Privacy Policy
Last updated: June 20, 2026
This Privacy Policy explains how SyncFiction processes your personal data in accordance with the EU General Data Protection Regulation (DSGVO), the German Federal Data Protection Act (BDSG), and the German Telecommunications Digital Services Data Protection Act (TDDDG).
Controller
The controller within the meaning of Art. 4(7) DSGVO is:
Email: privacy@syncfiction.com
A Data Protection Officer is not required, as the statutory appointment requirements under BDSG §38 are not met at present.
Legal Bases for Processing
Art. 6(1)(b) DSGVO — Performance of a contract
The following activities are necessary to provide the service you sign up for, including the AI-assisted reading features described in our Terms of Service. Where a stricter reading of "necessity" applies to any of them, we additionally rely on our legitimate interests (Art. 6(1)(f)).
| Processing activity | Data categories |
|---|---|
| Account creation and management | Account identifiers (name, email) |
| Adding fictions to your library and keeping them in sync | Library data |
| Generating EPUB files and delivering them to you | Content data, delivery details |
| AI features you actively request (semantic search, summaries, character information, recaps, chat) | Your requests, library content, chat messages |
| Storing your reading progress and preferences | Reading progress, settings |
Art. 6(1)(f) DSGVO — Legitimate interests
| Processing activity | Legitimate interest |
|---|---|
| Preparing content for the AI features (text processing, generating embeddings, extracting characters and metadata), including content and names that originate from third-party sources | Providing and improving the reading and AI features |
| Securing the service, preventing abuse, and enforcing rate limits and fair-use quotas | Security and fair use of shared resources |
| Operational logging and error diagnostics, where enabled | Service stability and troubleshooting |
You have the right to object to processing based on legitimate interests (see Right to Object below).
Art. 6(1)(a) DSGVO — Consent
| Processing activity | Notes |
|---|---|
| Connecting a file-storage provider for delivery | You initiate the connection; revocable at any time in settings |
| Providing a delivery email address | You provide the address; removable at any time in settings |
Art. 6(1)(c) DSGVO — Legal obligation
We may process data where required to comply with applicable legal obligations.
Obligation to provide data (Art. 13(2)(e) DSGVO)
Providing your account data (email, authentication identifier) is a contractual requirement necessary to use SyncFiction. You are not legally obliged to provide it, but without it the service cannot be provided. Connecting a delivery provider and a delivery email address are optional.
Automated decision-making (Art. 13(2)(f) DSGVO)
We do not carry out automated individual decision-making or profiling within the meaning of Art. 22 DSGVO.
Where the Content Comes From
Some of the content we process does not come from you directly. When you add a fiction to your library, we retrieve that fiction and related information — including the author's chosen public name — from the public source on which it is published. We process this information on the basis of our legitimate interest in providing the reading and AI features (Art. 6(1)(f) DSGVO). Affected persons can object as described below.
Recipients
We use a small number of carefully selected service providers who process data on our behalf and on our instructions, and who receive only the data needed for their function. We do not sell your personal data and do not use it for advertising. The categories of recipients are:
| Category of recipient | Location | Purpose |
|---|---|---|
| Authentication and user-management provider | USA | Secure login and account management |
| Cloud infrastructure provider (hosting and edge compute, object and vector storage, caching, job queues, real-time messaging) | USA (served from a global edge network) | Running the application and storing files and data |
| Managed database provider | US company | Primary data store |
| AI / language-model providers | USA | Generating embeddings and the AI reading features |
| Email-delivery provider | EU | Sending EPUBs by email |
| File-storage provider you connect | USA | Optional delivery to your own storage |
| Application-logging provider, where enabled | USA | Diagnostics and abuse prevention |
On request, we will tell you which specific providers we use. We may also disclose data where required by law or in response to a valid legal request from a competent authority.
