Privacy Policy
Effective Date: September 17, 2026 · Version 1.1
1. Overview and Scope
Synkk is operated by Ottomate ("we", "us", or "our"). This Privacy Policy explains how we collect, handle, protect, and process data when you interact with our websites (synkk.space), our managed cloud services (Synkk Cloud), and our synchronization software including the official Synkk Obsidian Plugin.
2. Controller vs. Processor Roles
Self-Hosted Deployments (Synkk Community & Self-Host Pro LTD): When you self-host the Synkk server via Docker or on your own infrastructure, you control that deployment and its data-processing configuration. Synkk does not send product telemetry to Ottomate by default. Data can leave your infrastructure when you configure external services such as payment, licensing, email, edge-network, or AI providers.
Synkk Cloud (Managed SaaS): When you use our hosted workspaces, you remain the Data Controller of your vault content. Ottomate acts as a Data Processor under GDPR Article 28, operating strictly on your documented instructions.
3. Zero-Knowledge Encryption (E2EE)
When you enable End-to-End Encryption (E2EE) on a vault, all notes, frontmatter, and attachments are encrypted directly on your local client device using AES-256-GCM with 100,000 PBKDF2 iterations via the standard WebCrypto API before network transmission. Master passphrases are kept in ephemeral memory and are never saved to disk or transmitted to our servers. Synkk Cloud servers only ever store and relay opaque binary ciphertext blobs.
4. Data We Collect and Why
- Account Identification: Name, email address, and argon2id-hashed passwords for authentication and account recovery.
- Payment Information: Subscription and license transactions are processed through our Merchant of Record, Dodo Payments Inc. Ottomate does not collect, process, or store payment card numbers or banking credentials.
- Device Tokens & Pairing Telemetry: Cryptographically generated high-entropy bearer tokens (`synkk_live_...`) to authorize individual Obsidian client devices and enforce team access permissions.
- System Logs: HTTP access and security logs may include IP addresses, request timestamps, and user-agent information. Retention is limited according to the documented production policy and infrastructure configuration.
- Optional AI Processing: Vault excerpts and prompts are sent to an external AI provider only when an operator configures that provider and enables the applicable RAG workflow. End-to-end encrypted vault content cannot be processed by server-side RAG while it remains encrypted.
5. Cookies and Tracking
Synkk does not use third-party tracking pixels, advertising cookies, or behavioral analytics cookies. We use only strictly necessary first-party HTTP-only session cookies (`synkk_session`, CSRF validation tokens, and portal password unlock grants) required for authentication and security.
6. Third-Party Subprocessors
For Synkk Cloud customers, we utilize the following infrastructure and service providers:
| Subprocessor | Purpose | Location |
|---|---|---|
| Hetzner Online GmbH | Core Cloud Server & Encrypted Storage Hosting | European Union (Germany) |
| OpenAI, L.L.C. (optional) | AI response generation only when an operator configures an OpenAI API key | United States / provider-selected processing regions |
| Dodo Payments Inc. | Payment Processing & Tax Compliance (Merchant of Record) | United States / Global |
| Cloudflare, Inc. | Edge Network, DDoS Shield & TLS Termination | Global Anycast Network |
7. Data Retention & Deletion Rights
Deletion removes or deactivates data from active production systems according to the product workflow and the documented retention schedule. Residual encrypted backups and security logs may persist for a limited period before scheduled expiry. Under the GDPR, CCPA, and applicable laws, you retain the right to:
- Request a portable export of your account and team data.
- Request immediate and irreversible deletion of your account and personal identifiers.
- Restrict or object to processing of personal data.
8. Privacy Contacts
For privacy inquiries, Data Processing Agreement (DPA) inquiries, or data subject access requests (DSAR), contact our Data Protection Office at: privacy@synkk.space.