Privacy Policy

Effective 11 November 2026. This policy covers the Halo by Synquic app for Mac and Windows, Halo accounts and sync, Halo Cloud and this website. Halo is made by Synquic, India. Contact: support@synquic.com.

In short

• Your passwords, SSH keys, bookmarks, history and settings are encrypted on your device, with an account key we never receive, before they reach our servers. We cannot read them.
• Halo AI and Halo Voice run on your computer. A request reaches our servers only when you allow Halo Cloud.
• We do not sell personal information, show ads, or collect analytics or crash reports in Halo.

Information we collect

Account. Your email address and name. You sign in with a 6-digit code sent to your email, or with Google, so there is no password. We keep each code only as a hash, and it expires after 10 minutes. We also keep your public key and your private key encrypted with your account key, and, for your recovery key, a verifier and an encrypted copy of your account key. We never receive your account key or recovery key. Accounts made with a master password before this change also keep the encrypted keys that password protects, and we never receive the password.

Device approvals. When you add a device, we keep its name and public key while the device is trusted, and any pending approval request.

Synced data. Your vault (logins, cards, notes, SSH hosts and keys), bookmarks, history, pinned sites and settings, stored only as ciphertext we cannot decrypt.

Devices and sessions. A random device ID, your computer's name, sign-in and last-active times, and session tokens, which we store only as hashes.

Teams. Team names, members' email addresses and roles, invitations, and the team's shared items as ciphertext.

Sign in with Google. If you choose it, Google gives us your email address, whether Google has verified it, and your Google account ID. We store the Google account ID to link it to your Halo account. We do not receive your Google password, and we do not access your Gmail, contacts, files or any other Google data.

Halo Cloud. When Halo Cloud is on and Halo AI on your computer cannot finish a task, the request, recent messages in that chat and the page content needed for it (for example the page text and its buttons) are sent to our server and to Amazon Web Services to produce an answer. We do not store or log this content. We count requests per account to apply usage limits. You can turn Halo Cloud off in Settings, and private windows never use it.

Technical data. Our servers see your IP address when the app or this website connects. We use it to deliver the service and to limit abuse; rate-limit counters are kept in memory, and IP addresses may appear in short-lived server logs.

What stays on your device

Your browsing and the pages you visit, your passwords in readable form, your account key and recovery key, voice audio, Halo AI requests answered on your computer, data imported from other browsers, and everything in private and Tor windows stay on your device and are not sent to Synquic.

How we use information

We use the information above to provide accounts, sign-in, sync and teams; to answer Halo Cloud requests; to keep the service secure and prevent abuse; and to reply when you contact us. We do not use it for advertising, and we do not sell it or share it with anyone for advertising.

Google user data

Halo's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We use your Google email address and account ID only to sign you in to Halo and keep your account linked. We do not use Google user data for advertising, do not sell it, do not use it to train AI models, and do not let people read it except with your consent, for security, or when the law requires it.

Who else receives data

• Hosting providers that run our servers and store the encrypted data, the app installers and update information.
• Amazon Web Services, only for Halo Cloud requests, as described above.
• Google, when you use Sign in with Google. This website also loads fonts from Google Fonts, which receives your IP address.
• Hugging Face, from which Halo downloads Halo AI and Halo Voice once; it receives your IP address during the download.
• Like any browser, the websites you visit, the Chrome Web Store when you install extensions, and the Tor Project when you first use a Tor window receive the requests Halo makes to them.

We may disclose information when the law requires it, and we will tell you when we are allowed to.

Retention and deletion

We keep your account and encrypted data while your account exists. Items you delete in Halo are removed from sync. To delete your account and all its data, email support@synquic.com from your account's email address; we delete it within 30 days. Halo Cloud content is not stored.

Security

Encryption happens on your device with XChaCha20-Poly1305, connections use TLS, sign-in codes and session tokens are stored hashed, and sign-ins are rate limited. No system is perfectly secure; the security page describes the design and its limits.

Your rights

Depending on where you live, including under India's Digital Personal Data Protection Act and the GDPR, you may have the right to access, correct, export or delete your personal data and to withdraw consent. Email us to use these rights. You can also export your vault yourself in Settings, under Passwords.

Children

Halo is not meant for children under 13, or under the minimum age in your country, and we do not knowingly collect their data.

International processing

Our providers may process data in countries other than yours. Your synced data stays encrypted wherever it is stored.

Changes

We will post changes on this page and update the date at the top. For significant changes we will also tell you in the app.

Contact

Synquic, India. support@synquic.com