Privacy Policy

Last updated: 5 November 2026 · Effective: 5 November 2026

1. Who we are

This policy covers the SyncMage service at syncmage.com. The data controller is:

S2Kernel S.à r.l.
[registered address]
Registration: [registration number]
Web: s2kernel.com
E-mail: [email protected]

2. Summary

• SyncMage moves files between your own cloud accounts.
• File content is not stored; it is processed only during a transfer.
• Access tokens are encrypted at rest and decrypted only while a task runs.
• Your data is never used for advertising, never sold and never used to train AI models.
• Disconnecting an account revokes its token; deleting your account purges your data.

3. Data we process

Data	Source	Why
Account details: name, e-mail address, password hash (Argon2id), language and notification preferences	Your sign-up or social login	To create your account, authenticate you and contact you
Connected cloud account details: provider, account id, account e-mail, storage quota	The provider's API, once you authorize it	To show the account in the interface, report its quota and explain connection problems
Access tokens (OAuth access and refresh tokens) or connection credentials (host, username, password) for non-OAuth providers	The provider's authorization flow, or the form you filled in	To run the tasks you start, on your behalf
File and folder metadata: name, path, size, modification time, provider id, type	The provider's listing API	To render the file manager, plan transfers, detect what changed and support search
Task records: which task, when, how many files and bytes, which error	Generated while tasks run	To show progress, explain failures and count usage against your plan
Technical records: IP address, browser user agent, session and device list, audit log entries (sign-in, connecting or removing a cloud, creating a share)	Your requests	Security, abuse prevention, legal obligations
Support conversations and the files you attach to them	Your messages	To answer you
Addresses you invite through the referral feature	You	To send the one invitation you asked for and credit you when it is accepted
Billing data	The payment provider — card details never reach us	Subscriptions and invoicing

4. File content

While a transfer, sync or backup task runs, file content is read from the source and written to the destination. During that:

• Content is not stored permanently; copying is streamed.
• Where a pair of providers cannot be streamed, content is buffered in an encrypted temporary object store; those objects are deleted when the task finishes and in any case expire automatically within 24 hours.
• Previews and archive (zip) downloads use the same temporary area under the same rule.
• Our staff do not read your file content. Access happens only through automated processing, and only for the task you started.
• Content is never used for advertising, profiling or model training.

File metadata is stored because the product is built on it: the file manager, search and change detection all read it. It is deleted when you disconnect the account.

E-mail migration

When you migrate a mailbox, each message is converted to a PDF in memory and written, with its attachments, to the destination you chose. The temporary rule above applies on the way there. We keep no copy of messages, subjects or attachments. We keep only the provider's message IDs, so a repeat run skips what was already migrated, and those IDs are deleted when you disconnect the mailbox. A mailbox connection is used by this feature only: it cannot be browsed, searched or used by any other task.

5. Google and Microsoft permissions

The consent screen asks only for what the connection you chose needs.

Google

Scope	Why it is needed
.../auth/drive	To list and read files in Drive and — when you pick Drive as a destination — write them. Transfer, sync, backup and the file manager rely on this.
.../auth/gmail.readonly	Only for the e-mail migration feature: to read messages and their attachments, convert the messages to PDF and write them to the destination you chose. Nothing is written to or deleted from Gmail.
.../auth/photospicker.mediaitems.readonly	To read the photos and videos you select in Google's own picker and copy them to the destination you chose. Selected items pass through our systems only for that copy, and access to the whole library is never requested.
.../auth/admin.directory.user.readonly	Only for team transfer, and only when a Google Workspace administrator connects their organisation: to list its members so they can be paired with accounts on the destination, and to confirm that a member belongs to that organisation immediately before a migration acts for them. We keep each member's address, name and active status for the pairing. Nothing is written to the directory, and member data is never read for any other purpose.
openid, email, profile	To show which account is connected and to recognise the same account on re-authorization instead of creating a duplicate.

Service account for team transfer. Copying a member's Drive during a Google Workspace team transfer does not use the administrator's sign-in. It uses a service account owned by SyncMage, with domain-wide delegation. This works only after an administrator of your organisation authorises that service account's client ID, in your own Google Admin console, for the single scope .../auth/drive. While it is authorised, SyncMage can open the Drive of a user in your organisation. It does so only during a team transfer that your administrator started, only for the members on that migration, and only after your organisation's directory has confirmed that the member belongs to it. The service account's key is kept as a secret on our servers. Your administrator can withdraw this at any time by removing the client ID from the Admin console; migrations then stop working and nothing else changes.

Microsoft

Scope	Why it is needed
Files.ReadWrite	For a personal OneDrive: to list, read and write your own files.
Files.ReadWrite.All	For SharePoint and OneDrive for Business: the same, in the files your organisation lets you reach.
Sites.ReadWrite.All	The same, in the SharePoint library you select.
Mail.Read	Only for e-mail migration: to read Outlook messages.
User.Read.All	Only for team transfer, when an administrator connects OneDrive for Business: to list the members to pair. Your organisation's administrator has to approve it.
openid, email, profile, User.Read	To show which account is connected.
offline_access	So scheduled tasks can run when you are not at the browser.

The same principle applies elsewhere: services used only as a source (Google Photos, Flickr, Evernote, Gmail, Outlook) are requested with read-only permission.

