Privacy policy

Last updated:

SYRIX VCF is operated by Syrix Vision Company ("we"). This policy explains what we collect, why, how long we keep it and what you can do. Contact: syrixcompany@gmail.com.

1. What we collect

  • Account: your name, e-mail address, Google account identifier and profile picture, provided by Google when you sign in. We never receive or store your Google password.
  • Your address book: the contacts you create, edit or import (names, phone numbers, e-mail addresses, company, job title, notes), your labels, backups and a history of which fields changed (never the old values).
  • Google Contacts access (only if you connect it): an access token and a refresh token, encrypted with AES-256-GCM. They are used only to create and update contacts in your own Google account.
  • Referrals and rewards: who invited whom, qualification status, the rewards ledger, payout requests and the payout details you enter (PayPal e-mail, Binance Pay ID or Pix key, and the account holder name), encrypted.
  • Progress: XP, levels, badges, missions, challenge participation, and the optional public nickname you choose.
  • Security records: sign-in events, active sessions, the shortened network prefix of the connection (never your full IP address), and a one-way hash of the network used for anti-fraud checks.
  • Support: the tickets and messages you send.

2. Why we use it

  • To provide the service: your address book, synchronisation, imports, exports and backups.
  • To run referrals, rewards and challenges, including fraud prevention and manual payout review.
  • To keep accounts secure: sessions, sign-in history, rate limits and abuse detection.
  • To answer support requests and send the e-mails you can control in Settings (rewards and news; security notices are always sent).

We do not sell personal data, do not build advertising profiles from your contacts and never send messages to the people in your address book.

3. Who can see what

Your contacts are visible only to you. Staff with an admin role see counts, sync status and account information needed to support you, never the contents of your address book. Admin actions are recorded in an audit log that cannot be edited. Leaderboards show only your nickname and score, and only if you opt in.

4. Service providers

  • Google for sign-in and, if you connect it, Google Contacts.
  • Our hosting provider, which runs the servers and database.
  • An e-mail delivery provider (Resend, when e-mail is enabled) for account and reward e-mails.
  • PayPal, Binance Pay or the Pix network, only when we send you a payout you requested.
  • Google AdSense, only if advertising is enabled and you accept it. Ads never receive your contacts.

5. How long we keep data

  • Your account and address book: until you delete them. Deleted contacts are erased after 30 days.
  • Automatic backups: 30 days. Manual backups: until you delete them.
  • Synchronisation history: 90 days. Notifications: 180 days. Expired sessions: 30 days after they end.
  • Account deletion: 14 days after your request (you can cancel during that time). Afterwards your profile, contacts, backups and tokens are erased. Accounting records of completed payments and the audit log are kept without your identity where the law requires.

6. Cookies and local storage

We use only the cookies the service needs: a session cookie (__Host-sid), a short-lived sign-in cookie (__Host-oauth, 10 minutes), a referral cookie (__Host-ref, 30 days, only when you arrive through a referral link) and a language preference (lang). Your theme and language are also remembered in your browser. If advertising is enabled, your choice is stored in your browser and ads load only after you accept.

7. Your rights

You can see and correct your information in the app, download all of it as a file (Settings, Your data), disconnect Google Contacts, sign out other devices and delete your account. You can also write to us to access, correct, restrict or object to processing, or to complain. You may contact your local data protection authority.

8. Security

Connections use HTTPS. Tokens and payout details are encrypted at rest with versioned keys. Sessions are stored as one-way hashes, protected against cross-site requests and can be revoked at any time. Secrets are never written to logs.

9. Changes

If this policy changes in a way that matters, we will tell you in the app before it applies. The date at the top shows the latest version.