Controller and contact
Gregor Graf is responsible for the own processing described here. The address and contact details are in the imprint. Privacy enquiries can be sent to contact@synhub.io. The scope matches the service table in the imprint.
Delivery, origin servers and Cloudflare
During a visit, technical connection data is transmitted, including the IP address, requested address, time and browser headers. The respective systems use it for delivery, error handling and security. According to the operator, the own servers are in Leibnitz, Austria; Gregor Graf has operational access.
Cloudflare is used as a reverse proxy and CDN in front of the own servers and processes traffic passing through it. Self-hosting in Austria therefore does not mean processing exclusively in Austria. The operator also mentions Web Analytics, challenges/bot protection and geoblocking; the earlier reference to Turnstile has not been explicitly withdrawn.
According to Cloudflare's product information, Web Analytics uses neither cookies nor LocalStorage nor individual fingerprinting. This is general product information. It confirms neither actual use on each SynHub host nor the disabling of other storage. Security features may evaluate the IP address, browser and further technical characteristics and restrict access. Cloudflare distinguishes protecting a customer's website from its own purposes of improving bot detection.
Earlier samples showed NEL/Report-To headers and email decoding on Legal/Social. NEL can cause browsers to send network error reports to Cloudflare. Seven days in the header configuration is not a verified deletion period at the recipient.
Provider information: Cloudflare Privacy, Web Analytics, Cookies, Turnstile/Challenge Platform.
Email through Hosttech
For an email, the operator and the mail service process the sender and recipient addresses, message content, attachments and necessary mail metadata to handle the enquiry. Gregor uses Hosttech for mail. A web contact form is not planned.
Gregor states retention of one year from receipt of mail and daily local backups retained for 30 days. Actual deletion of original messages, client copies and backups has not yet been demonstrated. These statements are not a confirmed deletion guarantee. Original messages, client copies and backups must be treated separately.
Recipients and international processing
Direct browser connections transmit at least the connection IP and request information to the destination. For a server-mediated request, the upstream initially receives the connection of the intermediary server; search text, feed address, image destination or other payload may still be forwarded. Forwarding the visitor's IP through headers or other fields requires separate verification. A local cache or proxy alone does not mean an absence of third-party processing.
Web and Social
Web provides project information. Based on the earlier review, own assets and bundled fonts come from the own origin; a font in the build does not mean a browser request to Google Fonts. This version stores the selected website language (en/de) in the cookie synhub-language only when the language control is used. It applies to the current host, has Path=/, HttpOnly, SameSite=Lax and a lifetime of 365 days from selection (Secure on HTTPS). It is sent to this host on requests so that content and document language match from the first render. The preference can be changed with the language control or removed through the browser's website data settings; without a valid value, English is used. No LocalStorage or SessionStorage is used for this preference. Infrastructure processing under 2.2 remains separate. According to the operator, Google Ads is not actively used.
Social provides Gregor's profile and contact links. Based on the earlier code review, the profile image and icons are local assets. On the relevant action, the page locally stores the language and the dismissal of its storage notice. Age confirmation for individual copy actions takes place in page state; server-side proof of age has not been demonstrated. Copy actions use the local clipboard.
Links to Discord/discordid.netlify.app, Instagram, Ko-fi, Snapchat, Steam, Telegram, TikTok, VRChat and X open third-party offerings. During the earlier normal first visit, these platforms were not loaded automatically. Their connection data and storage are governed by their own processing. This does not make the SynHub statement a blanket approval of these services.
Hub, search, short links and IT-Tools
Hub offers local favourites, settings, dashboards/notes, history and tools. According to the reviewed code, the calculator, unit conversion and QR generation process their calculation inputs in the browser; the shared infrastructure remains separate.
The selected target operation currently offers neither Google sign-in nor Drive synchronisation. Basic local use does not require a Google account. This version removes Identity requests, sign-in, auth endpoints and token use. Existing data and the production switch that has not yet been confirmed are explained under “Transition and earlier data”.
A reduced SearXNG configuration has been approved for search: only the engines duckduckgo, wikipedia and wikidata for general search; no additional engines can be enabled through categories, bangs or user preferences. Autocomplete is disabled. This limits the selection to three engines and two provider groups without claiming privacy compliance.
Regular/anonymous short links are intended to be valid for a maximum of 30 days. SynHub processes the target URL, short code and expiry time. Opening a link redirects to the destination, where the destination provider processes its connection data. Link validity and deletion of the database row are different operations. New links are valid for at most 30 days. Existing longer links retain their promised remaining lifetime; they are neither extended nor deleted early. The product limit is not proof of deletion from SQLite, logs or backups.
MyMemory translation, third-party RSS proxies, external browser voice search, arbitrary third-party iframes and ipify are removed in target operation. The IT-Tools embed is covered separately as a named own service, distinct from arbitrary third-party iframes. This version uses static own images and a local default icon. Stored external image addresses are no longer loaded; an arbitrary URL proxy is not offered. Direct RSS requests, tmpfiles with Lens/Bing and M-Lab/NDT7 are also disabled.
IT-Tools runs on a separate origin and stores additional settings. The earlier sample demonstrates five local keys but not a complete investigation of all tool functions. Exclusively local processing for all IT-Tools is not promised.
Retention and deletion
| Data | Retention and deletion |
|---|---|
| Origin/auth/error logs | The operator has so far stated 30 days. Which logs actually exist, when this period begins and whether deletion takes place have not yet been technically confirmed. A uniform period for all logs has therefore not been demonstrated. |
| Own backups | For own backups, scope, backup frequency, retention and the beginning of the period have not yet been confirmed. Handling deleted data during restoration has also not been demonstrated. Active deletion does not automatically remove an older backup. |
| Mail and local mail backups | The operator states one year from mail receipt and daily local backups retained for 30 days. Actual deletion of original messages, client copies and backups, and differing retention for individual data holdings, have not yet been confirmed. |
| Short-link data | New links: at most 30 days of validity. Existing links retain their remaining lifetime. A daily cleanup is prepared but not activated in production; actual deletion and backup rotation have not yet been confirmed. |
| Browser data | Per key in the Cookies/browser storage document; LocalStorage has no general expiry time of its own. Deletion per origin, browser and device. |
| Earlier OAuth/Drive data | No new sign-in or synchronisation in this version. Earlier sessions, tokens, cloud/cache copies and logs may remain; their deletion periods have not yet been confirmed. Revocation, cloud deletion and browser deletion are separate paths, explained under Transition and earlier data. |
| Earlier external data / unresolved functions | Provider periods relate to the recipient. tmpfiles states a maximum of 48 hours for its file copy; M-Lab describes public measurement data retained indefinitely. No inference about copies at Lens/Bing or other recipients. |
| Earlier service data | Gregor confirms there are no paid legacy agreements or ongoing service data. Technical data and mail data remain separate. |
Data subject rights
Subject to the legal requirements, rights to access, rectification, erasure, restriction and data portability exist. Processing based on legitimate interests may be objected to on grounds relating to a particular situation. Consent that has been given may be withdrawn with effect for the future.
Requests can be sent to contact@synhub.io or the imprint address. Please specify the project and data involved. Purely local data may not be attributable by the operator; it can be removed on your own device. Identity checks use the necessary information. Rights requests are handled within the statutory periods; justified restrictions are explained.
Complaints may be lodged with a data protection supervisory authority, particularly at the place of residence/work or the place of the suspected infringement. In Austria: Austrian Data Protection Authority, dsb@dsb.gv.at.
Transition and earlier data
As of 04.10.2026: The functional transition is prepared in this software version. A complete production switch of all services has not yet been confirmed. The separate SearXNG server configuration, Cloudflare rules, mail and backup lifecycle and the complete IT-Tools inventory still require operational evidence. Until then, earlier data flows and data holdings apply as transition information; the new interface alone does not prove that older deployed versions have been disabled.
During an earlier first visit to Hub, Google Identity and Google favicons were loaded. Earlier search suggestions could forward input text through the SynHub SearXNG instance; its public configuration included additional engines. Earlier search navigation led to Google by default. The number of enabled engines corresponds neither to the number of actual requests nor to direct disclosure of the visitor's IP to every engine. The approved selection of three still requires production configuration and upstream evidence.
Earlier RSS requests involved The Verge, Hacker News/hnrss and BBC, as well as possible additional stored feeds. On errors, AllOrigins, CodeTabs and Thingproxy could receive the complete feed address, including possible private parameters. Stored news and images may remain in the browser. MyMemory received entered text and the language pair. Earlier image uploads went to tmpfiles, and the image address subsequently to Lens/Bing. tmpfiles states at most 48 hours for its file copy; this does not demonstrate deletion at other recipients. Earlier M-Lab measurements included the IP address, time and measurement data; M-Lab describes publicly available measurement data retained indefinitely. Hiding a function does not delete this data at providers.
Earlier browser speech recognition could transmit audio to a recipient depending on the browser. The optional debug module used ipify; arbitrary website widgets could load their configured address when displayed. This version removes the request paths for stored modules as well. Own IT-Tools remains a separate service with its own origin and storage.
Google Identity and Drive synchronisation are disabled in this version. Earlier sessions are not used for sign-in, token renewal or synchronisation. Old browser cookies may remain until browser deletion; the disabled auth endpoints discard them. Server data, logs and backups are not automatically deleted as a result.
Earlier Google permissions covered openid, email, profile and drive.appdata. The app used the file h42-startpage-favorites.json in the AppData folder, access/refresh tokens, a session JWT and local copies, potentially including history. This was not permission for all Drive documents. You can revoke the connection to SynHub in your Google account. Revocation does not delete an AppData file. Existing hidden app data must be managed separately in Google Drive settings; SynHub cannot fully delete third-party accounts itself. For questions about specific data, contact contact@synhub.io.
Browser data is removed per origin, browser and device through website data settings. Hub reset deletes Hub app data on this device; history, old news, further toolbox settings and other origins must be treated separately. JavaScript cannot reach HTTP-only cookies. Local deletion removes neither a Drive copy, a short-link row, a provider file nor a backup. No real user cloud data was deleted as part of this transition.
The actual log fields and deletion runs, the start and execution of backup rotation and mail client copies have not yet been technically confirmed. No global deletion after 30 days is promised. Cloudflare products, security cookies and access assessments depend on the host and rules; a sample result with few cookies does not prove disabling. Specific contracts, provider roles, legal bases and international safeguards must be assessed for each actual data flow. General provider information does not replace account evidence.