Privacy Policy

Last updated: 2026-10-30

This policy explains what the Synclet Android app (name.gpm.synclet) does with data. It covers the app only.

The short version: Synclet moves your files between your phone and the servers you tell it to use, and nowhere else. There is no account to create, no server of ours that your files pass through, and no copy of anything kept anywhere you did not configure.

Who is responsible

Gabriele Proietti Mattia is the data controller for the processing described here. Contact: apps@gpm.name.

What leaves your device, and where it goes

Your files — to the remotes you set up yourself, and to nothing else.

A remote is your NAS, your web host or your Nextcloud: a server you reach over SFTP or WebDAV. Synclet connects to it directly, with the credentials you entered, over the protocol you chose. There is no intermediary service, no relay and no proxy: Gabriele Proietti Mattia operates no server for this app and could not receive your files even in principle.

Where a remote is run by someone else — a hosting provider’s Nextcloud, for instance — that provider’s own privacy policy governs what happens to the files once they arrive. You are sending them to your own account there.

Plain-http WebDAV is offered, and the app flags it: it sends your password and your files without encryption, so anyone on the path can read them. Use https where you can.

Nothing else is transmitted. No file names, no folder structure, no list of your remotes, no statistics about what you sync.

Writing in, and reading the answers

Synclet has a report screen — something is wrong, or an idea — and a messages screen where you can read what was written back. Both are optional, and nothing is sent from them until you use them: until you write something and press send, or sign in. Once you have signed in, the app also checks for a licence on its own; see “Licences” below.

What a report carries

What you wrote: whether it is a bug or an idea, the title and the description.
What makes it fixable: the app’s version, your Android version, the phone’s manufacturer and model, and your language tag. Typed into the message by the app — none of it is read from an identifier.
The app’s log, only if you switch it on. It is off by default, the app shows you exactly what would be sent, and email addresses, things that look like keys, tokens or passwords, coordinates and the query part of web addresses are masked first. That masking is not a guarantee: a log can still contain the names of your files and folders and the address of your server, so read it before you send it, or leave it off.
A screenshot, only if you pick one. Nothing is captured for you. The picture is shrunk and re-encoded on your phone, and what you see before sending is exactly what leaves it — so if part of the screen has nothing to do with the problem, remove it first.
Your email address, only if you type one, or fill it in with Google in the Google Play build (see “Signing in” below). Without it a report is anonymous and cannot be answered; with it, it is how you get a reply.
A random identifier for that single report, so that sending twice on a bad connection is not counted as two. It is not a device id, it is not stored on your phone, and a second report gets a different one.
The IP address it was sent from. It is stored with the report, and only the moderator sees it.
A fingerprint of your device, made from its Android ID (Settings.Secure.ANDROID_ID), which the app reads without any permission. Android gives every app its own value, tied to the app’s signing key, so two apps by Gabriele Proietti Mattia see different ones, and a factory reset changes it. The service keeps only a keyed one-way hash of it, never the value itself, and never shows it to anyone.

The same two go with a feature request. Both are there to keep abuse out, so that someone who sends abuse can be banned by device; see “Keeping abuse out” below.

It goes to apps-management.gpm.name, a service run by the author. It is not shared with anyone, not used to build a profile and not published: reports are read, given a state and answered by hand.

Never the advertising id, and no install id of our own — in a report or anywhere else. The fingerprint above is the only thing that identifies the device.

Keeping abuse out

A report or a feature request containing obscene words is not stored and not forwarded to anybody. Its sender is banned, without being told:

by the device fingerprint, permanently;
by the IP address, for 30 days;
by the account or address, permanently, but only if you were signed in or had verified the address. An address you merely typed into the form is never banned.

The owner can lift any ban. If you think you were banned by mistake, write to apps@gpm.name.

Signing in, and the key that costs

A report is answered by email, to the address you typed into it. That is the whole of what is needed, and if you never sign in nothing below applies to you.

