Know what is processed.

Desktop projects and remote AICopy Anchor Link

Engineering projects, conversations, drafts and isolated candidates are stored by the desktop application. When you use remote AI, messages, selected or automatically captured context, attachments and tool results may be sent through SynthCrew to the configured provider. The model does not run locally. Do not submit restricted material without authorization.

Candidate isolation and reviewed Apply control promotion to originals. Full Access can permit broad local execution outside that candidate; it is not a sandbox.

Website accountsCopy Anchor Link

The website uses self-hosted Better Auth with Google or GitHub authorization. The selected provider processes your sign-in and returns identity information. SynthCrew stores account identity and linked-provider records, encrypted OAuth tokens, website sessions and the information needed to authenticate service requests. Matching email alone does not link identities.

The server also records workspace membership, hashed desktop credentials and expiry, billing identifiers, usage reservations, token/cost accounting and support requests. Stripe processes billing when payments are enabled. Customer engineering AI uses OpenAI when enabled. Those commercial gates remain closed.

Email and support conversationsCopy Anchor Link

Support mail is routed through Cloudflare and recorded in a SynthCrew support inbox. Existing company forwarding is preserved. Web requests are associated with the signed-in account; email conversations retain sender, subject, message text, timestamps, routing category and delivery state. Original attachments remain in the forwarded company mailbox; they are not executed or automatically supplied to the email AI.

Simple product FAQs sent to support may be processed by a separately configured OpenAI service using the plain message text and public documentation. Responses are labelled automated. Billing, privacy, security, legal, account-access and uncertain cases require human review. Do not send passwords, tokens or confidential projects. The model has no account-modification, engineering or billing tools.

Support AI requests disable provider response storage through the API setting. That is not a claim that the provider or infrastructure keeps no logs or has zero retention. Provider agreements and operational policies remain separate.

Storage and accessCopy Anchor Link

Website sessions use secure cookies; see the cookie and storage notice for source-derived defaults and their limits. Desktop credentials use Windows DPAPI or Linux Secret Service where supported. Revoking a desktop stops future authenticated access; it does not erase local project files.

Support history is restricted to its requester and explicitly authorized SynthCrew operators. Being an owner of a customer workspace does not grant access to the staff inbox. Operational logs must not intentionally contain credentials or full support payloads.

Retention and requestsCopy Anchor Link

Do not assume automatic deletion of correspondence, backups, billing records or provider logs. Complete retention periods, processing locations and legal/controller details have not yet been established as a commercial policy. This page does not claim regulatory certification or that all obligations are satisfied.

For access, correction, deletion or other privacy questions, use the privacy contact in the contact directory. We may need to verify the requester's authority before changing or disclosing records. Do not email identity documents or credentials unless a separately agreed secure process is established.

Account email and company enquiriesCopy Anchor Link

If email/password access is enabled, the authentication system stores a password hash, verification/recovery records and website sessions; it does not store a readable password. Transactional messages pass through the configured mail service. Verification or recovery links are credentials: do not share them. Google/GitHub sign-in remains separate from any permission to read your engineering files.

The public company enquiry form records the submitted name, email, optional company details, message, timestamp and abuse-prevention hashes for SynthCrew staff review. It does not verify ownership of the sender address, join accounts or opt you into marketing. Do not submit confidential CAD, passwords, API keys or unnecessary personal information. Use the privacy contact procedure above to ask about your records. No new retention guarantee or international-transfer assurance is implied.