Privacy policy

Polygossa is a language-learning reader. This policy explains what we keep about you, why, who helps us run the service, and how to see, take or delete your data. The service is run by [company name, address], the data controller. Questions: [contact email].

What we keep

• Your account: email address, display name, profile photo if you add one, the languages you learn and speak, your goals, time zone and settings.
• What you do in the app: texts and audio you import, words and phrases you save with your notes, reviews, reading and listening progress, writing you submit, playlists, classes, forum posts, and likes.
• Signing in: your sign-in is handled by AWS Cognito, which keeps your email and a secure hash of your password (we never see the password), or your Google identity if you sign in with Google.
• Technical logs: server logs with request details, kept for one month to keep the service running and secure.

Why (legal basis)

• To provide the service you signed up for (performance of a contract): your account and everything you create in it.
• To keep the service secure and working (legitimate interest): logs, abuse prevention, moderation records.
• Paid plans, when they launch: billing records we must keep by law (legal obligation).

Who processes it, and where

• Amazon Web Services, Ireland (EU): hosting, database, file storage, sign-in (Cognito) and the emails Cognito sends (codes, password resets), and logs.
• Google: only if you choose Sign in with Google (your Google sign-in), and YouTube, which plays the videos you watch. YouTube's player is loaded from YouTube and may set its own cookies and see your IP address when a video plays.
• OpenAI (United States): the AI features (writing feedback, explanations, recommendations) send the text involved to OpenAI: your writing, the word or sentence being explained, and texts being imported or shared. Your vocabulary is never sent. The transfer is covered by [the EU Standard Contractual Clauses / OpenAI's data processing addendum].
• Dictionaries (Free Dictionary API, Wiktionary): our server sends only the word you look up, never anything about you.
• Stripe: payments, once paid plans launch.

We don't sell your data or use it for advertising.

Cookies

We use only cookies the service needs: to keep you signed in (and, for ten minutes, to finish signing in), and to remember your theme and layout. Cognito sets its own cookies on its sign-in pages. We use no analytics or advertising cookies. YouTube may set cookies when you play a video (see above).

How long we keep it

Until you delete your account. Deleting it removes your data at once, including texts you shared with the community; copies in our database backups disappear as the backups expire (within [14] days). Logs are kept for one month.

Your rights

• See and take your data: Settings › Privacy downloads all of it as one file.
• Correct it: change your profile in Settings.
• Delete it: Settings › Privacy deletes your account and everything in it.
• Object or ask questions: write to [contact email]. You can also complain to your data protection authority (in Ireland, the Data Protection Commission).

Changes

If this policy changes in a way that matters, we'll tell you in the app before it applies.