Syftr Privacy Policy

Effective date: 28 October 2026. Last updated: 28 October 2026.

What Syftr is

Syftr lets you share a public post link from a supported app (Instagram, TikTok, YouTube, X, Reddit, LinkedIn, Threads, Facebook, and Pinterest) and save it to your private library as structured notes. We fetch that post, transcribe speech when there is audio, read on-screen text, and organize what it contains: recipes, workouts, places, tools, GitHub repositories, and other notes. We only process public links you share. We do not ask you to log into those apps through Syftr. We do not have a public social feed. Other people cannot see your library unless you share a card with them.

Who this app is for

Syftr is for adults. It is not directed at children under 13 and is not a Kids Category app. We do not knowingly collect personal information from children under 13. If you believe we have, email Contact@zakov.ai and we will delete it. If you are 13–17, use the app only with a parent or guardian’s permission where the law requires it.

Operator

This policy covers the Syftr iOS app operated by ZAKOVAI LLC.

Legal name: ZAKOVAI LLC
Product: Syftr (iOS), bundle ID zakov.ai.sift
Operator / founder: Zach Benhamou
Place of business: Miami, Florida, United States
Privacy and support email: Contact@zakov.ai
Website: https://zakov.ai

Data we collect

A. Account

You sign in with Apple, with Google, or with a one-time code sent to your email.

Sign in with Apple: the stable Apple user identifier, and your email if Apple sends one. Apple often sends it only on the first authorization. If you chose “Hide My Email”, we may store a privaterelay.appleid.com address. We also store an Apple refresh token, encrypted, so we can revoke it at Apple when you delete your account.
Sign in with Google: the Google account identifier and email from Google’s sign-in token.
Email code: your email address. The six-digit code is stored only as a hash and expires after 10 minutes.
We issue a Syftr session token stored in the iOS Keychain. Lifetime: 90 days, then you sign in again.
We do not collect a password. We do not store a display name.

B. Library / “Other User Content”

When you share or paste a public post link, we store, linked to your account:

The source link and the platform it came from
Uploader/handle, caption, on-screen text, transcript
Images, cover frames, and video from the post that the saved card displays
Our generated summary and structured notes, based on what the post actually contains
Status, errors, and “gaps” (what we could not read, for example missing audio)
Timestamps, and the labels, topics, and snooze settings you set on a card
Cards you share with another Syftr account, and cards shared with you. To share, you enter the recipient’s sign-in email; the recipient sees your sign-in email as the sender.

Non-English posts are translated to English so the saved card is in English. Original links, @handles, and names that appeared in the post (including owner/repo names) are kept as-is.

C. Subscription / Purchase history

Whether your account has Syftr+, the plan, and its renewal or expiry date, through RevenueCat and the App Store.
How many of your free analyses you have used.
Apple handles payment. We never see or store your card details.

D. Technical

We use UserDefaults and the Keychain on device (account session, settings). Declared in PrivacyInfo.xcprivacy as UserDefaults CA92.1.
Server logs may include request metadata (time, path, status) for running the API. We do not use an advertising identifier. We do not track across apps and websites. NSPrivacyTracking is false. We do not use App Tracking Transparency because we do not track.

E. What we do not collect

Photo Library, camera, microphone, contacts, HealthKit, payment cards, government ID.
Location. If you allow it, Syftr uses your location on your iPhone to show saved places nearby while the app is open. It stays on the device and is never sent to us.
The share extension accepts a link (or text that contains one), not a photo or video file.
We do not ask you to log into other apps through Syftr. You are not connecting those accounts. We fetch the public link you shared.

How we collect it

Directly from you: sign-in, public links you share or paste, cards you share with others.
Automatically: fetching the public post at that link (video, audio, images, caption, on-screen text) on our servers so we can transcribe and extract.
From Apple or Google: the identity token (and email when provided).
From RevenueCat and the App Store: your Syftr+ status.
From GitHub’s API: when a post names a repository we look up that owner/repo, or search GitHub for likely matches from words in the post and let you pick.
From Google Places: when a post names a restaurant or venue, its public listing (website and Maps link).

How we use it

We use this data to:

Provide the library: sign-in, save and show your notes, extraction, Reanalyze, sharing, Syftr+, and account deletion.
Improve the product: keep extraction working, fix failures, and improve how we structure saved notes. We do not run advertising analytics or ads on this data.
Security: verifying sign-in tokens, session auth, and rate limits so one account cannot flood the pipeline.
Translation to English when the saved post is not in English.

We do not use this data for advertising or ad profiling.

AI processing

Syftr uses AI models from other companies to read the posts you save. When you save or Reanalyze a post, we send its media (video, audio, frames, and images) and its text (caption, on-screen text, and transcript), plus our instructions, to these AI processors:

OpenAI: Whisper speech-to-text, plus analysis, extraction, translation, review, and web lookups
Anthropic (Claude): analysis of video frames and images, extraction, translation, and web lookups
Google Gemini: analysis of YouTube videos

They return the transcript and structured notes that become your card. We do not train our own AI model on your data. We do not sell your data. Each provider handles it under its API terms, linked under Third parties below. Saving a link is how you ask us to run this processing; there is no separate in-app AI setting. To stop it, stop saving links, or delete your cards or your account.

Third parties / processors

We share data with the processors listed here, only to run the product. Each receives only what it needs for its job. They are not allowed to use Syftr user data to advertise. We require them to protect the data at least as well as this policy, through their terms and our accounts with them.