Some things need the service to be sure an address is yours: the messages screen, which shows what you sent and everything written back without going to find the mail; asking for a feature and voting; receiving a licence given by the author; and putting your name on the supporters list. How you prove it depends on the build:

The build from the F-Droid repository: you type the address and the service emails a six-digit code to it. Enter the code and the address is proved. This build contains no Google libraries and offers no Google sign-in.
The Google Play build: the app asks Android for the Google account on the phone, and Google’s ID token is sent to the service, which checks it against Google’s own keys. The service then stores your email address, the Google account id and the name on the account. On a phone with no Google account, the address and code take its place. Google sees that you signed in to “gpm apps”, the name the author’s apps share, under Google’s own privacy policy.

On the report screen of the Google Play build, the same Google button only fills in the address field, so that you can be answered. The app keeps no key from it, but the service records the address, the account id and the name, as it does for any sign-in.

Once you are signed in, the app keeps a key, and it is the one thing here that resembles a login, so it is worth being exact about it:

it hangs from the address you proved, never from your phone — nothing about the device goes into it, two phones that prove the same address get two separate keys, and removing the app throws the key away rather than recovering it;
it works for Synclet only, and opens nothing in any other app;
the service stores a one-way hash of it, not the key itself;
it stops working after a year without use, and Sign out withdraws it at the service and not only on your phone.

Sending a report needs none of this. You can report something having proved nothing, and that report carries no key or login, only the IP address and the device fingerprint described above.

Licences

The author can give Synclet Pro to an address by hand, to a tester for example. When you are signed in, the app asks the service whether you have been given one: when it starts, right after you sign in, and at most every ten minutes while it stays open. The request carries the key and nothing else: no device details, nothing about your remotes or your files. The phone keeps the answer as a yes or a no, and Settings shows it. If you have not signed in, nothing is sent for this check.

Each check counts as using the key, so a key on a phone that is still in use does not expire, and the address counts as active (see “Retention”).

Donations and the supporters list (F-Droid repository build)

The build from the F-Droid repository has nothing to buy. Its support card in the Info tab offers:

Donations through external links (Ko-fi, and a page for card, Google Pay and PayPal run by Stripe), which open in your browser and are handled by those services, under their own policies. The app does not see your payment. From the platform, the service records the amount, the currency, the platform and a one-way hash of the address you paid with, never the address itself.
A reminder notification once a week asking whether you would like to donate, on its own notification channel that you can silence in two taps in Android’s settings. It is made on the phone and sends nothing. Silencing it takes nothing away, and it stops when a donation is confirmed.
The supporters list, which anybody can read in the app. Being on it is a separate decision from donating, taken on a screen of its own, and nobody is on it without asking. You prove the address you donated from, with a code as above, and the service checks whether a donation is recorded against it. What is published is the name you typed and nothing else: never your address, never an amount, never a date. Taking it down is one tap on the same screen.

Feature requests and votes

The same screen lists what people have asked for in Synclet, and lets you ask for something and vote. Reading that list costs nothing and needs no address. Asking and voting do, for one reason: one vote per person is a promise, and without something to hang it on the count would mean nothing.

What is published is the request itself, once it has been read. Never your address, and never who voted for what.

What stays on your device

Credentials. Passwords and SSH private keys are stored encrypted on the device, under a key held in the Android Keystore. The host keys of your servers are stored too, so that a changed key can be noticed. They are used to connect to your remotes and are never sent anywhere else, never written to a log, and never included in a crash report.
Your configuration. Remotes, addresses, pairs, schedules and filters.
Sync state. For two-way jobs, a record of what each side looked like at the end of the last run — path, size, modification time, and where needed a content hash. This is what lets the app tell a new file from a deleted one.
Run logs. Which files were transferred, skipped, deleted or failed, and why. Logs record paths, never file contents. They stay on the device and are capped in size. They leave it only if you attach the app’s log to a report, as described above, or share one yourself — and a list of paths can itself be revealing.

Uninstalling the app removes all of it, as it does for any app’s private storage.

Access to your files

Synclet reads and writes only the folders you grant it, through Android’s Storage Access Framework: you pick a folder, Android grants access to that folder, and the grant is visible and revocable in the system settings. The app asks for no storage permission.

Other permissions

Network access, to reach your remotes, to tell which network you are on, and to reach the author’s service for what this page describes. Notifications (Android 13 and later), for progress, failures and a sync waiting for your OK, and in the build from the F-Droid repository for the weekly donation ask. Starting after a reboot, so that your schedules resume. None of these sends anything anywhere of its own accord.

