Privacy Policy

Text you paste into the Propaganda Detection tool is not stored on our servers — but it is sent to Google (Gemini) to be analysed. We do not store your IP address.

If you create an account, we store your email address. We don't sell data, don't show ads, and don't send marketing email.

This site is built and operated by the Syto project (syto.digital), an independent research effort on information operations. For anything about privacy, your data, or material published here, write to support.specialcat@gmail.com. We answer every such message.

We store your email address, an encrypted password (we never see the plain one), the date the account was created, and a role (ordinary user or administrator). Nothing else about you is stored — no phone number, no postal address.

If you sign in with Google, we receive and store your address and the basic profile details Google shares — your name and profile picture. We get no access to your mail, contacts, or anything else.

Authentication is handled by Supabase. Your session is kept in cookies that are required for sign-in to work at all.

The tool is available to registered users only — you need to be signed in to use it.

When you submit text, it is sent to Google (the Gemini API) for analysis and is not stored by us. We keep only a minimal record that a check happened: which manipulation techniques were found (their codes and sentence numbers), which narrative it matched, and what the request cost. That record is linked to your account. The text itself is not in there.

When you submit a link, we fetch the page from our server — not from your device, so your IP is never revealed to that site — and cache the result for about 30 days: the address, a fingerprint of the content, a one-line summary of the theme, and the analysis, which contains short quoted fragments from that page. This exists so the same address isn't paid for twice.

Please don't paste other people's personal data, medical information, or anything you aren't entitled to share with a third party: everything you submit reaches Google.

Essential cookies keep you signed in. Without them authentication cannot work. One more value — your light/dark theme choice — is kept locally in your browser and never sent anywhere.

Preference cookies are two de-identified values that make the site easier to use and identify nobody. The first remembers which focus you read last (Ukraine, the USA, the United Kingdom, Germany or Poland) so the site opens there next time; you change it at any moment simply by opening a different focus. The second is your two-letter country code, worked out from the network address your request arrives with. It decides whether analytics loads at all, and on a first visit it also picks which focus the site opens on — after that the first value decides, and one click on any focus changes it.

Google Analytics 4 runs on the live site only and counts de-identified events: page views, that a tool check happened (input type, outcome, how many techniques were found), link copies, and completed sign-ups. We deliberately send no content — no pasted text, no submitted links, no email addresses. There is no advertising or remarketing.

The site currently shows no cookie-consent banner. You can switch analytics off for yourself with Google's official opt-out add-on or a browser blocker.

We send only transactional email: address confirmation and password reset, delivered by Resend from noreply@syto.digital. Open and click tracking are switched off — we cannot see whether you opened a message. We run no mailing list.

Supabase — database and authentication (your address, your session). Servers in Frankfurt (EU).

Vercel — site hosting, Frankfurt (EU) region. Technical logs may briefly contain IP addresses and requested URLs.

Google (Gemini API) — analysis of submitted text, or of the page behind a submitted link.

Google Analytics — de-identified visit statistics.

Resend — delivery of transactional email.

X (Twitter) API — only when you submit a link to an X post, to retrieve its text.

Fly.io — the monitoring pipeline's server (Frankfurt). It processes no visitor data.

Tool check records — 30 days.

Cached link results — about 30 days after the last use.

Daily quota counters — 7 days.

Your account — until you delete it. Write to support.specialcat@gmail.com and we will delete the account and the data tied to it.

Collected public posts (monitoring) — indefinitely — this is a research archive (see the next section).

An honest caveat: expired records are removed by a daily background job. If it fails to run, data can outlive the windows above.

For readers in the EU and the UK, data-protection law (the GDPR) asks us to name a legal basis for each way we use data. Here they are, in the same plain terms as the rest of this page.

Keeping our agreement with you. Your account (the email address, the session) and the transactional email exist because you asked for an account — we process that data to provide exactly the service you requested.

Legitimate interest. The minimal tool-check records and quota counters protect a paid, abusable service from misuse and runaway cost. The archive of public posts serves our public-interest research into information operations, with the safeguards described under “Monitoring of public sources”: public posts only, paraphrase instead of quotation, no ordinary users, and no attempts to identify anyone. You can object to any of these uses — write to support.specialcat@gmail.com and we will consider it on the merits.

Analytics needs no basis here, because it does not run. For visitors from the EU and the UK, Google Analytics is simply never loaded and no analytics cookies are set. Where it does run (elsewhere in the world), it counts the de-identified events listed above, and that also rests on legitimate interest.

You can ask for a copy of your data, for corrections, for deletion, or object to a particular use. Write to support.specialcat@gmail.com — there is no self-serve form, deliberately: the volume is small and we answer personally. If you believe we process data unlawfully, you have the right to complain to a data-protection supervisory authority.

Syto's main activity is research into information operations. We systematically collect public posts from the open channels, accounts and feeds we monitor, store their text and metadata (publication time, view counts, the source's follower count), and publish aggregated analysis. The source registry is open — you can see it under About the project.

Some of those sources are personal accounts of public figures — state officials, state-media staff, and commentators. We process only what they published publicly themselves, and only for a public-interest purpose: understanding how coordinated narratives spread. Being monitored is not an allegation about the account holder. We do not collect ordinary users' posts, comments or replies, collect no images, and make no attempt to identify the person behind an anonymous account.

In what we publish we paraphrase rather than quote verbatim, and we never link to hostile sources. If you believe a specific item concerns you personally and was published in error, write to support.specialcat@gmail.com and we will consider it on the merits.

The site is intended for an adult audience — journalists, researchers, analysts. We do not knowingly collect children's data and do not target content at them.

If this policy changes we update the date at the top. For material changes — a new recipient of data, for instance — we notify account holders by email. The terms of use live on the Terms of Service page.