Cookie Policy

1. About this policy

This Cookie Policy explains the cookies and similar technologies used on the websites of Syniray, Inc. (“Syniray”, “we”), 447 Sutter St, Ste 506 - 1201, San Francisco, CA 94108, United States.

It covers syniray.ai — the public pages (the homepage, pricing, the Hub, Discovery, the legal pages and the sign-in page) and the application (the Chat and its tools, Syniray Code, Syniray Academy, Projects, the Library and the pages of conversations and results that people share) — and the payment pages at checkout.syniray.ai.

In short:

• Most of what we store is strictly necessary: it keeps you signed in, protects the sites and payments, and keeps your Chat history on your device when you use Syniray without an active paid plan (on the Free plan).
• Some items remember preferences you set yourself, such as the theme, the language or the last model you chose.
• One thing is optional: Google Analytics, which tells us in aggregate how syniray.ai is used. It is loaded only after you accept it in the cookie panel, and you can change your choice at any time under “Cookie preferences”. The two typefaces of our pages, Plus Jakarta Sans and JetBrains Mono, are served by Syniray itself, not by Google Fonts (see “The typefaces on our pages”).
• We use no advertising or social-media tracking, and we do not follow your browsing on other websites.

When one of these technologies involves personal data — your session identifier or your IP address, for example — our Privacy Policy explains how we handle it: https://syniray.ai/hub/legal/privacy-policy/

2. What cookies and similar technologies are

A cookie is a small text file that a website asks your browser to keep and to send back with later requests. A cookie set by the site you are visiting is a first-party cookie; one set by another company’s service is a third-party cookie. A session cookie is normally deleted when you close the browser; a persistent cookie lasts until its expiry date or until you delete it.

Websites can also keep information in your browser in other ways, which this policy treats in the same way as cookies:

• Local storage — information a site keeps in your browser with no expiry date, until the site or you remove it. Each site address (for example syniray.ai and checkout.syniray.ai) has its own.
• Session storage — the same, but kept only until you close the browser tab.
• IndexedDB — a small database inside the browser, used here by Google’s Firebase library, which handles phone-number verification.
• Requests to third-party servers — when a page loads a typeface, a script or an image from another company’s server, your browser sends that server your IP address and the usual technical details of a request, even if nothing is stored on your device.

European law (Article 5(3) of Directive 2002/58/EC, the ePrivacy Directive; in Portugal, Article 5 of Law No. 41/2004) and the United Kingdom’s Privacy and Electronic Communications Regulations share a basic rule: a site may store or read information on your device without your consent only when this is strictly necessary to provide a service you have explicitly asked for, or to transmit a communication. Other uses require your prior consent, subject to the few further exceptions the UK rules allow. For each item, this policy says which rule we consider applies, and why.

3. How Syniray uses them

Strictly necessary

We consider these strictly necessary to provide the service you ask for, so we do not ask for your consent for them: signing you in and keeping you signed in, the security checks that protect our sites from automated abuse, fraud prevention on the payment pages, the phone-number verification that is part of setting up an account, and keeping your Chat history on your device when you use Syniray without an active paid plan.

Preferences

These remember choices you make yourself — the light or dark theme, the interface language, the last AI model and reasoning level you chose, or whether Projects and the Library show a grid or a list. They are set as a result of choices you make, used only to apply them, and not used to identify or follow you. European data protection authorities have indicated that storing a preference a user has expressed, in order to apply it, can be regarded as necessary for the service that user asked for; on that basis we do not ask for consent for them. The UK rules now also contain an express exception for storage that adapts a site to a user’s preferences. They are all listed below, and you can remove them at any time (see “Your choices”).

Analytics — only with your consent

With your consent, syniray.ai loads Google Analytics, which tells us in aggregate how the website is used: which pages are visited, from which kind of device and browser, and from which country. It sets the cookies _ga and _ga_<ID> on syniray.ai and sends what it measures to Google. Until you accept it in the cookie panel, Google Analytics is not loaded at all: no cookie is set and nothing is sent to Google. Your answer is kept in the cookie syniray_consent (see the table), and you can change it at any time (see “Your choices”). It is never loaded on checkout.syniray.ai.