6. Limited Use disclosure

In practice:

• Data from your Google and Microsoft accounts is used only to provide the feature you started.
• It is not used for advertising and is not sold or transferred to third parties.
• It is not used to develop, improve or train generalised artificial intelligence or machine learning models.
• Humans do not read it, except with your explicit permission, for security purposes where unavoidable, or to comply with applicable law.

7. Purposes and legal bases

• Performance of a contract: creating your account, establishing connections, running tasks, billing.
• Legitimate interests: security, fraud and abuse prevention, keeping the service working, debugging.
• Consent: connecting a cloud account, and optional marketing e-mail. You may withdraw consent at any time.
• Legal obligation: tax law and lawful authority requests.

8. Service providers and transfers

We do not sell your data. We use these categories of provider:

Category	Why	Location
Hosting provider [name]	The servers the application and database run on	[country]
The cloud providers you connect	Your files are already there; transfers go through their APIs	Governed by that provider's own terms
Payment provider	Paid plans are not open yet. When they are, billing will run through a licensed payment institution named here, and card details will never reach us.	Governed by the provider's terms
E-mail delivery [name]	Verification, notification and invoice e-mails	[country]
Google Ireland Limited	On these marketing pages only: Google Analytics if you consent, and Search Console for search visibility (section 13). Not used inside the application.	Ireland / EU

Where data is transferred outside Türkiye or the EEA, appropriate safeguards (such as standard contractual clauses) are applied, in line with KVKK art. 9 and GDPR chapter V.

9. Retention

Data	Kept for
Account details	As long as your account exists
Access tokens and connection credentials	Until you disconnect; then revoked and permanently deleted within 30 days
File metadata and search index	Until the connection is removed
Transferred file content and migrated e-mail	Not stored; temporary buffers expire within 24 hours
IDs of migrated e-mail messages	Until the connection is removed
Task and error logs	180 days; per-file records 30 days
Audit records	12 months
Support conversations and attachments	As long as your account exists
Invoices and financial records	As required by law (10 years in Türkiye)
Everything remaining after account deletion	Purged within 14 days

10. Security

• All traffic is encrypted with TLS.
• Cloud credentials are encrypted at rest with AES-256-GCM; keys live in application configuration and can be rotated.
• The transfer engine holds credentials in memory only while a task runs; they are never written to the server's disk as a configuration file.
• Tokens, passwords and authorization headers are masked in logs.
• Passwords are hashed with Argon2id; two-factor authentication (TOTP) is supported; sensitive actions such as deleting an account or removing a cloud require password confirmation.
• The temporary buffer and all backups are encrypted.
• Requests to private network addresses are blocked, rate limits apply and sensitive actions are written to an audit log.

No system is perfectly secure. If you find a vulnerability, please write to [email protected].

11. Disconnecting and deleting data

Removing a single cloud connection

In the application, open Clouds and choose Remove on the account. The token is revoked where the provider offers revocation, the metadata and search index for that account are deleted, and the record is permanently removed within 30 days.

You can also revoke access from the provider:

• Google: myaccount.google.com/permissions
• Microsoft: account.live.com/consent/Manage
• Other providers: the connected-applications page of that account

Deleting your whole account

In the application, go to Settings → Account → Delete account (password confirmation is required), or write to [email protected] from your account's e-mail address. Scheduled tasks stop at once. Within 14 days your connected accounts are revoked and your tasks, shares, logs, support conversations and temporary objects are permanently purged. Only financial records we are legally required to keep remain, with your billing e-mail address on them; audit records stay for the rest of their 12 months with your identifying details removed. Requests by e-mail are completed within 30 days.

Note: SyncMage never deletes files in your cloud accounts. Deleting your SyncMage account does not touch them.

12. Your rights

Under KVKK art. 11 and the GDPR you have the right to access, rectify, erase, restrict and object to the processing of your data, to data portability, and to withdraw consent. You can export a machine-readable copy of your data from the application, or ask us for one.

Write to [email protected]; we answer within 30 days. You may also complain to the Turkish Personal Data Protection Authority (KVKK) or your local EU supervisory authority.

13. Cookies and measurement

Strictly necessary cookies

What the service needs to work: the session cookie (HttpOnly, Secure, SameSite=Lax), CSRF protection and your language preference. You cannot sign in without them, so they do not require consent.

Analytics cookies — only if you agree

Google Analytics 4 is used to measure how these pages are used. It does not start before you accept: a notice appears on your first visit, and if you decline, no cookie is written and no request is made to Google.

• What is measured: the page viewed, approximate location (country or city level), device and browser type, and where you arrived from.
• What is not: your name, e-mail, files or anything from your cloud accounts. There is no sign-in on these pages at all.
• IP addresses are truncated and Google signals are disabled; the measurement is never used for advertising.
• The data is processed by Google Ireland Limited as a processor, with standard contractual clauses for the transfer.
• Your choice is stored in your browser. You can change it here.

Google Search Console

Google Search Console is used to see how the site appears in search results. It reports aggregate search data (which queries, how many clicks); it writes no cookie to visitors and identifies no one. A verification tag in the page source or a verification file in the folder may be present to prove ownership.

No advertising or profiling cookies from third parties are used.

14. Children

The service is not intended for anyone under 18 and we do not knowingly collect data from children. If we find such data, we delete it.

15. Changes

When this policy changes, the date at the top changes with it. Material changes are announced by e-mail to your account address.

16. Contact

S2Kernel S.à r.l.
[registered address]
Registration: [registration number]
[email protected]