Privacy Policy & Sovereign Data Covenant for Synapse Search & TabSynapse
Effective Date: September 24, 2026
Last Revised: September 24, 2026
Application / Suite: Synapse Search, Synapse Companion, and the TabSynapse Web Operating System (collectively, the "Service" or "Software")
Operator & Data Controller: Synapse Engineering & Sovereign AI Foundation ("Synapse", "we", "us", or "our")
Official Portal: https://tabsynapse.com
Privacy & Security Contact: privacy@tabsynapse.com
Data Protection Officer (DPO): dpo@tabsynapse.com
1. Executive Summary & Sovereign Privacy Architecture
Synapse Search was engineered from its foundational line of code on a local-first, zero-telemetry sovereign architecture. We believe that your search history, mathematical scratchpads, browsing habits, personal notes, and intellectual inquiries are your private property and must remain under your sovereign control.
The Non-Negotiable Core Covenants:
- Zero Data Brokerage or Sale: We do not sell, rent, monetize, broker, lease, or trade your personal data, search queries, or browsing history to any advertising network, data broker, analytics firm, or commercial enterprise.
- Zero Third-Party Tracking Pixels: There are zero third-party telemetry scripts, Google Analytics tags, Facebook/Meta pixels, tracking cookies, or persistent device fingerprinting libraries embedded within the extension package or local workstations.
- Deterministic 0ms Client-Side Isolation: All mathematical evaluations, tip calculations, unit conversions, currency conversions, timezone lookups, and lexicon definitions execute locally within your browser's V8 engine. Not a single network packet is generated or transmitted to any server for these operations.
- Zero Account Requirement: The Service operates with complete anonymity. We do not require you to create an account, verify an email address, or provide personal credentials to use the full capabilities of Synapse Search or its integrated workspaces.
2. Categorization of Data & Technical Processing Details
A. Data Stored Exclusively on Your Local Device (chrome.storage.local & IndexedDB)
The following information is persisted strictly on your computing device within your browser’s sandboxed local storage:
- Local Workstations Data: Notes, documents authored in Sovereign Wordpad, calendar schedules, and folder structures.
- Bookmarks & Speed Dials: Custom quick-launch shortcuts and personalized dial directories.
- Client Configuration & Preferences: Selected theme, wallpaper configuration, dock positions, and custom quick-resolver aliases.
- Encrypted Bring Your Own Key (BYOK) Credentials: When you supply custom API keys (e.g., OpenRouter, OpenAI, Anthropic), they are encrypted client-side using AES-GCM-256 using keys derived directly within your browser runtime. The plaintext secret is never transmitted to, inspected by, or stored upon any Synapse server.
Retention & Sovereignty: This data resides exclusively on your local device. You maintain absolute control over its lifecycle. Uninstalling the extension or clearing your browser site data immediately and permanently purges this information from existence.
B. Ephemeral Data Transmitted Over Encrypted Network Channels (TLS 1.3)
When you affirmatively invoke an action that requires remote computation, data is transmitted strictly as follows:
1. Real-Time Web Search & Grounding Requests
- Trigger: When your query requires external real-time web facts, news, or source citations (e.g., querying current events, entity lookups, or live web research).
- Processing: The anonymized search query is sent over encrypted HTTPS (TLS 1.3) to our stateless gateway or directly to the verified search index solely to retrieve live public source snippets and URLs.
- Retention: Stateless and ephemeral. We do not maintain historical query logs tied to user IP addresses or browser fingerprints.
2. Generative AI Inference Requests
- Trigger: When you submit a question or prompt to one of the generative AI models (e.g., DeepSeek, GLM, GPT-5.6, MiMo, or Perplexity Sonar).
- Processing: Your prompt and relevant conversational context are transmitted securely via TLS 1.3 directly to the inference endpoint (either via the Synapse Free Gateway or via your personal BYOK provider). The response is streamed back to your screen in real time.
- Model Training Exclusion: Neither Synapse nor its gateway partners utilize your private queries or outputs to train, retrain, or fine-tune public foundation models without your explicit opt-in consent.
3. Companion Contextual Page Telemetry
- Trigger: Only when you actively trigger a feature within the Synapse Companion dock (such as requesting an executive summary of an article, extracting YouTube video chapters, auditing webmail rows, or drafting an inline reply).
- Processing: The content script inspects the visible text of the active tab in memory. If you click a prompt, the relevant excerpt is bundled as context for the AI inference stream.
- Retention: This in-memory text is discarded when the tab closes or the Companion session resets. It is never cataloged or stored on remote servers.