What we do not use

We do not use advertising, cross-site audience-measurement or social-media cookies or scripts, and we do not build profiles of your browsing on other websites. Google Analytics, when you accept it, measures only your use of syniray.ai, with Google signals and ad personalisation turned off. If your browser sends a Global Privacy Control signal, we treat it as a refusal of analytics: the panel does not ask, and Google Analytics is not loaded unless you accept it yourself under “Cookie preferences”. The other companies named in this policy receive technical data such as your IP address when your browser contacts them, and handle it under their own policies; we do not control whether they combine it with what they collect on other websites.

4. The cookies and storage we use

The table below lists the cookies and similar technologies that our sites set or cause, as checked against the sites’ code. Requests to other companies’ servers that store nothing of ours on your device are described in “Other companies involved”, apart from reCAPTCHA, which also has a row in the table. “Set by” says who sets it: Syniray when it is our own code (first party), otherwise the company named. “Category” says whether an item is strictly necessary or remembers a preference (see “How Syniray uses them”); no item depends on your consent. Where a row groups several items, they are listed here.

• syniray_session is set only when you sign in, including right after you create an account. You can end your other sessions at any time in Settings › Sessions.
• PHPSESSID (the default name of the server software’s session cookie) is set on the pages of the application, the sign-in page, shared pages and the payment pages, including for visitors who are not signed in. The other public pages — the homepage, pricing, the Hub, Discovery and the legal pages — start no such session.
• syniray_consent now keeps your answer to the cookie panel about analytics. An answer kept by the earlier panel of our public pages (about Google Fonts) is not read as an answer to this one; on syniray.ai it is deleted.
• syniray_free_* stands for syniray_free_history (your list of conversations), syniray_free_conv_ followed by a conversation identifier (each conversation) and syniray_free_pending (an answer still being written). They hold the content of your conversations in plain text in this browser. They are not tied to your account and are not removed when you sign out: anyone who uses the same browser profile can read them, and they appear in the Chat history of any other account signed in there without an active paid plan. On a shared computer, delete your conversations in the Chat or clear the site data. Conversations kept this way are not saved in your Syniray account, so clearing this storage deletes them for good.
• “syniray_* (interface)” stands for syniray_last_model, syniray_effort, syniray-voice-lang, syniray_projects_view, syniray_library_view, syniray_academy_model, syniray_academy_effort, syniray_academy_mem_dismissed, syniray_code_model and syniray_code_effort.
• The theme is kept under syniray-theme on most pages and under syniray_theme on some pages of the application (Deep Research, Fact Check, Documents, Projects, the Library and some shared pages). The payment pages keep their own syniray-theme.
• Earlier versions of the site stored two more items that the Chat still reads if your browser has kept them: syniray-show-reasoning (hides the reasoning box) and syniray-auto-search (asks for a web search with every message). Clearing the site data removes them.
• Cloudflare, Stripe and Google set their items under their own rules, which they can change, and may use further items of their own on their own domains. The names and durations shown for Cloudflare’s and Stripe’s cookies are the ones those companies publish, not values our code controls.

5. The typefaces on our pages

Syniray’s pages use two typefaces, Plus Jakarta Sans and JetBrains Mono. Syniray serves them itself, from syniray.ai and, for the payment pages, from checkout.syniray.ai, on every page of both sites: the public pages, the pages of the application (the Chat and its tools, Syniray Code, Syniray Academy, Projects and the Library), shared pages and the payment pages. No page of syniray.ai or checkout.syniray.ai requests anything from Google Fonts (fonts.googleapis.com or fonts.gstatic.com), so displaying these typefaces does not send your IP address to Google. Syniray stores nothing on your device for them; your browser may keep the font files in its ordinary cache.

The former consent panel

Earlier versions of the public pages and the payment pages loaded these typefaces from Google Fonts, treated them as optional and asked for your consent first, in a panel at the bottom of the page. That panel has been removed. The cookie panel our sites show now is about Google Analytics only (see “How Syniray uses them”); an answer you gave to the earlier panel is not read as an answer to it.

6. Other companies involved

The following companies take part when you use our sites. Each acts under its own privacy policy, and part of what they do happens on their own domains, outside our control.

