ZYNC

Privacy Policy

Last updated: July 17, 2026

1. Introduction

This Privacy Policy explains what personal data ZYNC collects, why we hold it, how long we keep it, and what you can require of us. The controller of the data described here is [LEGAL ENTITY NAME], registered at [REGISTERED ADDRESS] ([COMPANY NUMBER]). Our representative for the purposes of Article 27 of the General Data Protection Regulation is [EU REPRESENTATIVE, OR STATE THAT NONE IS APPOINTED]. It applies to the ZYNC portal, the operator console, the Telegram Mini App, and this website. Where this policy and our published Terms of Service disagree, this policy governs questions of personal data.

2. Data We Collect

Information You Provide

  • Sign-in identity. Depending on the method you choose, this is an email address, a public wallet address you prove control of, or an account identifier and handle from a linked provider (Telegram, Farcaster, or X). We store an opaque reference to any provider credential rather than the credential itself.
  • Profile data you set: display name, avatar image URL, biography, handle, and language preference.
  • Wallet addresses you link, recorded per chain alongside the date you verified control of them.
  • Responses you enter into forms attached to a mission, and the mission and campaign activity those responses relate to.
  • Messages you send us for support, and identity or business verification material you submit if you request a withdrawal or operate as a sponsor.

Data Collected Automatically

  • Device and browser signals used to detect fraud and automated participation, retained per credential and used to score whether an account is operated by one real person.
  • Mission, reward, and ledger activity: what you completed, what it paid, and when.
  • Your IP address and browser details, written to a security log on authentication and privileged actions.
  • Data supplied by the Telegram SDK when you sign in through Telegram: your Telegram numeric identifier, first and last name, username, and photo URL.

Wallets, Custody, and Public Chain Data

Two different kinds of wallet are involved, and they are not treated alike. A wallet you connect yourself remains under your sole control: we receive its public address and a signature proving you hold it, never its private key or recovery phrase, and we never generate a recovery phrase for you. Separately, ZYNC operates a platform-controlled wallet that your rewards are credited to. We hold the keys to that wallet, its address is not shown to you, and it is used only to route rewards you have earned. We also operate platform treasury wallets that are not associated with any individual. Transactions settled on a public blockchain are visible to anyone and permanent; once a network records a transaction, neither you nor we can alter or remove it.

3. How We Use Your Data

  • To run your account and the Spaces you join.
  • To verify that a mission was completed and to pay the reward it earned.
  • To resolve one person across the providers they have linked, so that a single member is not counted as several.
  • To detect fraud, automated participation, and multiple accounts, and to enforce platform rules. This includes scoring device signals and inferring links between accounts, including whether accounts appear to belong to the same person, household, or organisation.
  • To send you service messages about your account, rewards, and security.
  • To understand how the platform is used and improve it, only where you have consented to product analytics.
  • To meet legal obligations, including anti-money-laundering, sanctions, and tax requirements connected to withdrawals.

5. Data Sharing

We do not sell personal data, and we do not share it for advertising. We run our own database, analytics store, cache, message broker, object storage, and job runner on infrastructure we control, so most processing involves no third party at all. Data reaches someone else only in these cases:

  • Infrastructure and service providers: Hetzner, a German company, hosts our servers; section 9 states where. When you sign in or act through a linked platform, that platform necessarily processes the interaction: Telegram for Telegram sign-in and bot messages, Neynar for Farcaster identity resolution, and Coinbase and WalletConnect for wallet connection. These providers act under our instructions where they process on our behalf, and as independent controllers where they operate their own platform.
  • Space operators: An operator running a Space you join can see your profile, your membership, your mission completions in that Space, and any form responses you submit to it. Operators cannot see your other Spaces, your platform-wide balances, or your verification material.
  • Legal and regulatory authorities: Where the law requires it, where we must establish or defend a legal claim, or to meet anti-money-laundering and sanctions obligations connected to a withdrawal.
  • Public blockchains: A settled transaction is broadcast to a public network and is visible permanently to anyone. This is a property of the network, not a disclosure we can withdraw.