Apple — Sign in with Apple and App Store purchases. apple.com/legal/privacy
Google — Sign in with Google; Google Gemini analyzes YouTube videos you share; Google Places looks up restaurants and venues a post names. policies.google.com/privacy, Gemini API terms
OpenAI — speech-to-text (Whisper) for audio in the post, plus text and image analysis, extraction, translation, review, and web lookups. Audio, frames, and text from the post, plus our prompts. openai.com privacy policy
Anthropic — Claude models for analysis of video frames and images, extraction, translation, and web lookups during review. Frames and text from the post, plus our prompts. anthropic.com/legal/privacy
Apify — fetches public Instagram posts; fallback fetcher for Reddit galleries; last-resort fetcher for YouTube videos when our direct download is blocked. Receives the post link. apify.com/privacy-policy
ScrapeCreators — fallback reader for public posts on supported platforms when the direct fetch fails. Receives the post link. scrapecreators.com/privacy
RevenueCat — manages Syftr+ subscriptions. Receives your Syftr account ID and App Store purchase records. revenuecat.com/privacy
Resend — sends email sign-in codes. Receives your email address and the code. We also use it to email ourselves operational alerts, which can include a failed save’s link and error. resend.com privacy policy
GitHub (Microsoft) — lookup and search of public repositories. GitHub Privacy Statement
Railway — hosts the Syftr API and processes posts. railway.com/legal/privacy
Supabase — Postgres database for accounts and libraries. supabase.com/privacy
The source platform — we request the public page at the link you submitted. We do not send your identity to that platform. Its own privacy policy applies to the public post itself.

Infrastructure is in the United States. If you are in the EEA, UK, or Switzerland, this is a transfer of personal data to the US. We rely on the processors’ published mechanisms (standard contractual clauses or equivalent) and on the fact that this is required to provide the service you asked for.

Lawful bases (GDPR / UK GDPR)

Contract: we need the account, the link, and its content to provide the library and Syftr+ you asked for.
Legitimate interests: security, abuse prevention, keeping the extractor working (including periodic ingest checks of public test posts we choose — not links from your library).
Consent: you choose how to sign in, every link you share, and whether to share a card.

You may object or request erasure as described below.

California / US state privacy (CCPA/CPRA and similar)

We do not sell personal information and we do not “share” it for cross-context behavioral advertising. We do not use sensitive personal information to infer characteristics. Categories we collect: identifiers (account IDs, email), customer content (links and extracted notes), and commercial information (Syftr+ purchase status). We disclose these to the processors above for app functionality only. To exercise access, deletion, or correction, email Contact@zakov.ai from the address on the account, or use in-app Delete account. We will not discriminate against you for exercising these rights.

Retention

Account and library: until you delete the card or the account.
Deleted cards: kept for 30 days so you can restore them, then permanently erased with their media.
Session token: up to 90 days, or until you sign out or delete the account.
Email sign-in codes: 10 minutes.
Fetch cache: we may keep the fetched media for a post (including video) for up to 24 hours, keyed by its link, so a Reanalyze or a repeat save is faster. It is not your library and expires automatically. Other working files are deleted after processing.
Free analysis count: kept with your account. Deleting a card does not reset it. Deleting the account removes it.
Database backups, if any, roll off on the provider’s backup cycle after deletion. We do not keep a separate marketing profile.

Account deletion

In Syftr → Settings → Delete account:

“Delete in 30 days”: we set a deletion date 30 days out. Signing in again before that date with Apple, Google, or your email code cancels it and keeps the library.
“Delete now”: we immediately delete your account, every card and its stored media, your shares, and your sign-in identities. This is irreversible.

We cannot recover a “Delete now” library.

If you cannot open the app (lost phone, and similar), email Contact@zakov.ai from the email on the account and ask us to delete it. We will complete deletion within 30 days of a verifiable request.

When you delete a Sign in with Apple account, we revoke Syftr’s token at Apple. You can also stop using Sign in with Apple in iOS Settings → [your name] → Sign in with Apple.

Deletion removes Syftr’s copy of your library. It does not delete the original post on the platform you shared it from, your Apple or Google account, purchase records Apple and RevenueCat keep under their own policies, or data an AI provider may keep for a limited time for abuse monitoring under its own policy. A copy of a card someone else already saved to their own library stays in their library. Deleting the account does not cancel an App Store subscription; cancel it in iOS Settings.

Sign out vs delete

Sign out only clears the session on that device. The library stays on the server until you delete the account.

Your rights

Access, correction, deletion, portability (we can export your cards as JSON on request), and restriction/objection where the law gives you that right. Email Contact@zakov.ai. We may need to verify you are the account holder. We aim to respond within 30 days.

Security

TLS in transit. The database is not exposed to anonymous clients (the server uses a privileged connection; row-level policies are enabled). Apple refresh tokens are stored encrypted. Session secrets live in the iOS Keychain. No method is perfect. We will notify you if a breach legally requires it.

Automated decision-making

Extraction is automated. Models structure the saved card based on what the post contains. That does not produce legal or similarly significant effects. You can Reanalyze, pick a listed GitHub candidate when the post points to a repository, or delete the card.

Intellectual property / source posts

You are responsible for only sharing links you are allowed to save for personal use. Syftr does not grant you a license to the original creator’s content. We store a copy for your private library.

International users

The service is operated from the United States. If you use Syftr from another country, your data is processed in the US.

Do not sell / do not track

We do not sell personal information. This page does not track you, so there is no browser Do Not Track signal to honor. The iOS app does not participate in cross-app tracking.

Changes

We will update the “Last updated” date on this page. For material changes, we will also describe them in the app or by email. Continued use after the date means you accept the update, except where the law requires opt-in.

Contact

ZAKOVAI LLC

Attn: Privacy — Syftr

Miami, Florida, United States

Contact@zakov.ai

Governing law

Florida law, except where a mandatory consumer statute in your place of residence says otherwise. This is a privacy notice, not a terms of service. Use of Syftr is also covered by the Syftr Terms of Service.