Privacy Policy

Effective Date: November 1, 2026

Cynosure is operated by A3RN LLC ("A3RN," "we," "us," or "our") and is built with privacy at its core. This Privacy Policy applies to users of the Cynosure application ("Service") within the United States. This policy explains what data Cynosure collects, how we use it, and how we protect it. Our end-to-end encryption architecture is designed so that we cannot read your personal content.

You sign in to Cynosure with an A3RN account, which A3RN operates at auth.a3rn.com and which works across A3RN products. Your A3RN account itself — how you sign in, and the profile you register with — is covered by the A3RN Account Privacy Policy. This policy covers the data Cynosure holds.

1. Data We Collect

From Your A3RN Account

When you first sign in, Cynosure receives the following from your A3RN account and keeps a copy so it can show it to you and contact you:

Your A3RN account identifier
Email address
Your name, as it appears on your A3RN account (the first and last name you registered with)

Cynosure also records the date your Cynosure account was created and when you last used it. Your passkeys and other sign-in credentials are held by the A3RN account service, not by Cynosure.

Encrypted Content

The titles, descriptions, and details of your visions, goals, and activities are encrypted on your device using AES-256-GCM before being transmitted to our servers. We store this data as encrypted blobs that we cannot decrypt. Scheduling metadata needed to sync across devices (such as recurrence rules and timestamps) is not end-to-end encrypted.

Device Information

A device identifier generated by the app, and the device's name, used to register the device for multi-device sync and notifications
Device type and operating system (for multi-device sync)
App version
Platform (iOS, Android, or Web)

Security Records

When you set up, verify, or reset end-to-end encryption, request a data export, delete your Cynosure data, or change the members of an Enterprise group, Cynosure records the action with the IP address and the browser or app (user agent) it came from. These records protect your account and help investigate misuse.

Support Requests

When you contact support through the app, Cynosure keeps what you submit — your name, email address, subject, message, and category — together with the app version and platform, so we can respond and follow up.

People You Invite

When you invite someone to a shared team, or an Enterprise administrator adds a member to a group, Cynosure stores that person's email address and sends them an email about the invitation.

Usage Preferences

AI features opt-in status
Diagnostic reporting preference
Archive retention duration
Biometric authentication preference

2. End-to-End Encryption

Cynosure uses mandatory end-to-end encryption with keys derived from your recovery phrase using industry-standard key derivation. Your encryption keys never leave your device. Our servers store only encrypted data that we cannot read, access, or decrypt.

3. How We Use Your Data

We use your account information to:

Recognise you when you sign in with your A3RN account
Invoice and administer Enterprise plans
Sync your encrypted data across your devices
Respond to support requests submitted through the app
Send emails you or your team need, such as team invitations, Enterprise group notices, and notice that your encryption was reset
Protect your account and the Service from misuse, using the security records described in Section 1

4. Third-Party Services

Enterprise Billing

Cynosure has no in-app purchases and no web checkout, and A3RN does not collect payment card details. For Enterprise plans, which A3RN invoices directly, A3RN retains only the contact and billing information necessary to invoice and manage the plan.

Service Providers

Two service providers process data on A3RN's behalf, only to provide the Service:

Email delivery: emails Cynosure sends go through an email delivery provider, which receives the recipient's email address and the content of the message
Network protection: requests to Cynosure pass through Cloudflare, which processes IP addresses and request details to deliver traffic and to block abuse

AI Features

A3RN may offer AI-powered features that process data on your device using platform-provided capabilities (Apple Foundation Models on iOS; Google Gemini Nano on Android and in Chrome). When AI features run on-device, no content is sent to external servers. If Cynosure introduces AI features that require server-side processing in the future, this policy will be updated accordingly.

Diagnostic Reporting

Cynosure sends diagnostic reports to A3RN's own servers to detect and fix faults: application errors, application crashes, warning and error messages written by the app, and performance measurements such as memory use and page load timing. These reports are generated using the Grafana Faro software development kit and are transmitted only to infrastructure operated by A3RN. They are not sent to Grafana Labs or to any other third party.

Diagnostic reports are associated with your account identifier so that repeated faults can be recognised as affecting one account. They do not include your email address, and they do not include your visions, goals, or activity content, which remain end-to-end encrypted. Automated masking is applied before transmission to remove email addresses that would otherwise appear in message text.

Diagnostic reporting is enabled by default and can be switched off at any time in Settings under Preferences, using the "Share Diagnostic Reports" control. The setting applies to your account and therefore to every device you sign in on. While it is switched off, no diagnostic reports are transmitted and your account identifier is not attached to any report.

