Privacy policy

Effective date: November 3, 2026. This policy covers the Smart sync Global service, Global plugin account flows and this website. It does not describe the separate domestic service.

Who to contact

Smart sync is an independent project. For privacy, account or data requests, contact admin@smartsync.cc.

Data we process and why

Account identity: email address, sign-in provider identifiers and linked account information to register, authenticate and protect your account.
Service metadata: device authorizations, vault identifiers and labels, storage usage and sync transaction state to operate sync, enforce plan limits and diagnose failures.
Security and operational records: connection addresses, timestamps, errors and service events for abuse prevention, reliability and support. Do not put sensitive note content into vault labels or support messages.
Payment records: checkout, customer, subscription and order identifiers, status and plan information when using Stripe. Stripe handles payment information under its own policy; Smart sync does not need your full card number. Live billing is currently disabled.
Vault data: encrypted note content, attachments and paths uploaded for synchronization. Content is encrypted by the plugin before upload. Operational metadata above is outside that content encryption boundary.

We use this information to provide the service, maintain security, respond to requests and comply with applicable obligations. We do not sell your personal data or use your notes for advertising.

Google sign-in requests basic identity and email using OpenID Connect. GitHub sign-in requests the identity and email needed for your account. We do not request Gmail, Google Drive or repository content access. Provider tokens are used for the sign-in flow; they are not a way to read your notes. You may revoke Smart sync in your provider settings; revocation alone does not delete your Smart sync account.

Google user data is used only for account sign-in and account management described here, not for advertising, sale, or AI model training. Our use of Google API information follows the Google API Services User Data Policy, including its Limited Use requirements. Google policy.

Providers and international processing

The Global application server runs on Oracle Cloud in Ashburn, United States. Encrypted object data is stored privately using Cloudflare R2 Standard; we have not verified a fixed geographic storage location for that bucket. Cloudflare provides DNS. Tencent QQ Mail provides outgoing account emails, and Stripe provides test checkout. Google and GitHub process provider sign-in under their own policies. Processing may occur outside your country through these providers; we do not promise that all data stays in one country.

Website storage and tracking

This informational website uses no analytics, advertising scripts or optional tracking cookies. Hosting infrastructure processes ordinary requests and security information. Account and payment pages on other Smart sync subdomains use necessary session storage or cookies to complete authentication and checkout; third-party identity and payment pages have their own policies.

Retention and deletion

You can delete cloud vaults in the plugin. Before deleting your account, remove all cloud vaults and wait for cleanup to finish. Account deletion requires a recent verification of the same identity and confirmation. It removes account access, linked sign-ins, device sessions and associated active account data. It does not delete local notes on your devices.

We retain minimal closed-identity digests to reject stale sign-in callbacks and necessary historical order records for security, accounting and applicable obligations. Pending payment cleanup is retried if a provider is temporarily unavailable. We do not promise immediate physical erasure from historical backups: encrypted server backups normally rotate over seven days, with at least three successful copies retained, so failed backup runs can extend that period. Current backups are server-local; they are not a guarantee against loss of the host.

Your choices and security

Keep independent backups and protect your encryption password; we cannot recover encrypted notes without it. You can review connected devices, sign out, delete cloud vaults or request account deletion. Contact us for access, correction or other applicable privacy requests. We may need to verify that the request is yours before acting.

Changes

We will update this page and its effective date when our practices change. Material changes affecting active users will also be communicated through an appropriate service channel. See the terms of service.