Synthesis Lab · last updated 14 October 2026
This policy says what Synthesis Lab stores, why, who else sees it, and how to get it removed. It is written to be read, not to be skimmed past.
Your account: name, email address, a password hash (never the password), sign-in method (email, Google or ORCID), and the plan you are on.
Your research: projects, manuscripts and their version history, the sources you add (metadata, and the full text or PDF where you or the open-access record supplied it), notes, figures, analysis scripts, notebooks and their outputs, peer reviews, and the knowledge graph built from your sources.
A record of changes: every edit to a manuscript made by an AI assistant or by the app is logged with who asked for it, which client or model made it, when, the stated reason, and the exact text that changed. This is what lets you audit what an assistant did.
Usage and billing: which AI models were used, token counts and cost per request, credits and allowances, and Stripe's references to your subscription. Card numbers never reach us; Stripe holds them.
Connected apps: when you connect an AI client over MCP, we store the authorization you granted (which projects, read or write, compute or not) and log every tool call with the client's name, so you can see and revoke it under Settings → Connected apps.
Problem reports: when something in the app breaks or gets in your way, the assistant can report it to us for you: what kind of problem, a short description of what the app did, and the steps. Reports never contain your research text (one that quotes your manuscript, sources or notes is refused), and you can turn them off in Settings.
Technical records: server logs with IP address and request paths, kept briefly for security and debugging.
We use your data to run the product for you: store and version your work, run the checks and reviews you ask for, bill correctly, keep your account secure, and answer support requests. We do not sell your data, and we do not use your manuscripts, sources or notes to train models.
AI model providers. When you use an AI feature, the relevant text (a manuscript section, a source excerpt, a question) is sent to the model you or the app chose: through OpenRouter, or directly to Anthropic, OpenAI, Google or xAI, or to a key you supplied. Their handling is governed by their terms; we choose providers that do not train on API traffic by default. If you connect your own AI client over MCP, that client's provider sees what the client requests.
Infrastructure. Our servers and database run on DigitalOcean. Heavy document conversion and sandboxed compute run on Modal. Email is sent through Resend. Payments are handled by Stripe.
Integrations you turn on. Zotero, Consensus, Google Drive and similar services receive only what the integration needs, and only after you connect them.
People you share with. If you share a project, the people you add see what their role allows: viewers read, commenters add notes, editors change the manuscript and use the AI on your allowance, admins also manage sharing. The edit ledger shows them who changed what.
One session cookie keeps you signed in. Stripe sets its own cookie on the checkout and billing pages. We do not run advertising or cross-site tracking.
Your research stays as long as your account exists. Deleting a project removes it and everything in it. Server logs are rotated within weeks. Billing records are kept as long as the law requires.
You can export your manuscripts or download a whole project as a zip at any time, delete projects yourself, choose which comment emails you get, revoke connected apps, and remove integrations. To delete your account and all its data, or to get a copy of everything we hold about you, email support@synth-lab.com from your account address; we act within 30 days.
Connections are encrypted in transit. Passwords are hashed with bcrypt. Integration tokens are encrypted at rest. Sign-in from AI clients uses OAuth with PKCE, short-lived access tokens and rotating refresh tokens; the client never sees your password.
When this policy changes we update the date above and, for material changes, tell signed-in users in the app. Questions go to support@synth-lab.com. See also the terms of service and how we handle research integrity.