Privacy policy
Last updated 2 September 2026
This policy explains how Syncs collects, uses, and protects your information when you use the app, API, and console at console.syncs.co.za, or the public website at syncs.co.za.
Data we collect
We collect the details you give us and the data created when you use the service:
- Account: name, email address, password (stored as a hash), and optional business name and VAT number. We do not ask for a phone number.
- Receipts: photos or PDFs you upload, merchant names, amounts, VAT, dates, payment method, card type if it appears on the slip, invoice numbers, notes, categories, and whether a slip is personal or business.
- Location: only if a receipt is saved with GPS coordinates.
- Connected email: if you link Gmail, Outlook, or IMAP, we store the mailbox address, encrypted access tokens, and imported message details (subject, sender, date) plus attachments that look like receipts.
- Workspace sharing: names and email addresses of people you invite.
- Device: a signed-in app token, and a random app-install identifier used only to stop abuse (it is not an advertising ID). Biometric unlock stays on your device and is not sent to us.
- Technical: IP address (resolved to a country, not a street address, for visitor analytics and abuse prevention), app or browser type, pages viewed on our sites, and server logs used for security, rate limiting, and product operations.
Why we use it
- Create and secure your account, including email verification.
- Read slips with AI, organise receipts, suppliers, VAT, and reports.
- Import e-receipts if you connect a mailbox.
- Let you share a workspace with members you invite.
- Send service email (welcome, verification, workspace invites, account deletion).
- Protect the service from abuse.
We do not sell your data, and we do not use it for advertising or newsletters beyond these service messages.
Third-party sharing
We only share data with the tools needed to run the product:
- Google Gemini: receipt images or extracted text, so the slip can be read.
- Google: if you connect Gmail, so we can import receipts you authorise.
- Microsoft: if you connect Outlook, for the same purpose.
- Syncs hosting and mail: the servers and mailbox (noreply@syncs.co.za) that run the app and send mail.
We do not use payment companies or ad networks in this app.
Cookies
The website uses a session cookie to keep you signed in in the browser, a CSRF token to protect forms, and a first-party visitor cookie so we can see how the public site, console, and account pages are used. These are not advertising cookies.
The mobile app stores a sign-in token on the device. It does not use tracking cookies.
Data security
- Connections use HTTPS.
- Passwords are hashed, not stored in plain text.
- Mailbox tokens are encrypted at rest.
- Your receipts are limited to your account, or to members you choose to share with.
No system is perfectly secure. If we become aware of a breach that affects you, we will take reasonable steps to contain it and notify you where the law requires.
Your rights
You can view and update your profile, export receipts, and delete your account in Settings. That permanently removes your account, receipts, and related data. If you cannot sign in, request deletion here. You can also email us to ask for a copy of your personal data, a correction, or deletion. If you are in South Africa, you have rights under POPIA and may contact the Information Regulator.
Contact
Privacy questions: noreply@syncs.co.za
Syncs
https://syncs.co.za · https://console.syncs.co.za