3. Chrome Web Store & Browser Extension Permissions Audit
In strict adherence to the Google Chrome Web Store Single Purpose Policy and Principle of Least Privilege, every permission requested by the extension is auditable and limited to essential operational needs:
| Manifest Permission | Technical Necessity & Operational Boundary |
|---|---|
storage |
Required to persist your local bookmarks, folder organizations, custom wallpapers, and AES-256 encrypted API keys within chrome.storage.local. No data leaves your machine. |
sidePanel |
Required to render the Synapse Companion side panel natively alongside web pages using Chrome's official Side Panel API (chrome.sidePanel). |
activeTab |
Required to access the URL and in-memory DOM text of the currently focused tab only when the user explicitly triggers a companion action (e.g., summarizing an article, analyzing YouTube video chapters, or auditing inbox items). |
scripting |
Required to inject the companion co-pilot interface into active tabs that were opened prior to extension installation or update (chrome.scripting.executeScript). |
notifications |
Required to display native desktop alerts for calendar reminders and focus session timers locally on your operating system (chrome.notifications.create). |
host_permissions["https://*/*", "http://*/*"] |
Required strictly for: (1) Background service worker streaming of AI completions and web grounding citations from secure inference gateways; (2) In-memory companion page context extraction on arbitrary websites visited by the user. |
4. International Regulatory Compliance
A. European Union General Data Protection Regulation (GDPR) & UK GDPR
Synapse adheres to the data protection principles set forth under Regulation (EU) 2016/679 (GDPR) and the Data Protection Act 2018 (UK GDPR):
- Legal Basis for Processing (Art. 6 GDPR): Processing of ephemeral inference queries is conducted pursuant to Contractual Necessity (Art. 6(1)(b)) to fulfill the user's requested search/synthesis service, and Legitimate Interest (Art. 6(1)(f)) in ensuring platform security and rate-limiting integrity.
- Data Subject Rights (Arts. 15–22 GDPR): You possess the right to access, rectify, restrict, or erase personal data. Because Synapse does not maintain persistent server-side user profiles, accounts, or query histories, your data is already 100% in your physical possession within your local browser storage. You can exercise complete erasure at any second by clearing your browser storage.
- Data Protection Officer: For formal GDPR inquiries, contact our Data Protection Officer at dpo@tabsynapse.com.
B. California Consumer Privacy Act (CCPA / CPRA)
Under the California Consumer Privacy Act as amended by the California Privacy Rights Act:
- Notice of Collection: Synapse does not collect identifiable categories of personal information beyond ephemeral network payloads necessary for real-time inference.
- We Do Not Sell or Share Personal Information: Synapse has never sold, rented, or shared consumer personal information to third parties, and will not do so.
- Right to Know & Delete: California consumers have the right to request deletion of their data. Because all persistent data is stored strictly on your local device, you can delete it immediately via browser settings or the in-app "Clear Vault" buttons.
- Non-Discrimination: We will not discriminate against you in pricing, features, or service quality for exercising any statutory privacy rights.
C. Children's Online Privacy Protection Act (COPPA)
The Service is not directed to, marketed toward, or intended for children under the age of thirteen (13). We do not knowingly solicit, collect, or maintain personal information from children under 13. If you believe a child has provided us with personal information, contact privacy@tabsynapse.com immediately for swift investigation and removal.
5. Subprocessors & Third-Party Service Providers
Synapse partners exclusively with high-integrity infrastructure providers for real-time stateless compute:
| Subprocessor / Service | Purpose | Data Transmitted | Privacy Standard |
|---|---|---|---|
| OpenRouter / AI Providers | AI Inference Streaming | Ephemeral user prompt & context | Encrypted TLS 1.3; Zero retention on custom keys; SOC 2 certified endpoints |
| Unsplash API | New Tab Wallpapers | Landscape category query | Public photo metadata only; Zero personal data |
| Open-Meteo API | Local Weather Widget | Latitude / longitude coordinates | Non-identifying spatial coordinates; Zero personal identifiers |
6. Cryptographic Security Standards
We implement rigorous technical, organizational, and physical safeguards:
- Client-Side AES-GCM-256: Sensitive secrets (such as BYOK API keys) are encrypted locally using the Web Cryptography API (
crypto.subtle.encrypt) using AES-GCM with a 256-bit key length and unique initialization vectors. - Strict Manifest V3 Content Security Policy (CSP): The extension enforces an uncompromising CSP that prohibits
eval(),new Function(), remote script loading, and inline scripts, mitigating cross-site scripting (XSS) and code injection vectors. - Transport Layer Security: All external requests mandate TLS 1.3 (or minimum TLS 1.2) with strict certificate validation.
7. Data Retention & Erasure Protocols
- Ephemeral Inference Payloads: Processed in RAM and purged immediately upon completion of the streaming response.
- Local Application Data: Stored in your browser's persistent storage until you manually delete documents, clear your cache, or uninstall the extension.
- BYOK Key Erasure: Clicking "Clear / Revert to Free Tier" in the Settings modal immediately overwrites and deletes the encrypted key from local storage.
8. Amendments & Version History
We may revise this Privacy Policy periodically to reflect architectural evolutions, regulatory updates, or enhanced security capabilities. When amendments occur, we will update the "Last Revised" date at the top of this page and publish the updated policy at https://tabsynapse.com/privacy.html. Because we do not store your email address, we encourage users to review this page periodically. Continued use of the Service following published updates constitutes constructive acceptance of the revised covenants.
9. Contact, Inquiries & Data Rights Verification
For legal inquiries, regulatory notices, or privacy verification audits:
- Entity: Synapse Sovereign Engineering Foundation
- Official Web Portal: https://tabsynapse.com
- Privacy Office: privacy@tabsynapse.com
- Data Protection Officer: dpo@tabsynapse.com
- Legal Counsel: legal@tabsynapse.com