How Synopt handles data

The authoritative, per-field list lives on the security page and is kept in sync with the code. In summary: the agent sends metadata about AI tool activity: which tool, which model, when, token counts, an estimated API-equivalent cost as reported by the tool's own telemetry, the repository, branch and project, and a secret-detection verdict recorded as a type, severity and field.

It does not send prompt text (storage is off by default and fails closed), the detected secret values themselves (redacted on the device before upload), source code or diffs, or keystrokes, screenshots and browser history. The agent is open source, so this is checkable rather than merely asserted.

Alongside telemetry, Synopt Cloud holds the ordinary account data needed to run a hosted service: the email addresses and roles of dashboard users, organisation settings, and enrollment records for each Mac.

• Synopt Cloud: your organisation is the controller and decides what is collected, who can see it and how long it is kept. Codex Labs Technologies LLP acts as the processor, handling it on your instructions.
• Self-hosted: Codex Labs is not a processor at all. The data never leaves your infrastructure and we have no access to it: there are zero outbound data flows. How self-hosting works.

Synopt Cloud runs on Hetzner in Germany (EU). Telemetry, aggregates and account data are stored there. We do not replicate customer data outside the EU.

We take on EU and UK customers, and hosting in Germany is a deliberate choice rather than an accident of where a server was cheap. Here is the honest position, stated once, so nobody has to infer it:

• Your organisation is the controller. Codex Labs Technologies LLP is the processor for Synopt Cloud, handling data on your instructions.
• Everything is stored in Germany. There is no transfer outside the EU to assess, because there is no transfer.
• A formal Data Processing Agreement is not available during early access. We have not had one drafted yet. If your procurement process requires a signed DPA before you can start, tell us: we would rather say “not yet” now than sign something we haven't had reviewed, and self-hosting removes the question entirely.
• We are not claiming GDPR compliance as a certification, because that is not a thing anyone can self-award. What we can do is describe the system precisely and let your DPO judge it.

Separate from the product: this is about visitors to synopt.dev, not about engineers whose Macs run the agent. We count pageviews so we can tell whether anybody is finding us and from where. It is our own server in Germany (EU) doing the counting, which is why the sub-processor list below still has one entry on it.

Per pageview we record:

• The page path, and the campaign parameters in the link you followed if it carried any.
• The hostname of the site you arrived from (google.com, chatgpt.com), never the full referring URL. A full URL can carry the other site's query string, which is how analytics tools end up holding search terms and session tokens that were never theirs to hold.
• Your browser's user agent string.

We do not store your IP address. To tell a returning reader from a new one within a single day, we store a one-way hash of your IP address, your user agent, and a secret that is generated in memory, never written to disk, and replaced every day. Once it rotates, yesterday's hashes cannot be matched to today's, so the trail does not accumulate.

Counting a pageview sets no cookie and stores nothing on your device, which is why you were not asked to dismiss a consent banner to read this page. To be exact, because this is a page about being exact: once you sign in, the application does use your browser's storage. It keeps your session token there so you stay signed in, and remembers whether you collapsed the sidebar. Neither is used to count or recognise visitors, and neither is read by anything described above.

When our web server writes an access log, every IP address in it is truncated to a /24 network first, and the same is true of the one internal log line we write when a source is sending pageviews too fast. That is enough to see that a search engine crawled us, or that one network is flooding us, and not enough to identify a reader.

This is the complete list. There is one:

• Hetzner Online GmbH - Hosting and storage for Synopt Cloud. Servers are in Germany.

No analytics vendor, no error-reporting service, no CDN sitting in front of your data. If that changes, this list changes in the same release.

Send access, correction, export or deletion requests to support@synopt.dev. Email support@synopt.dev and we will delete your organisation's data within 7 days. It is a manual process today: there is no self-service delete button in the dashboard yet, but the commitment is firm.

If you are an engineer whose activity is being reported and your employer is the controller, we will route your request to them and tell you that we have: we cannot unilaterally delete a customer's records, but we will not ignore you either.

• Retention is configurable per organisation, up to a ceiling set by your plan. The retention job re-checks that ceiling on every run, so the ceiling is what actually applies, not whatever was configured when the setting was last saved.
• During early access, data is kept for 30 days on a rolling basis. If you need a longer window to evaluate, ask us and we will raise it for your org.
• Deleting an organisation removes its telemetry and account records.

• We do not sell customer data, and we do not share it with advertisers or data brokers.
• We do not use customer telemetry to train models, ours or anyone else's.
• We do not read your prompts, because in the default configuration we do not have them.

Privacy, DPA and works-council questions go to support@synopt.dev. If you need a signed agreement before a trial, say so and we will tell you honestly what we can sign today.