What we store, and what leaves your machine

The website

The waitlist

If you sign up for the waitlist, we collect your email address and your first name. The email is used for one purpose: telling you when the beta opens and when Syncopy launches. No newsletter, no marketing sequence, no sharing or selling to anyone. You can ask us to delete it at any time by mailing hello@syncopy.app, and every launch email carries an unsubscribe link.

We also record which site you arrived from — a search engine, Reddit, ChatGPT, or a link someone shared — and store it with your signup, so we know where people are finding Syncopy. That is a site name, not a profile of you: no cookie, no identifier, and nothing that follows you around other websites.

The form is provided by Tally, a Belgian company that stores form responses encrypted within the EU. Tally acts as our processor: they hold the data on our behalf and do not use it for their own purposes. If the product never launches, the list is deleted rather than repurposed.

Analytics

We use Cloudflare Web Analytics to see how many people visit and which pages they read. It sets no cookies, does no fingerprinting, and does not follow you across other websites. We see aggregate counts — page views, referrers, countries, load times — not individuals. That is why this site has no cookie banner: there are no tracking cookies to consent to.

Downloads

When you click the download button, we count that click per day, per version and per country. We do not store your IP address: we keep only a one-way value derived from it that changes every day and is deleted after 30 days, plus the country code. After that, only daily totals remain. The installer itself comes from GitHub, which handles that request under its own privacy policy.

Hosting

The site is hosted on Cloudflare. Like any web host, Cloudflare processes the IP address of incoming requests to serve pages and block abuse. Fonts are served from this domain, so no third party sees your request for them.

The application

Syncopy is a desktop application. There is no Syncopy server in the middle of your trading: the app talks to Tradovate directly from your machine, the same way your trading platform does.

What stays on your computer

• Your broker credentials. Stored encrypted at rest using Windows' own DPAPI, tied to your Windows account. They are sent to Tradovate to log in, and nowhere else.
• Your trades, positions, balances and P&L. Held in a local database file on your machine. We never receive them.
• Your logs and journal notes. Rolling log files on disk. The diagnostics export is a file you save yourself and choose whether to send to us for support, either by hand or with a problem report (below).

Which connections the app makes

This is the complete list. There is no analytics, telemetry or crash-reporting library in Syncopy — not in the Rust backend and not in the frontend.

• Tradovate (demo.tradovateapi.com, live.tradovateapi.com, md.tradovateapi.com, trader.tradovate.com) — your broker. Login, orders, fills, balances and market data. This is the connection that makes the product work.
• Cloudflare's public DNS resolver (1.1.1.1) — before opening a websocket, Syncopy resolves Tradovate's hostname over DNS-over-HTTPS, because relying on the machine's own resolver turned out to be a source of dropped connections. Cloudflare sees your IP address and which Tradovate hostname you are resolving. No account data is involved, and if the lookup fails the app falls back to your operating system's resolver.
• syncopy.app — three things, all on our own site, and these are the only connections the app makes to us:
  • The update check, at startup and once an hour. Syncopy asks whether a newer version exists and downloads the installer only if you accept one. Our server sees your IP address and which version you are running, the same as any website you visit. This is also the only way we learn roughly how many copies are in use — there is no licence check, no account and no identifier. We count checks per day, per version and per country. We do not store your IP address: we keep only a one-way value derived from it that changes every day and is deleted after 30 days, plus the country code. After that, only daily totals remain. Updates are signed, and the app refuses any download that is not signed with our key.
  • The discount-code list shown in the app's Setup tab, a public file the app downloads. Nothing about you is sent with it beyond what any web request carries.
  • Problem reports — only when you press Send. “Report a problem” sends your description, your email if you give one, a summary of your setup (status, accounts and roles, recent activity) and, if you leave it on, the log files from today and yesterday. Logs contain account numbers and balances; passwords and tokens are removed before sending. Screenshots only if you add them. The report arrives as an email in our support mailbox and is kept as long as the support case needs it. Nothing is sent without you pressing Send.

When the paid version ships, its licence is checked on your own machine and does not contact our server. If that ever changes, this page changes first.

Your rights

Under the GDPR you can ask what we hold about you, ask for a copy, ask for corrections, and ask for deletion. For the waitlist that means one email address, and one mail to hello@syncopy.app settles it. You also have the right to complain to the data protection authority in your own country.

Controller: Syncopy, contact hello@syncopy.app.