Privacy

What is collected, where it goes, and how long it is kept. This describes what the software actually does.

Effective 28 September 2026.

In short

This website sets no cookies and stores nothing in your browser. It does measure basic usage and page performance — page views, a short fixed list of interaction events, and web-performance metrics — through analytics served from this domain by our host, described under “This website” below. Varra stores your account and your conversations, because a conversation that does not persist is not useful. Conversations are sent to a third-party AI model provider to generate replies. Nothing is sold, shared for advertising, or used to train models.

Who is responsible

Syntur is a working name for a venture that is not yet incorporated. Until incorporation, the party responsible for the data described here is Benson Kraft, contactable at benson@syntur.ai. This section will name the company once it is formed.

What this covers

Two services, which collect very different amounts. This website, at syntur.ai, and Varra, the AI agent at varra.carboncircuitintelligence.com. Lucentra is not a shipping product and collects nothing.

This website

No accounts, no advertising and no ad trackers, no cookies, and nothing stored in your browser — no local storage, no session storage, no identifier written to your device. You are not asked to accept anything, because there is nothing to accept.

This site does measure basic usage, and this is exactly what that is. Three kinds of data:

• Page views. For each one, our host records the page path (without the query string), the referring URL, and the country, operating system, and device or browser type it infers from the request.
• A fixed list of interaction events, defined in analytics.js, which you can read: which call-to-action was clicked, how far down the page was read (25/50/75/100%), and which sections came into view. Each event is a name off that list and nothing else — no page content, no free text, no form input — and each name is recorded at most once per page view.
• Web performance measurements. For a page view, how quickly the page rendered and responded — the Core Web Vitals (Largest Contentful Paint, Cumulative Layout Shift, Interaction to Next Paint) and related timings — recorded against the route they were measured on, together with the device and browser type, the approximate country, and a coarse description of the network connection. These are reported as aggregates: what comes back is how fast a page is, not who was on it.

This runs on Vercel Web Analytics and Vercel Speed Insights, both served from this domain rather than by a third-party tracking script, so your browser makes no request to another company. Vercel receives the data and distinguishes one visitor from another using a hash it derives from the incoming request, which includes your IP address, on its own servers. Vercel's documentation states that this hash is not shared between sites, that it is discarded after 24 hours, and that the recorded data is not associated with an IP address. It is not linked to a name, an email, or a Varra account.

To be accurate about what that means: this is pseudonymous measurement rather than anonymous in the strict sense. Within a single day, requests from the same network and browser resolve to the same hash, and so can be counted as one visitor. Across days, and across other sites, they cannot.

Typefaces are served from this domain rather than a font CDN, so rendering a page sends no request to any third party. The same is true of the Varra application: loading it contacts no third party either, and it carries no analytics at all, so nothing about you reaches anyone else before you have chosen to sign in.

What Varra collects

Account information. An email address, a display name, and either a password or a Google account identifier. Passwords are not stored. What is stored is a bcrypt hash with a per-password salt, which cannot be reversed into the original password.

Conversation content. The messages you send, the replies Varra returns, a conversation title, and the mode in use. This is retained so that conversations remain available across sessions.

Usage totals. Token counts per account, used to understand cost and load. These are aggregate numbers and contain no conversation content.

Gmail connection and approved emails, only if you connect Gmail. What that involves is described under “Gmail connection” below.

How it is used

To operate the service: authenticating you, returning your conversations, generating replies, and understanding load and cost. It is not used for any other purpose.

Who it is shared with

Third-party AI model providers. Varra's replies are generated by a third-party AI model provider. To produce a reply, your message and the earlier turns of that conversation are transmitted to that provider's API, and its handling of that data is governed by its own terms. The provider Varra uses is named on the Overview page.

Google, where you choose to sign in with Google. That sign-in requests three scopes — openid, email, and profile — and Google returns an account identifier, your email address, and your name.

Those three values are stored, and they are the only data retained from Google sign-in. They are used to create your account, recognise you on subsequent sign-ins, and address you by name in the interface. The profile scope also exposes a profile picture, locale, and given and family names; none of those are requested from the response, stored, or used. Signing in with Google does not give Varra access to Gmail. Connecting Gmail is a separate, optional step with its own Google permission request, described under “Gmail connection” below. No Google data is sold or used to train models.

Vercel, which hosts this website and provides the usage measurement described under “This website” above. It receives the page-view and interaction data for this site. It does not host Varra and does not receive Varra conversations or account data.

Service providers and infrastructure partners who host the application and database. They hold the data described above because they operate the systems it runs on. Their identities are available on request.

Information may also be disclosed where required by law.

Gmail connection

Varra offers an optional Gmail connection to eligible accounts. This section describes what the connection does for any account that connects one.

