Privacy Policy.

Last updated: 2026-09-30 · Version 2.0

This policy explains what personal data SyncTide ("we") handles, in which role, why, and how you can exercise your rights. SyncTide is offered in two forms, and they differ:

• On-premises installation — the software runs on the customer's own server. Measurements, alarms and user accounts stay there and are not sent to us.
• Hosted service — we run the instance for the customer, on servers in Germany. We then process the customer's data on its behalf, as a processor, under a Data Processing Agreement (§4).

1. Who we are

Controller for the processing described in §2 and §3: Tiago Guimarães, established in Portugal. Contact: [email protected]. We have not appointed a Data Protection Officer; our processing does not require one. All requests go to the address above.

2. This website

• Hosting and statistics. The site is served by Cloudflare Pages. Cloudflare Web Analytics gives us aggregate page counts; it sets no cookies and builds no profile of you. Cloudflare processes your IP address to deliver the pages.
• Fonts and scripts. Pages load fonts from Google Fonts and animation scripts from jsDelivr. Your browser therefore sends your IP address to those providers when the page loads.
• Contact form. Messages you send through the contact page (name, email, company, the plan you ask about, your message) are relayed by Formspree (USA) to our inbox.

No advertising pixels, tracking cookies or session recording are used. Legal basis: legitimate interest in operating the site (Art. 6(1)(f) GDPR); for enquiries, your request and pre-contractual steps (Art. 6(1)(b)).

3. Customers and licences

To issue and support a licence we keep:

• the customer's name and the contact details of its technical and billing contacts;
• for on-premises licences, the MAC addresses of the server the licence is bound to; for hosted licences, the instance identifier. They are written into the signed licence file, and we keep a record so we can reissue or renew it;
• invoicing data required by Portuguese tax law.

Legal basis: performance of the contract (Art. 6(1)(b)) and legal obligation for invoicing (Art. 6(1)(c)).

4. The hosted service

In a hosted instance the customer is the controller of the personal data it puts in SyncTide — typically the names, usernames and email addresses of its users, the phone numbers, emails or Telegram chat IDs of alarm contacts, and the IP addresses kept in the audit log. We process that data only to run the service, on the customer's instructions, under the Data Processing Agreement, which lists our sub-processors and security measures. Questions from people whose data is in a customer's instance should go to that customer; we will help it answer.

5. Connections the software makes

An on-premises installation sends nothing to us. It contacts external services only for these features, and only when the customer uses them:

• Update check — asks GitHub (Microsoft, USA) whether a newer version exists. GitHub sees the server's IP address.
• Weather in forecasts — sends a site's coordinates to Open-Meteo. Only when the prediction module uses weather.
• Alarm messages — SMS, WhatsApp, Telegram or email go through the providers the customer configures (e.g. Twilio, Meta, Telegram, its mail server), which receive the recipient and the message text.

The web interface loads its fonts and scripts from the SyncTide server itself. The one exception is the map: when a page shows it, the browser fetches map tiles from OpenStreetMap (OpenStreetMap Foundation), which sees the viewer's IP address.

6. Who receives data

We do not sell or rent personal data. Recipients are limited to:

• Cloudflare (website hosting and statistics), Google Fonts and jsDelivr (website assets), Formspree (contact form);
• our email provider, for correspondence;
• Hetzner Online GmbH, Germany (hosted service infrastructure);
• the Portuguese Tax Authority, for invoices;
• authorities, where the law requires it.

Cloudflare, Formspree and GitHub may process data in the USA; such transfers rely on the EU–US Data Privacy Framework or on Standard Contractual Clauses. Hosted-service data stays in the EU.

7. How long we keep it

• Enquiries that do not lead to a contract: 12 months.
• Customer and invoicing records: the duration of the relationship plus 10 years (Portuguese tax law).
• Licence records (including MAC addresses): while the licence is active; deleted on request once it is permanently retired.
• Hosted-service data: as set out in the Data Processing Agreement — exported on request and deleted after the contract ends; backups expire within 30 days.

8. Your rights

You may request access, rectification, erasure, restriction, portability and object to processing based on legitimate interest, and withdraw consent where processing relies on it. Write to [email protected]; we reply within one month. You may also lodge a complaint with the Portuguese supervisory authority, the Comissão Nacional de Proteção de Dados (CNPD, cnpd.pt), or the authority of your EU country of residence.

9. Security

Measures for the hosted service are listed in the Data Processing Agreement, Annex 2. Vulnerabilities can be reported under our Security Policy.

10. Changes

We update this page when our practices change; the date at the top shows the current version. Customers are told of material changes by email.