Privacy Policy
Effective October 13, 2026
This policy explains what information Synchrony Synergy ("we", "us") collects when you use EdgeGuard (the website at synchronysynergy.org and the dashboard at guard.synchronysynergy.org, together the "Service"), how we use it, and the choices you have. Questions: [email protected].
1. Information you give us
- Account details: your business name and email address, and your password, which we store only as a salted one-way hash (we can't read it).
- Business settings: your Cloudflare API token and Zone ID, and, if you turn on phone alerts, your ntfy topic URL and access token. Tokens and alert settings are stored encrypted.
- People you invite: the email addresses of team members you add to your business.
- Support messages: anything you send us by email.
2. Payment information
Payments are handled by Stripe. You enter card details on Stripe's pages; they never reach our servers. We receive and keep only your Stripe customer and subscription identifiers, your plan, and your subscription status (for example active, past due or cancelled). Stripe's use of your information is covered by Stripe's privacy policy.
3. Traffic data from your website
To protect your website, the EdgeGuard forwarder you install on your Cloudflare site sends us a short summary of each request to your site: the visitor's IP address, the requested path, the visitor's network (ASN) and country as reported by Cloudflare, and the browser's user-agent string. From this we keep:
- visitor IP addresses with per-minute request counts, kept for 14 days;
- a threat score for each IP and the reasons for it, and a history of challenges and blocks applied at Cloudflare, kept while your account is active.
Requested paths are held only briefly in memory to calculate scores and are not stored. We use this data only to run the Service for you. For this data you (our customer) decide what is collected by installing the forwarder, and we process it on your behalf. You are responsible for telling your own visitors, for example in your privacy policy, that their requests are screened for security purposes.
4. Information collected automatically
- Sign-in cookie: the dashboard uses one essential cookie to keep you signed in. We don't use advertising or analytics cookies or trackers, and the sales website sets no cookies of its own.
- Server logs: our servers keep short-lived technical logs of requests (such as time, address and page requested) for security and troubleshooting.
- Cloudflare: our websites are served through Cloudflare, which may set security cookies and process connection data under Cloudflare's privacy policy.
5. How we use information
We use information to provide and secure the Service, apply the protections you configure, send the alerts you turn on, handle billing, answer support requests, and meet legal obligations. We do not sell personal information and we do not use it for advertising.
6. Who we share it with
We share information only with service providers that help us run the Service, and only as needed:
- Cloudflare: delivers our websites and carries out the challenges and blocks on your Cloudflare site;
- Stripe: payments and subscriptions;
- InterServer: server hosting and backup storage in the United States;
- ntfy: delivers phone alerts, only if you turn alerts on (alerts contain your business name and summary information such as blocked IP addresses or traffic levels);
- IONOS: our email provider, for messages you send us.
We may also disclose information if required by law, to protect the rights and safety of our users or others, or as part of a sale or transfer of the business, in which case this policy continues to apply.
7. Retention and backups
We keep account and business information while your account is open. Traffic counts are deleted after 14 days. When you ask us to close your account, we delete its data from the live system. Encrypted backups are kept for up to about six months and then removed automatically.
8. Security
We use encrypted connections (HTTPS), encrypt stored Cloudflare tokens and alert settings, store passwords only as hashes, limit sign-in attempts, and keep backups encrypted. No system is perfectly secure, so please use a strong, unique password.
9. Your choices and rights
You can view and update your business settings and team in the dashboard, and change your password at any time. To get a copy of your information, correct it, or delete your account, email [email protected]. Depending on where you live, you may have additional rights under local law; contact us and we will help.
10. Where data is stored
The Service is run from the United States, and information is stored there.
11. Children
The Service is for businesses and is not directed at children. We don't knowingly collect information from anyone under 18.
12. Changes
If we change this policy, we'll update the date above, and for significant changes we'll email account owners before the change takes effect.