Privacy Policy

Syft reads your file in your browser and keeps your content library in your browser's own storage, not on our servers. Syft Detect uses our servers: the text needed for detection is sent once, analysed, and deleted shortly after the result reaches the Syft workspace. It is never used to train a model or shared with anyone. Using the workspace requires a Syft account, which tells us who you are, not what you inspect. A small number of clearly labelled actions also use our servers, and this page lists exactly what each one sends and why.

• Content you add to Syft (text, documents, images, code) and the findings of the standard scan. These are stored in your browser (IndexedDB) and never transmitted by the ordinary scan.
• Your Recent items, Library, per-finding assessments and scan history.

Clearing your browser storage removes this data; we cannot recover it, because we never had it.

• Account data. The Syft workspace requires an account (the free AI check on our website runs without one, and a free account is required to view and keep its result). We hold your email address, sign-in records, plan and usage counters. The account database holds no document content.
• Public AI check. When you run the AI check on our website, the text you pasted and its result are sent to our server once, encrypted at rest, and held only until you open them from your account or until they expire unopened. They are then deleted. They are not shared, not used for training, and not sent to analytics.
• AI analysis of your text. Syft no longer sends your text to any outside AI-detection company. The external provider that previously produced those readings was removed on 4 October 2026, and no third party receives your text for AI analysis. If that ever changes, this page and its date change with it before any text goes anywhere.
• Deep metadata inspection and PDF cleaning (explicit). When you press those buttons, the file is uploaded, processed on our server, and the temporary copy is deleted immediately after. It is not sent to any third party.
• Connections. If you connect Google Drive, Dropbox, GitHub or Notion, we store the OAuth tokens for your connection encrypted at rest. For Google Drive and Dropbox, file bytes flow directly from the provider to your browser without passing through our servers. For GitHub and Notion the provider offers no such path, so the file or page you open is relayed through our server to your browser and is not stored there.

• Google, Dropbox, GitHub, Notion: only if you connect them, under the scopes shown on each provider’s consent screen and repeated on its connection page in Syft.
• Stripe: payment processing for paid plans. We never see or store card numbers.
• Resend: delivers our transactional email (verification and password-reset messages) to your address.
• Sentry: error reports when something in Syft breaks. Reports carry the technical error and the route it happened on, and are stripped of your identity, cookies, request contents and document content before they leave.
• Railway (hosting) and Google Workspace (our own mailboxes) as infrastructure.

We do not run advertising, we do not sell or share your data for advertising, and we do not use your content to train models.

• Session cookie. When you sign in, one HttpOnly, Secure cookie identifies your session for up to 30 days. It is strictly necessary for accounts and carries no tracking.
• Short-lived flow cookies. Connecting a provider sets a ten-minute HttpOnly cookie that protects the OAuth round-trip. It does not identify you across sites.
• Browser storage. Your library, findings and per-device preferences live in this browser’s IndexedDB and localStorage, as described above. They are not cookies and are never sent to us.
• No tracking. We set no advertising or analytics cookies and load no third-party trackers, so there is no consent banner: everything we store in your browser is either essential to a feature you used or is your own content library.

Syft’s servers run on Railway in the United States, and the providers above (Stripe, Resend, Sentry) process data in the United States or in the regions they operate. If you use Syft from outside the United States, the account data and the uploads described on this page are transferred there for processing. Your files are read where they are, wherever you are; the text for Syft Detect is transferred for processing as described above.

The service is operated by Syft, reachable at support@usesyft.com, which is the data controller for the server-side records described here. Wherever you live, you can ask us to: see the account records we hold about you; correct your email address or name; export your usage records; delete your account; or object to a use of your data. We answer within 30 days. If you are in the EU, UK, Switzerland or a US state with a privacy statute, those rights are also yours by law, and you may complain to your local supervisory authority.

Syft is a tool for people who are old enough to hold their own account with an email provider and to accept these terms. We do not knowingly collect account data from children under the minimum age stated in the Terms of Service; if you believe a child has created an account, contact support@usesyft.com and we will delete it.

Local content is yours and under your control in your browser: it lives on your device until you delete it there, and clearing your browser storage removes it completely. Server-side, we keep account records while your account exists; usage records are kept for the current and previous billing period so allowances and invoices can be reconciled. Error reports in Sentry are kept for 90 days. Server logs are kept by our host for a short rolling window.

Disconnecting a provider deletes its stored tokens immediately. To delete your account, email support@usesyft.com from the address on the account. We delete the account, its session, plan, preference, usage and connection records within 30 days, and cancel any active subscription. What remains: Stripe’s own records of past payments, which we are required to keep for tax and accounting purposes, and the local library in your browser, which only you can delete.

Provider tokens are encrypted at rest with keys held outside the database. Anything uploaded to our servers is processed in temporary storage and removed after processing. To report a vulnerability, contact security@usesyft.com. We read that inbox with priority.

If this policy changes materially, we will update this page and its date. Questions: support@usesyft.com.