International Transfers
Several of our providers are based in the United States or may process data there. Where personal data is transferred outside the EU/EEA, we rely on appropriate safeguards under Chapter V DSGVO: either the EU-U.S. Data Privacy Framework (Art. 45 DSGVO) where the provider is certified under it, or the EU Standard Contractual Clauses (Art. 46(2)(c) DSGVO) where it is not. Some processing — such as email delivery — takes place within the EU. You may request a copy of the applicable safeguards at any time by contacting us.
Cookies
SyncFiction uses only strictly necessary, first-party cookies: cookies set by our authentication provider to keep you securely signed in and to manage your session, and a preference cookie that remembers basic settings such as your theme. We do not use tracking, advertising, or analytics cookies, and we therefore do not display a cookie banner.
These cookies are strictly necessary for the operation of the service and are exempt from consent under §25(2) TDDDG; the associated processing is based on Art. 6(1)(b) and (f) DSGVO.
Data Retention
We keep personal data only for as long as necessary for the purposes described above:
| Data category | Retention criterion |
|---|---|
| Account data, library, reading progress, settings, account tier | For as long as your account exists |
| Provider connections (file storage, delivery email) | Until you disconnect them or delete your account |
| AI chat history | For as long as your account exists, unless you delete it earlier |
| Files you upload yourself (your private EPUBs and any covers extracted from them) | Deleted when you remove them or when you close your account |
| Shared library files generated from public sources (EPUBs and cover images, e.g. from Royal Road) | Kept as a shared library resource, independently of any individual account |
| Temporary caches, counters, and queue data | Short-lived; expires automatically (typically minutes to hours) |
| Operational logs, where enabled | Kept only for a short, limited period |
| Database backups | Retained for our provider's short default cycle, then overwritten |
When you delete your account, your account data is removed from our database and any files you uploaded yourself are deleted. Library files we generate from publicly available sources (such as Royal Road) are general library content, not your personal data, and remain available to all users. Where we are legally required to retain certain data (for example under tax or commercial law), we keep it for the applicable statutory period. Content and metadata obtained from public third-party sources may be retained independently of your account on the basis of Art. 6(1)(f) and Art. 17(3)(a) DSGVO (freedom of expression and information).
Right to Object (Art. 21 DSGVO)
You have the right to object at any time, on grounds relating to your particular situation, to processing of your personal data based on Art. 6(1)(f) DSGVO (legitimate interests). If you object, we will cease processing unless we demonstrate compelling legitimate grounds that override your interests, rights, and freedoms, or the processing serves the establishment, exercise, or defence of legal claims.
To object, contact us at privacy@syncfiction.com.
Your Rights
Under the DSGVO, you have the following rights:
- •Access (Art. 15) — request a copy of the personal data we hold about you, including the specific recipients to whom it has been disclosed
- •Rectification (Art. 16) — request correction of inaccurate personal data
- •Erasure (Art. 17) — request deletion of your personal data, subject to legal retention obligations and where no overriding legitimate grounds exist
- •Restriction of processing (Art. 18) — request that we restrict processing under certain circumstances
- •Data portability (Art. 20) — receive the personal data you provided to us in a structured, commonly used, machine-readable format. This applies only to data you directly provided and that we process on the basis of contract or consent. It does not cover derived or generated data such as AI outputs, embeddings, or recommendations.
- •Withdraw consent (Art. 7(3)) — where processing is based on your consent, you may withdraw it at any time via the same means you used to grant it (e.g., in your settings) or by contacting us. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
- •Lodge a complaint (Art. 77) — you have the right to lodge a complaint with a supervisory authority, in particular in the EU Member State of your habitual residence, place of work, or place of the alleged infringement
To exercise any of these rights, contact us at privacy@syncfiction.com. We will respond within one month. In cases of particular complexity, this period may be extended by a further two months, in which case we will inform you.
Minors
SyncFiction is not directed at children. Where we rely on consent for a service offered directly to a child, that consent is valid only from the age of 16, in line with Art. 8 DSGVO as applied in Germany. We do not knowingly collect personal data from children under 16. If you believe a child has provided us with personal data, please contact us and we will delete it.
Changes to This Policy
We may update this Privacy Policy from time to time. Material changes will be communicated through the application.