5. Data We Do NOT Collect

As of the effective date of this policy:

We do not use advertising or tracking SDKs
We do not collect behavioural or product analytics: we do not record which screens you visit, which buttons you press, or how you navigate the app
We do not send any data to third-party analytics providers; the diagnostic reporting described in Section 4 goes only to A3RN's own servers
We do not use cookies beyond secure session tokens
We do not collect location data
We do not sell or share your data with advertisers
We do not use tracking pixels or fingerprinting
Biometric data (Face ID, Touch ID) is processed on-device only and never sent to our servers
The camera is used only to scan the QR code that moves your encryption keys to a new device. Images are processed on the device and never sent to our servers

These practices may change over time. Any material changes will be reflected in an updated version of this policy.

6. Do Not Sell or Share

A3RN does not sell, rent, or share your personal information with third parties for their marketing purposes. We do not use or disclose sensitive personal information for purposes other than providing the Service.

7. Data Retention

We retain your data in accordance with our retention practices, which vary by data type:

Deleted items: Visions, goals, and activities you delete are retained during a soft-delete period, then permanently removed. Deleting your Cynosure data, or your A3RN account, removes your Cynosure data immediately (see Section 8)
Temporary data (authentication tokens, data exports, access codes): Retained briefly after use or expiry
Operational data (audit logs, sync history): Retained for a limited period
Archived tasks: Retained based on your configured preference
Shared team content: Content you contribute to a shared team owned by another user is retained by the team owner if you leave or delete your account. Your author reference is removed

A3RN reserves the right to adjust retention periods at any time. Data may be retained longer than indicated if required by law or necessary to resolve disputes.

Service Discontinuation: If A3RN permanently discontinues the Service, A3RN may provide advance notice to allow you to export your data, but is not obligated to do so. Following discontinuation, user data will be deleted from our servers in accordance with our retention practices.

8. Account Features

A3RN provides the following account management features:

Access: View all data associated with your account
Export: Download data from your personal workspace and shared teams you own in JSON format at any time
Delete your Cynosure data: In Settings, "Delete My Cynosure Data" permanently deletes your Cynosure data, including all data from teams you own. Your A3RN account stays active, so you can keep using other A3RN products, and signing in to Cynosure again later starts a new, empty account
Delete your A3RN account: Deleting your A3RN account at auth.a3rn.com/account also deletes your Cynosure data, along with your data in every other A3RN product. See the A3RN Account Privacy Policy
Correct: Update personal information in your account settings
Opt out: Disable AI features and diagnostic reporting at any time

These features are provided as part of the Service and may be modified or discontinued at any time in accordance with our Terms of Service. To use these features, access the relevant options in your account settings.

9. Security Measures

Transport: All communications use encrypted transport (HTTPS)
Encryption at rest: Server-side database encryption
End-to-end encryption: Industry-standard encryption for all user content
Authentication: Through your A3RN account, with passkeys or a password stored only as a salted hash
Token security: All tokens are cryptographically hashed before storage
Access control: Security controls ensure users can only access their own data
No backdoors: Even Cynosure staff cannot decrypt your encrypted content

Breach Notification: No system is completely secure. In the event of a security breach that affects your personal data, A3RN's notification obligations are limited to those imposed by applicable U.S. state law. Because your content is end-to-end encrypted, a server-side breach would not expose the contents of your visions, goals, or activities. However, the copy of your account details Cynosure holds (email address and name), device information, security records, support requests, the email addresses of people invited to teams or Enterprise groups, and scheduling metadata (such as recurrence rules and timestamps) could be affected. A3RN makes no guarantees regarding the timeliness of breach detection or notification beyond what is required by law.

Security Monitoring: By using the Service, you consent to A3RN logging, monitoring, and analyzing usage patterns, access logs, and system activity for security, fraud prevention, abuse detection, and service integrity purposes. This monitoring may include automated analysis of login patterns, API usage, device information, and IP addresses. Security monitoring data is retained in accordance with the schedules in Section 7 and is not used for advertising or sold to third parties.

10. Age Restriction

The Service is intended only for users aged 16 and older who are residents of the United States. We do not knowingly collect personal information from anyone under 16. If we learn that a user under 16 has created an account, we may terminate that account and delete associated data without notice.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify you through the app. Your continued use of the Service after changes take effect constitutes acceptance of the updated policy.

12. Contact Us

If you have questions about this Privacy Policy or how your data is handled, please contact us through the Contact form in the app settings or email us at .