Privacy notice
Last updated: 24 September 2026
In short: your AI provider logins and your files stay on your own computer. We keep your SYC-AI account and your session history so the panel works on every device. We do not sell data, show ads or use third-party analytics.
Who we are
SYC-AI is a product of SYC. Contact for anything about your data: syc@syc-ai.com.
What we collect and why
- Account — your email address (used for sign-up codes and account recovery), username and a salted scrypt hash of your password. We never store your password itself.
- Sign-in and security — session tokens (stored only as hashes), IP addresses of requests, kept to protect accounts (rate limits, abuse detection) and to fix problems.
- Connected devices — each device's name, platform, SYC Node version and last-seen time, plus a hash of its access token.
- Session history — the messages you send to your agents and their replies, stored on our servers so you can continue a session on another device. Replies can quote parts of your files. A per-account storage limit applies.
- Phone features — which kinds of messages you allow agents to send your phone, and the notifications, links or text that are sent there.
- Support — tickets and replies you write to us.
- Plan — your edition and its end date.
What stays on your computer
- Your logins with Anthropic, OpenAI and other AI providers — the providers' own CLIs keep them on your device.
- Your files and projects, and the commands the agents run.
- SYC Node's local activity log (
~/.syc-node/activity.log).
Who else processes data
- Brevo — delivers the sign-up and recovery codes we email you.
- Our hosting provider — runs the servers behind syc-ai.com.
- GitHub — hosts our public source code and releases.
- Your AI providers (for example Anthropic or OpenAI) — your device talks to them directly with your own account, under their terms and privacy policies.
How long we keep it
- Account, plan, devices and session history: while your account exists, or until you delete sessions or ask us to delete the account.
- Server logs: up to 30 days. A record of changes to your account (for security) is kept while the account exists.
- Encrypted backups: hourly copies for 3 days and daily copies for 14 days.
Your rights
You can download your account data from your profile (Account details → Download my data). You can ask us to correct or delete your data, or object to how we use it, by writing to syc@syc-ai.com. If you are in the EU or the UK you also have the right to complain to your data-protection authority.
Security
All traffic is encrypted (HTTPS). Passwords are hashed with scrypt; session and device tokens are stored only as hashes; backups are encrypted. SYC Node only starts the AI command-line tools you install, only reads and writes inside its own folder, and can be paused or removed at any time.
Security events: when a device refuses an attempt to access SYC-AI's own files, or an agent refuses a request aimed at SYC-AI itself or at something illegal, we record the time, the account, the device, the kind of event and a short description (at most 500 characters, such as the file path or the reason). We keep these records for 12 months to protect the service and review them only for that purpose.