Privacy policy

Effective October 29, 2026. Contact support@cynch.fm for privacy requests.

What we collect

Account name and email, verification status, organization names and memberships, invitations, legal acceptance version, uploaded files and pasted emails, plan and payment preferences, and messages you send to support. We also use short-lived hashed anti-abuse counters. Do not submit health records, patient data, passwords, or payment card numbers.

Why and where

We use this information to authenticate you, provide organization-scoped onboarding, deliver requested verification and invitation emails, support your team, and protect the service. Cloudflare provides hosting, D1 database storage, private R2 file storage, and email delivery. Your email provider also processes messages delivered to you. No AI model processing is enabled for onboarding submissions in this release.

Access and sharing

Members can see their organization’s onboarding submissions and team. Admins can manage invitations, roles, and service preferences. Designated Cynch super admins can access all organizations and the support inbox. Incoming support mail is available to those super admins; sending an email does not automatically create an organization or authorize access. We do not sell onboarding data or use it for advertising.

Cookies and logs

The app sets only the essential cfm_session sign-in cookie, with Secure, HttpOnly, and SameSite=Lax protections, for up to seven days. No advertising or behavioral analytics integrations are installed. Cloudflare may process technical request, delivery, abuse, and security logs to operate its services. We avoid logging raw files, email bodies, sign-in links, and session values.

Retention and control

Verification links expire after twenty minutes and are single-use. Expired tokens, sessions, and anti-abuse counters are removed by scheduled cleanup. Account, organization, original submissions, and support records are retained for onboarding and support until deletion is requested or the service is closed, subject to legal retention needs. A self-service deletion tool is not yet available. Contact support from your verified account to request access, correction, export, or deletion.

Early-service boundaries

This is a professional service for adults, not directed to children. No promise of regulatory certification, special-category data handling, or a business associate agreement is made. We will update disclosures before introducing AI providers, new integrations, or paid billing.