← Back to Scyn

Privacy Policy

Last updated: August 12, 2026

Who controls your data

Scyn is the controller of personal data processed through scyn.app. Contact us at support@scyn.app about this policy or any privacy request.

What we collect

  • Account data: your email address and, when your sign-in method provides them, your name and profile picture.
  • Content: the projects, chapters, story text, graphs, nodes, and links you choose to store or sync with Scyn. Free-tier graph data stays in your browser unless you use a feature that stores it with Scyn.
  • Subscription data: your plan, subscription status, and the billing information needed to manage your subscription. Stripe handles payment-card details; Scyn does not store your full card number.
  • Technical data: error, performance, device, browser, and request information needed to secure, maintain, and troubleshoot the service.
  • Optional analytics: only if you allow analytics, pseudonymous page views and explicit feature-use events described below.

Why we use it and our legal bases

  • Contract: to create your account, authenticate you, store and sync your projects, provide paid features, process subscriptions, and respond to support requests.
  • Legitimate interests: to protect Scyn, prevent abuse, and use minimised Sentry error and performance reports to keep the service reliable. You may object to this processing; we will consider your rights against our need to run a secure and reliable service.
  • Consent: to use PostHog product analytics. Rejecting or withdrawing analytics consent does not affect the service.
  • Legal obligations: where we must retain transaction, tax, fraud, or compliance records.

We do not use your story content to train AI models, sell it, or use it for advertising.

Cookies and browser storage

Scyn uses browser storage to keep you signed in, complete sign-in requests, remember your privacy choice, save local work, and keep your app settings. PostHog analytics storage remains off unless you select Allow analytics. You can withdraw that consent at any time through Cookie settings.

StoragePurposeDuration
Essential session cookieKeeps you signed in after you authenticate.7 days
Sign-in security cookiesValidate Google or Apple sign-in and return you to the page you requested.Google: for the browser session or until sign-in completes. Apple: up to 10 minutes or until sign-in completes.
Privacy preference in browser storageRemembers whether you allowed or rejected analytics, when you chose, and the notice version you saw.Up to 12 months, then we ask again
PostHog analytics cookies and browser storageStores pseudonymous visitor and session identifiers. PostHog creates this storage only after you allow analytics and removes it when you withdraw consent.Up to 365 days
Local project storage in your browserStores free-tier projects and story graphs on your device so the editor works without sending that graph data to Scyn.Until you delete the content or clear site data
Scyn app preferences and local draftsRemembers editor settings, dismissed guidance, the last open chapter, and recovery drafts you asked the app to preserve.Until replaced, deleted with the related content, or site data is cleared

Sentry does not use browser storage, and session replay is disabled. Scyn does not use advertising cookies or cross-site advertising trackers.

Service providers and recipients

We use Railway for cloud hosting and data storage, Google and Apple for sign-in, Resend for sign-in links and service emails, Stripe for billing, Sentry for error and performance monitoring, and PostHog for optional product analytics. These providers process data for Scyn under their service terms and data-processing commitments.

Sentry receives limited error and performance information. For signed-in users, this may include an internal account identifier. We disable session replay and configure Sentry not to receive your name, email address, or story content.

If you allow analytics, PostHog receives pseudonymous events such as page views, feature use, and conversion milestones. These events may contain technical project or graph identifiers, but not your name, email address, profile picture, or story content. We disable person profiles, automatic click and text capture, and session recording.

We may disclose information if legally required or when necessary to establish, exercise, or defend legal claims. We do not sell personal information or share it for cross-context behavioural advertising.

International transfers

Scyn and some providers process data in the United States. Where EU, EEA, or UK data protection law requires a transfer safeguard, we use an applicable adequacy decision or contractual safeguards such as the EU Standard Contractual Clauses and an applicable UK transfer addendum or agreement. Email us to ask about the safeguard relevant to your data or to request a copy.

How long we keep it

  • Account and synced project data remain while your account exists. Self-service account deletion removes account and story data from the active database.
  • Backups containing deleted account data rotate out within 90 days.
  • Sentry error and performance data is retained for up to 90 days.
  • PostHog analytics events are retained for up to 12 months.
  • Billing and transaction records are retained only as long as needed for accounting, tax, fraud prevention, dispute handling, and other legal obligations.

Your rights

Depending on where you live, you may have rights to access, correct, delete, restrict or object to processing, and receive a portable copy of your personal data. Where we rely on consent, you may withdraw it at any time without affecting earlier lawful processing. You may also complain to your local data-protection authority; UK users can contact the Information Commissioner’s Office.

Use Delete account in Settings, or email support@scyn.app. We may need to verify your identity. We aim to respond within one month, subject to any lawful extension.

Scyn does not make decisions about you based solely on automated processing that produce legal or similarly significant effects.

California privacy rights

If the California Consumer Privacy Act applies to Scyn and you, you may request to know, correct, or delete covered personal information and receive a portable copy. You also have the right not to receive discriminatory treatment for exercising a privacy right. Scyn does not sell personal information or share it for cross-context behavioural advertising, so there is no sale or sharing to opt out of. Submit a request through Settings or support@scyn.app.

Security and deletion

We use access controls, encrypted connections, protected sign-in sessions, and provider access restrictions to safeguard your information. No online service can promise absolute security.

Delete individual projects from the dashboard. To remove your account and stored story data, use Delete account in Settings. If you cannot access your account, email support@scyn.app.

Children

Scyn is not directed to children under 13 and we do not knowingly collect their personal information. If you believe a child under 13 created an account, email support@scyn.app so we can investigate and delete it where appropriate.

Changes and contact

If a material change affects your rights or requires new analytics consent, we will provide notice and ask again where required. The date above identifies the current version. For privacy questions, requests, or complaints, email support@scyn.app.