Location permission

None. Synclet asks for no location permission and never reads where you are. Android only reveals the name of the Wi-Fi network to a background app that has location access “all the time”, which Synclet will not ask for, so it does not match networks by name. Its way of choosing an address — try the addresses and use the one that answers within two seconds — needs no permission at all.

Tailscale

If you mark a remote as needing Tailscale, Synclet sends a request to the Tailscale app on your phone asking it to connect, using the automation hook Tailscale publishes for this purpose. That request contains no data of yours, goes to no network, and Synclet receives nothing back from Tailscale beyond whether your remote then answers.

Diagnostics

There are none. The app contains no analytics, no crash-reporting service and no Firebase, in any version. If it crashes, nothing is sent: the only way anything about a problem reaches Gabriele Proietti Mattia is the report you write yourself, as described above.

What the app never does

No account you have to create in order to use the app. An email address only if you type one in yourself or sign in with Google — to be answered about a report, to read those answers in the app, to vote for a request, to receive a licence or to be on the supporters list — and never for anything else.
No advertising, and no sale or sharing of data with anyone.
No tracking, across this app or any other.
No uploading of your files or your configuration to us — there is nowhere to upload them to.
No reading of your contacts, messages, call history or photos beyond the folders you explicitly pointed the app at.

For readers in the EU/EEA and the UK: the transfers the app performs are ones you instruct it to make, between your device and services of your own choosing, and each of those services is an independent controller of what it then holds. Gabriele Proietti Mattia receives nothing from them, so there is no processing on that side to which a legal basis under Article 6 would attach.

What does reach Gabriele Proietti Mattia rests on these:

A report or a request, and the address you attach to it — your consent, given by pressing send. You may ask for it to be deleted at any time.
The IP address and the device fingerprint kept with a report or request, and the bans that follow an obscene one — a legitimate interest (Article 6(1)(f)): protecting the service and the people who run it.
Proving an address, the key, and the licence check that uses it — your consent, given by asking for the code or pressing the Google button. Withdrawn by signing out, or by deleting the account.
The record of a donation, and your name on the supporters list — the record rests on a legitimate interest (Article 6(1)(f)) in knowing what money was received; the listing rests on your consent, given on its own screen and withdrawn there in one tap.

Retention

At the service (apps-management.gpm.name):

An address, and what hangs from it (the name and account id from Google, a key, votes, a licence, a name on the supporters list) is kept while you use it. An address that has been silent for five months — nothing sent, nothing requested, no sign-in and no licence check — is sent an email saying it will be deleted, and is deleted a month later, six months after it went quiet, unless you have come back in the meantime.
Never deleted this way: an address with a donation recorded against it, one that is on the supporters list, or one with an active licence.
A sign-in key stops working a year after you last use it, and is withdrawn the moment you press Sign out. Deleting the app removes the copy on your phone.
Reports are kept while they are useful — an open one until it is answered, a closed one as the record of a decision. A screenshot is part of the report it came with and goes when it goes. The IP address and the device fingerprint are kept with the report as long as the report is kept. Ask and yours is deleted, including the address you sent it from. When an address is deleted, its reports stay with the address removed from them.
A donation record — amount, currency, platform and the hashed address — is kept as the record of money received, and stays when an address is deleted.
Ban records stay until they expire (30 days for an IP address) or the owner lifts them.

On your device, configuration and sync state remain until you delete the job or uninstall the app; logs are capped and rotate. What your remotes retain is up to you and to them.

Your rights

Under the GDPR you may request access to, correction of, or deletion of your personal data, and object to processing. You retain the right to lodge a complaint with a supervisory authority.

For what the service holds: in the app, on the messages screen in the Info tab, Account → Delete my account and data; or write to apps@gpm.name from the address you signed in with; or use the delete-account page. Deletion takes the address, the name and account id from Google, the key, your votes, a licence, and your name on the supporters list. Reports stay with the address removed from them, and donation records stay as above.

For what is on your phone, removing a job or uninstalling the app deletes it, and what reached a remote is deleted there.

Children

Synclet is not directed at children under 13 and knowingly collects no data from them.

Changes

Material changes will be published on this page with a new date at the top, and significant ones will be noted in the app’s changelog.

Last updated: 2026-10-30