as sign-in and account notices.
• OpenRouter — routes AI Wingman requests to a language model. Not used during the beta. If the feature is switched on, these calls are made from our server, never from your device, and carry the conversation context needed to produce a suggestion.
• Amazon Web Services (Rekognition) — automated screening of uploaded images, and the optional selfie check that compares your selfie with your profile photo.
• PostHog — product analytics: which screens are used and where people drop out of sign-up, tied to a random account identifier. We don’t send your messages, photos or precise location to it.
• OneSignal — delivers push notifications to your device if you turn them on. It holds your account identifier and device push token.
• Sentry — error reports when the app crashes or something fails, so we can fix it. Reports carry technical details and can include your account identifier.

We choose providers that are contractually committed to handling data only on our instructions and not for their own purposes. We also disclose information where we’re required to by law, in response to a valid legal request, or where it’s necessary to prevent a serious threat to someone’s life, health or safety.

10. Where your data is stored, and going overseas

Australian Privacy Principle 8 requires us to tell you when your personal information is disclosed overseas. It is.

• Our database, sign-in system and photo storage are hosted by Supabase in Frankfurt, Germany. Your profile, photos, messages and location are stored there, not in Australia.
• Image screening and the selfie check run on Amazon Web Services in the United States (Northern Virginia).
• Product analytics (PostHog) and push notifications (OneSignal) are processed in the United States.
• Our other providers — Vercel, Resend, Sentry and OpenRouter — process data in a range of locations, which may include the United States and the European Union.

Before we disclose personal information overseas we take reasonable steps to make sure the recipient handles it in a way consistent with the Australian Privacy Principles. Germany is subject to the EU GDPR, which is a comparable regime. Where a provider operates somewhere without comparable protection, we rely on our contract with them.

Storing data overseas doesn’t reduce your rights. We remain accountable to you under Australian law wherever the data physically sits.

11. Keeping it secure

We take reasonable steps to protect your information from misuse, loss and unauthorised access. In practice that means: data encrypted in transit and at rest by our providers; database rules that stop one user account reading another user’s email address, date of birth or precise coordinates; the Reveal enforced on the server; private photos served only through short-lived signed links; and administrative access restricted to the moderation tools, with every action logged.

We’re a small team and we’re not going to pretend otherwise. No system is perfectly secure, and we don’t claim certifications we don’t hold. What we do commit to is fixing problems fast and telling you when something goes wrong.

12. If there’s a data breach

We’re covered by the Notifiable Data Breaches scheme in Part IIIC of the Privacy Act.

If personal information we hold is lost, or accessed or disclosed without authorisation, and that’s likely to result in serious harm to you, we will:

• assess what happened promptly — within 30 days of becoming aware of it, as the Act requires, and faster than that wherever we can;
• notify the Office of the Australian Information Commissioner (OAIC) as soon as practicable; and
• notify you directly — what happened, what information was involved, and what you should do about it.

Given what SYNC is, we treat any incident that could out someone as serious harm by default.

13. How long we keep it, and deleting your account

• While your account is open, we keep your data so the service works.
• You can delete your account at any time in Settings. That starts a cooling-off period. During it your profile is hidden from everyone, and you can cancel and come back.
• Once the cooling-off period ends, your account is permanently deleted — profile, photos, location and account record.
• Your messages are anonymised rather than deleted. The other person keeps their side of the conversation, with you shown as a deleted user. We do this so that deleting your account doesn’t break or erase someone else’s conversation history.
• Short-term server logs are kept by our hosting providers under their own retention policies.
• Safety and moderation records — including reports, moderation decisions and child-safety records — may be kept for longer where the law requires it, or where we need them to defend a legal claim.

14. Your rights

Under the Australian Privacy Principles you have the right to:

• Access the personal information we hold about you (APP 12). Settings → Export my data gives you a machine-readable file, or email us.
• Correct anything inaccurate, out of date or misleading (APP 13). Most of it you can edit in your profile; email us for anything you can’t.
• Delete your account and your data (section 13).
• Take your data with you — the export is JSON, a format you can reuse.
• Withdraw consent — turn location off, turn the AI Wingman off, or delete your account. Some things are core to the service, so withdrawing consent for them may mean we can’t keep providing it to you.
• Complain — see section 15.

We’ll respond to an access or correction request within 30 days, which is what the Privacy Act requires, and usually much sooner. We don’t charge for access. We may need to confirm you’re the account holder first. If we refuse a request, we’ll tell you why in writing and how to complain about it.

15. Complaints

Come to us first. Email privacy@syncdatingapp.com with “Privacy complaint” in the subject line and tell us what happened. We’ll acknowledge it within 5 business days and give you a written answer within 30 days.

If you’re not satisfied — or we don’t get back to you — you can take it to the Office of the Australian Information Commissioner (OAIC), the regulator for the Privacy Act. The OAIC can investigate and can require us to act. Details on how to complain are at oaic.gov.au. The OAIC will normally expect you to have complained to us first and given us a chance to fix it.

16. If you’re in the EU, the EEA or the UK

The GDPR (and the UK GDPR) applies to you as well, and we honour it.

Our legal bases

• Contract — running your account, discovery, messaging.
• Consent — information revealing sexual orientation, location, optional analytics and marketing email. You can withdraw consent at any time.
• Legitimate interests — safety, moderation, preventing fraud and abuse, keeping the service working.
• Legal obligation — child-safety scanning and reporting, and responding to lawful requests.

Special category data

Information revealing sexual orientation is special category data under Article 9. We rely on your explicit consent, given when you create a SYNC profile.

Your GDPR rights

Access, rectification, erasure, restriction of processing, objection, and data portability. You also have the right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects — we don’t make decisions like that about you.

Transfers

Where personal data moves out of the EEA or the UK, we rely on the European Commission’s standard contractual clauses or on an adequacy decision.

Complaints

You can complain to us first, and you can lodge a complaint with the data protection supervisory authority in your country.

17. Cookies and local storage

The website and the app use cookies and similar browser storage.

• Essential — keeping you signed in and keeping the service secure. These can’t be turned off.
• Optional analytics — only set if you accept them in the banner, and used to understand which pages work. Not used for advertising and not shared for cross-site tracking.

We don’t use advertising cookies, because SYNC has no advertising.

18. Changes to this policy

If we make a material change we’ll tell you by email or in the app before it takes effect. The date at the top of this page always shows the current version.

19. Contact us

Privacy questions, requests and complaints: privacy@syncdatingapp.com

Legal notices: legal@syncdatingapp.com

SYNC is operated from Melbourne, Australia.