• Cloudflare — every Syniray site is delivered through Cloudflare’s network, which protects it from attacks and automated abuse. All requests to our sites pass through Cloudflare, and its security features may set cookies such as __cf_bm and cf_clearance, listed above. https://www.cloudflare.com/privacypolicy/
• Stripe — the payment pages load Stripe’s payment script (js.stripe.com) when they open. The card details you type go directly into fields provided by Stripe; Stripe may set fraud-prevention cookies on the payment pages and use its own cookies inside those fields. https://stripe.com/privacy
• Google Analytics — only with your consent (see “How Syniray uses them”): syniray.ai then loads Google’s tag (www.googletagmanager.com) and sends the measurements to Google Analytics. Google does not log or store IP addresses in Google Analytics. https://policies.google.com/privacy
• Google Firebase Authentication and reCAPTCHA — when your account is set up, we verify your phone number by text message using Google’s Firebase service, protected by an invisible reCAPTCHA check. The Firebase library is downloaded from Google (www.gstatic.com) on the pages of the application and on shared pages, also for visitors who are not signed in; the record listed in the table is created when you complete the verification. reCAPTCHA may set or read Google’s own cookies on Google’s domains. https://policies.google.com/privacy
• Sign in with Google and, where it is offered, Sign in with Apple — if you choose one of them, you continue on Google’s or Apple’s own site, where their cookies and policies apply. The sign-in page loads Apple’s sign-in script (appleid.cdn-apple.com) for every visitor, so Apple receives the IP address of anyone who opens that page. If you signed in with Google, your profile picture is loaded from Google’s servers. https://www.apple.com/legal/privacy/
• jsDelivr and cdnjs — the application and shared pages load open-source libraries from these public networks: KaTeX for mathematics, highlight.js for code, pdf.js to display PDF files, Split.js for resizable panels and, on the Agent page, PptxGenJS to build presentations. These requests send your IP address to the network that serves them; we do not use these networks to store anything on your device.

We do not ask for your consent for these requests, because we consider them necessary for the pages to work: they deliver and protect the sites, take payments, verify phone numbers, offer sign-in and display mathematics, code and documents. Several of them are made when a page opens, whether or not you use the feature concerned — for example, the Firebase library on the pages of the application and on shared pages, Apple’s script on the sign-in page, and the libraries for mathematics, code and PDF files.

The icons of websites cited as sources in answers are fetched through our own servers, so displaying them does not make your browser contact those websites. If an answer displays an image hosted on another website, however, your browser loads that image from the website concerned, which receives your IP address.

7. Your choices

The cookie panel

The first time you visit syniray.ai, a panel asks whether you accept analytics (Google Analytics). You can accept it, reject it, or open the details and choose; the pages work the same whatever you choose, and rejecting is as easy as accepting. Your answer is kept for 12 months in the cookie syniray_consent. You can change it or withdraw your consent at any time with “Cookie preferences” — at the bottom of the public pages, in the side menu of the application and on this page. Withdrawing stops Google Analytics on syniray.ai at once and deletes its cookies there; it does not affect what was measured before. checkout.syniray.ai shows no panel: it uses nothing that needs your consent.

Your browser’s settings

You can delete or block cookies and site data in your browser’s settings, or use a private window. Blocking or deleting strictly necessary items signs you out and may stop sign-in, payment or phone verification from working. Deleting the site data of syniray.ai also deletes the Chat history kept on your device when you use Syniray without an active paid plan, and resets your preferences.

8. Changes to this policy

We update this policy when our sites start or stop using a cookie or similar technology, or start using one for a different purpose. The dates at the top of this page show when the current version took effect and when it was last changed. If we start using an optional technology, we will first ask for your consent, and we will not use it until you have given it.

9. Contact

For questions about this policy or about how we handle personal data, write to [email protected]. For other legal matters, write to [email protected]. Our postal address is Syniray, Inc., 447 Sutter St, Ste 506 - 1201, San Francisco, CA 94108, United States.

If you are in the European Union or the United Kingdom, you can also lodge a complaint with the supervisory authority of the country where you live or work — usually its data protection authority; in Portugal, the Comissão Nacional de Proteção de Dados (https://www.cnpd.pt), and in the United Kingdom, the Information Commissioner’s Office (https://ico.org.uk).