Google user data. The use of information received from Google Workspace scopes will adhere to the Google User Data Policy, including the Limited Use requirements.

What you authorise. Connecting Gmail is separate from signing in, and happens only if you start it and approve Google’s permission screen. It requests three scopes: openid, https://www.googleapis.com/auth/userinfo.email, and https://www.googleapis.com/auth/gmail.send, which Google describes as “Send email on your behalf.” If Google returns any other combination of scopes, the connection is refused and the grant is revoked.

What Varra can do with it. Send one plain-text email at a time from the connected address, to a single recipient, with a subject and a body of up to 4 KB and no attachments. Each send requires an approval of that exact email, recipient, subject and text, and each approval can be used to send once. Varra does not read your inbox, threads, drafts, labels, sent mail or attachments, and it does not create drafts, change labels, archive, forward or delete messages.

What is stored. For the connection: the Google account identifier and email address of the connected mailbox, the scopes granted, the connection’s state and dates, and a Google refresh token so the connection keeps working. The short-lived access token used to send is obtained when needed and is not stored. For each email: the approval record, which contains the recipient, subject and text you approved, and a send record containing the connected address, the time, the result, and the message and thread identifiers Gmail returns. Gmail message content is not otherwise stored.

Who receives it. The email is sent through Google’s Gmail API, which delivers it to the recipient. The Gmail connection and the sending of an approved email do not pass the email or your Gmail details to the AI model provider. Gmail data is not sold or used to train models.

Disconnecting. You can disconnect Gmail from Varra’s Connections settings. Disconnecting deletes the stored refresh token and asks Google to revoke it; the record of the connection, without the token, is kept until the account is deleted. You can also remove Varra’s access at any time from your Google Account’s settings for third-party access. Varra can then no longer send, and it discards the stored token the next time it tries.

Web search

Web search is not currently available in Varra, so no search terms leave the service. If web search is offered later, this notice will be updated before it is.

What is not done

Personal information is not sold, rented, or shared for advertising. No advertising or cross-site tracking technology is used on either service. Conversations are not used to train models.

Neither the website nor the application carries a third-party analytics or tracking script. The Varra application carries no usage analytics at all. This website's measurement is served from this domain and is described in full under “This website” above.

Your choices

A copy of everything held about you can be downloaded from the account menu inside Varra. It is a single JSON file containing your account details, every conversation with its messages, and your usage totals, along with any Gmail connection, approval and send records (never the stored token). Your password hash is deliberately not included: it is of no use to you and does not belong in a file you might send somewhere.

Deleting your account is also done from that menu, described below.

For correction of anything inaccurate, or anything the two buttons above do not cover, email privacy@syntur.ai. Requests are answered within 30 days.

Retention and deletion

Conversations can be deleted from within Varra. Deleting a conversation removes its messages from the database, not only from the list.

Deleting your account is done from the account menu inside Varra. It removes the account, every conversation, their messages, and the usage totals held against it, along with any Gmail connection, approval and send records. Varra also asks Google to revoke a connected Gmail grant. The action is immediate and cannot be undone.

If you would rather it were handled for you, email the address above and it will be.

Information is otherwise retained for as long as the account is active.

Security

Traffic is served over HTTPS. Passwords are hashed with bcrypt. Session cookies are HTTP-only and same-site, so they cannot be read by scripts running in the browser. A Gmail refresh token is encrypted by the application before it is written to the database, with a key that is not stored in the database.

No service can guarantee that a breach is impossible, and this policy does not claim otherwise.

Where data is processed

Data may be processed in the United States and in other countries where the providers above operate. Using the service involves that transfer.

Children

Varra is not directed at children under 13, and information from them is not knowingly collected. If such information has been collected, contact the address above and it will be deleted.

Changes

Material changes will be reflected in the effective date at the top of this page, and described here.

28 September 2026. Updated “Gmail connection”: the connection is now offered in the Varra interface to eligible accounts, the identity scope is listed under its canonical name, https://www.googleapis.com/auth/userinfo.email, and Gmail can be disconnected from Varra’s Connections settings.

27 September 2026. Added “Gmail connection”, describing the optional Gmail connection and what it accesses, stores and sends. The Google sign-in paragraph now says that signing in does not give Varra access to Gmail, and “What Varra collects”, “Your choices”, “Retention and deletion” and “Security” now cover Gmail connection records. The Gmail section also carries Google’s Limited Use statement for information received from Google Workspace scopes.

6 September 2026. The “This website” section was rewritten to describe the site’s usage measurement, which this policy previously described as absent. What the site collects did not change; the description of it did. Vercel is now also named under “Who it is shared with.”

Contact

Questions about this policy, or a request made under it: privacy@syntur.ai.

Anything else: benson@syntur.ai.