6. Data Retention

We keep personal data for as long as your account is open, and after that only where a specific record has its own retention period. The periods below are the ones our systems actually enforce:

  • Account data: Held while your account is open. When you request erasure we apply a grace period, currently 7 days, during which you can cancel; the request must then complete within a service window, currently 30 days. Both periods are operator-set and may be shortened. Erasure runs as an ordered sequence across every system holding your data, and if any system reports a blocking obligation the erasure is deferred rather than partially applied.
  • Withdrawal and compliance records: Identity and business verification material connected to a withdrawal, and any sanctions or Travel Rule determination, are kept for as long as financial-crime law requires us to evidence the decision. Records that establish links between accounts are not deleted on request where we need them to meet anti-money-laundering obligations; they are marked revoked and retained.
  • Ledger entries: Entries in the value ledger are retained for the operating life of the ledger and are not routinely purged. They are the record of what was earned and paid, so erasure disconnects them from your identity rather than destroying them.
  • Analytics data: Product analytics reach our analytics store only if you have given consent. Once there, they are currently retained without a fixed expiry, and we do not represent that they are automatically anonymised after a set period. If you withdraw consent we stop the flow, and erasure anonymises your records in that store.
  • Audit and security logs: Audit logs are retained for 3 years. Authentication and security logs, including IP address, are retained for 90 days. Webhook delivery records are retained for 90 days.

7. Cookies and Tracking

We set no advertising cookies and no third-party tracking cookies, and we embed no third-party analytics or advertising script in any ZYNC application or on this website. The cookies we do set fall into two groups:

  • Strictly necessary: Your session, the short-lived state value that protects a sign-in redirect against forgery, and a referral attribution cookie recorded when you arrive through an invite. These cannot be turned off without breaking sign-in. Session cookies are scoped to the exact host you are signed in to and are never shared across Spaces.
  • Preference: Your language choice and the sign-in method you last used, so we can bring you back to it. These hold no identifier that tracks you across sites.

Your browser can block or clear any of these; blocking the strictly necessary ones will prevent sign-in. Product analytics are governed by a consent record on your account rather than a cookie, are off unless you turn them on, and remain off if we hold no record of your choice. We do not currently act on the Do Not Track browser signal, because we operate no cross-site tracking for it to disable.

8. Your Rights

Under GDPR and applicable laws, you have the right to:

  • Access: Request a copy of your personal data
  • Rectification: Correct inaccurate or incomplete data
  • Erasure: Request deletion of your data ("right to be forgotten")
  • Restriction: Limit how we process your data
  • Portability: Receive a machine-readable export of your data. The export is assembled as one bundle, made available to you once, and then deleted, currently within 24 hours and never later than 7 days. Ledger and withdrawal records are excluded from the portable export because we retain them under a legal obligation rather than your consent; you can still request access to them.
  • Objection: Object to processing we base on legitimate interest. We will stop unless we can show compelling grounds that override your objection, which for fraud prevention and account-integrity signals we generally can.
  • Withdraw consent: Withdraw consent at any time where processing is based on it, including product analytics. Withdrawal does not undo processing already carried out.

To exercise any of these rights, contact privacy@zyncd.in. We will respond within 30 days of the request taking effect. An erasure request first passes a cancellation grace period, currently 7 days, so an erasure you do not cancel completes within roughly 37 days of the day you ask. Some rights are limited where they collide with a legal obligation or with a permanent blockchain record, and we will tell you which limitation applies rather than silently ignore part of the request. You also have the right to complain to your local supervisory authority.

9. International Data Transfers

Our servers are operated by Hetzner and are located in [HOSTING REGION — CONFIRM THE PROVISIONED REGION BEFORE PUBLICATION]. Personal data leaves that infrastructure only through the specific providers named in section 5. Where one of those providers processes personal data outside the European Economic Area, that transfer relies on the safeguards in Article 46 of the GDPR, which for our providers means the European Commission's Standard Contractual Clauses or an adequacy decision covering the destination. [CONFIRM THE EXECUTED TRANSFER MECHANISM WITH EACH PROVIDER BEFORE PUBLICATION.] You can request details of the safeguard applied to a particular provider by writing to privacy@zyncd.in.

10. Children's Privacy

ZYNC is for adults. You must be 18 or older to hold an account, and the Services are not directed at children. We do not ask for your date of birth and we do not operate an age-verification check, so we rely on the representation you make when you accept the Terms of Service. If we learn that an account belongs to someone under 18 we will close it and delete the personal data we hold for it. If you believe a child holds an account, write to privacy@zyncd.in and we will act on it.

11. Security

We protect your data with encryption in transit, row-level access rules enforced by the database itself rather than by application code alone, least-privilege service credentials, secrets held in a dedicated secret store, and an append-only audit log of privileged actions. Access to production data is restricted to the people who need it to operate the platform. No system is immune to compromise; if a breach affects your personal data and is likely to present a risk to you, we will notify the competent supervisory authority within 72 hours of becoming aware of it and inform you where the law requires.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated through the platform, email, or a prominent notice on our website. We encourage you to review this policy periodically.

13. Contact

For privacy inquiries or to exercise your rights, contact us at: