Privacy Policy

1. About this policy

This Privacy Policy explains how Synera Email ("the add-in") handles your data. Synera Email is a desktop add-in for the Synera engineering platform, developed and published by Pathfinder Labs ("Pathfinder Labs," "we," "us"). The add-in lets users send and receive email from their Synera workflows via SMTP, IMAP, and POP3, with OAuth 2.0 authentication for Gmail and Microsoft 365.

This section applies to Synera Email. Other Pathfinder Labs products and this website are covered by the other sections of this Privacy Policy.

2. Summary

• Synera Email runs entirely on the end user's Windows PC. Pathfinder Labs operates no cloud service for the add-in.
• We do not receive, store, or transmit your email content, OAuth tokens, mailbox metadata, or passwords to Pathfinder Labs servers. There are no Pathfinder Labs servers involved in the product's operation.
• OAuth tokens and any custom-connection passwords are stored locally on your machine, encrypted with the Windows Data Protection API (DPAPI).
• We do not sell, share, or use your data for advertising, analytics, or machine-learning training.

3. Google API Services — Limited Use disclosure

Synera Email's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically, we commit that:

• We do not use Google user data to serve advertising.
• We do not transfer Google user data to third parties except (a) as necessary to provide or improve the user-facing features of Synera Email that are prominent in its user interface, (b) to comply with applicable law, or (c) as part of a merger, acquisition, or sale of assets, with notice to users.
• We do not use Google user data for purposes unrelated to improving Synera Email's user-facing features.
• We do not allow humans to read Google user data unless we have obtained the user's affirmative consent to read specific messages, it is necessary for security purposes (such as investigating abuse), it is required to comply with applicable law, or the data has been aggregated and anonymized. In the ordinary course of Synera Email's operation, no person at Pathfinder Labs has access to your Google user data, because that data never leaves your PC.

4. Google user data we access and why

When you connect a Google account, Synera Email requests the following OAuth 2.0 scope:

Through this scope the add-in can read message headers, bodies, attachments, and folder/label metadata from your Gmail mailbox, and can send messages on your behalf. All such access happens on your PC in memory, only at the moment a workflow node runs, and only against the account you authorized.

5. Microsoft user data we access and why

When you connect a Microsoft account (personal or work/school), Synera Email requests the following OAuth 2.0 scopes via the Microsoft identity platform:

• https://outlook.office.com/SMTP.Send — send messages on your behalf when a Send Email node runs.
• https://outlook.office.com/IMAP.AccessAsUser.All — read your Outlook mailbox via IMAP when an IMAP Monitor node runs.
• https://outlook.office.com/POP.AccessAsUser.All — retrieve messages from your Outlook mailbox via POP3 when a POP3 Retrieve node runs.
• offline_access — allow the add-in to refresh its access token so workflows can run unattended.

When Synera Email is used inside an organization's Microsoft 365 tenant, the organization's tenant administrator is the controller of mailbox contents. Pathfinder Labs does not process or store mailbox data on its own infrastructure.

6. Custom (non-OAuth) connections

Synera Email also supports manual SMTP/IMAP/POP3 connections to any mail provider (including iCloud, Zoho, and self-hosted servers). For these connections the add-in stores the username and password you enter, encrypted at rest with DPAPI under %LOCALAPPDATA%\Synera\SyneraEmail\. Pathfinder Labs does not receive these credentials.

7. How your data is handled, stored, and transmitted

• Processing location. All operations happen on your Windows PC. Mailbox data, tokens, and credentials are never transmitted to Pathfinder Labs servers because the add-in has no such servers.
• Token storage. OAuth access and refresh tokens are written to %LOCALAPPDATA%\Synera\SyneraEmail\Tokens\, encrypted at rest using the Windows Data Protection API (DPAPI), scoped to the current Windows user account.
• Password storage. Passwords for custom SMTP/IMAP/POP3 connections are encrypted in the same manner under %LOCALAPPDATA%\Synera\SyneraEmail\.
• Transport security. All traffic between the add-in and Google or Microsoft endpoints uses TLS. The add-in does not downgrade to plaintext for OAuth providers.
• In-memory handling. Mailbox contents are held in memory only as long as a workflow node requires them and are not persisted by Synera Email after the node completes.

8. Optional token embedding in .syn workflow files

Synera workflows are designed to run both interactively and unattended (for example, on a Synera Run server). To support unattended execution, Synera Email offers an optional behavior: OAuth tokens and the associated OAuth client identifiers can be serialized into the .syn workflow file so the workflow can re-authenticate without an interactive browser prompt.

When you enable this option for a given workflow, you are responsible for safeguarding that .syn file as you would any file containing credentials. We recommend storing such files only in access-controlled locations (for example, a private source-control repository or a build system's secrets store). Revoking the relevant OAuth grant at Google or Microsoft (see Section 10) invalidates any tokens embedded in a .syn file.

9. Data we do not collect

• We do not collect telemetry, analytics, or usage data from the add-in.
• We do not collect crash reports automatically.
• We do not scan, index, or retain your email content.
• We do not profile users, build inferences, or sell any data.

The parent Synera application and Windows operating system may collect their own data under their own policies; those are governed by Synera and Microsoft, respectively.

10. How to revoke access and delete data

Revoke Google access. Visit myaccount.google.com/permissions, locate "Synera Email," and remove access. Refresh tokens are invalidated immediately by Google.

Revoke Microsoft access. Visit myapps.microsoft.com → Manage your apps. Tenant administrators can revoke consent organization-wide via the Enterprise Applications blade in the Microsoft Entra admin center.

Delete locally-stored data. Delete the folder %LOCALAPPDATA%\Synera\SyneraEmail\ on your PC to remove all cached tokens and encrypted credentials. Uninstalling the add-in has the same effect.

Because Pathfinder Labs holds no user data on its own systems in connection with the add-in, there is no server-side data for us to delete. If you have contacted us by email (for example, for support) and want that correspondence deleted, see Section 14.

11. Security

• OAuth tokens and passwords are encrypted at rest using the Windows Data Protection API (DPAPI) with an application-specific entropy value and CurrentUser scope.
• Connections to mail servers use TLS; plaintext fallback is not used for the Google or Microsoft OAuth flows.
• We manage the OAuth client credentials the add-in ships with. If we become aware of a compromise, we will rotate them and notify affected users through an add-in update.
• No service is perfectly secure. We do not guarantee that locally-stored credentials or mailbox contents cannot be obtained by malware or another user with administrative access to your PC.

To report a security vulnerability in Synera Email, email matthew@pathfinderlabs.ai.

12. Your rights under GDPR and UK GDPR

If you are in the European Economic Area, the United Kingdom, or Switzerland, you have rights under the General Data Protection Regulation (or the equivalent UK or Swiss law) with respect to personal data we process. Because Synera Email processes personal data only on your own device and does not transfer it to Pathfinder Labs, our role is that of a software vendor; the controller of mailbox data is you (or, where the add-in is used inside an organization, your employer or the tenant administrator).

If you contact Pathfinder Labs directly — for example by email — we become a controller of that correspondence. You may at any time request access to, correction of, deletion of, restriction of processing of, portability of, or objection to the processing of personal data you have sent us. Contact matthew@pathfinderlabs.ai. You also have the right to lodge a complaint with your supervisory authority.

13. Your rights under US state privacy laws

If you are a resident of California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, Virginia, or another US state with a comprehensive privacy law, you have rights that may include: the right to know what personal information we have collected, the right to delete that information, the right to correct inaccuracies, the right to opt out of the sale or sharing of personal information, the right to limit the use of sensitive personal information, and the right to non-discrimination for exercising any of these rights.

We do not sell or share personal information as those terms are defined under the California Consumer Privacy Act (as amended by the California Privacy Rights Act) or analogous US state laws. We do not use sensitive personal information for purposes other than those permitted without a right-to-limit request.

To exercise any of these rights, email matthew@pathfinderlabs.ai. We will respond within the time frames required by applicable law and will not discriminate against you for exercising your rights.

14. Data we receive when you contact us

If you email Pathfinder Labs for support, we receive the email address, name, and content you send. We use that information only to respond to you and to keep a record of support history. We retain support correspondence for as long as reasonably necessary — typically no more than three years — and delete on request.

15. Children

Synera Email is a business tool intended for engineers and is not directed to children under 16. We do not knowingly collect personal information from children.

16. International users and data transfers

Because Synera Email processes mailbox data on your own device, Pathfinder Labs does not make international transfers of mailbox data. Traffic between your PC and your mail provider (Google, Microsoft, or a custom server) is governed by the provider's own privacy policy.

17. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date above and, where appropriate, surface a notice in an add-in release. Continued use of Synera Email after changes take effect constitutes acceptance of the updated policy.

18. How to contact us

Pathfinder Labs
Email: matthew@pathfinderlabs.ai
Web: pathfinderlabs.ai