Privacy Policy

Polygloat — Last updated: August 2026

1. Who We Are

Polygloat is operated by Polygloat, a sole proprietorship (eenmanszaak) based in Amsterdam, the Netherlands. We are the data controller for the personal data described in this policy.

For privacy questions or requests, contact us at: legal@polygloat.com

2. What Data We Collect and Why

Account data

• Username — your unique identifier within the app, publicly visible
• Display name — the name shown on your profile, publicly visible
• Email address — used solely to send you a login link. Not shown to other users.
• Profile avatar — an optional photo or image you choose to upload
• Bio and social links — optional profile fields, publicly visible
• Age confirmation — a timestamp recording that you affirmed being 16 or older when you signed up — see section 9.

Technical data

• Timezone — collected to schedule your spaced repetition reviews at the correct local time. This is a functional requirement of the app.
• Push notification token — if you grant permission for push notifications, we store a device token linked to your account so we can deliver reminders and update notifications. You can disable push notifications at any time in your device settings.
• Crash and performance diagnostics — if the app crashes or runs slowly, a diagnostic report (device model, OS version, app state, network timings) is collected via Firebase so we can find and fix the problem. Crash reports are tagged with your user ID so we can investigate issues affecting your account.

Device permissions

When you upload content, the app may request access to:

• Camera — to record a video directly in the app
• Microphone — to capture audio during recording
• Photos — to select a video or image from your library

These permissions are used only for the purpose you grant them. We do not access these resources in the background.

Learning activity data

• Watch history — which videos you watched, when, and for how long, including playback segments
• Vocabulary state — which words (lemmas) you have encountered, and when they are scheduled for review
• Interactions — videos you liked, profiles you visited, users you blocked, and reports you submitted
• Content you create — videos, transcripts, and associated metadata if you upload to the platform

We collect learning activity data because it is the core of the Polygloat service. Without it, personalised video recommendations and spaced repetition scheduling cannot function.

What we do not collect

We do not collect your real name, date of birth, phone number, precise location, or payment information.

3. Legal Basis for Processing

We process your data on the following legal bases under GDPR:

• Performance of a contract — account data, timezone, and learning activity data are necessary to provide the service you signed up for
• Legitimate interest — analysing usage patterns and crash/performance diagnostics to improve the app, enforcing these terms against abusive users, and ensuring platform integrity
• Consent — push notifications and optional device permissions (camera, microphone, photos)

4. Third-Party Services

We use the following third-party services (data processors) to operate Polygloat. Each acts on our instructions and under a data processing agreement.

• Supabase — hosts our database, authentication, and storage services in the European Union (EU region). Your account data and learning activity data live here.
• Cloudflare R2 (US provider) — stores the video, audio, and avatar files themselves.
• Google Firebase (US) — four narrowly scoped services: Cloud Messaging delivers push notifications (receives your device push token); Analytics receives events about the upload flow, with no personally identifying parameters; Crashlytics receives crash reports tagged with your user ID; Performance Monitoring receives network and app timing measurements.
• Deepgram and Soniox (both US) — transcribe the audio of uploaded videos (speech-to-text). An uploaded video is personal data of the people in it: it contains the uploader's face and voice, and it is that voice which is sent for transcription. Under Soniox's terms, Soniox retains uploaded media until deletion is requested.
• ElevenLabs (US) — aligns uploaded audio with its transcript (forced alignment) to produce word-level subtitle timing.
• Google Translate (US) — translates sentence text from content, including translations you request on demand in the app.
• OpenAI and Anthropic (both US) — language processing of content text: transcripts, dictionary glosses, and example sentences. They never receive private messages — Polygloat has none — and uploaded content is public by design.
• Amazon Web Services (US) — generates reference pronunciation audio (Polly text-to-speech) and stores the generated files (S3). Only dictionary text is involved — no personal data.
• SMTP2GO (New Zealand) — sends our transactional email: login codes and launch-list emails. Receives your email address.
• Google Cloud Run (US) — runs the natural-language-processing services that analyse content text.

We do not sell your data. We do not use your data for advertising.

5. Data Retention

When you delete your account, we delete the following within 30 days:

• Your username, display name, bio, and email address
• Your profile avatar and any social links on your profile
• Your notification settings and push notification tokens
• Your social connections (accounts you follow and your followers), your activity feed, and your saved collections
• Any video files you uploaded (unless you choose to keep them anonymously — see the Content Upload Policy)

Your learning activity data (watch history, interactions, vocabulary state) and the transcriptions and vocabulary analysis of videos you uploaded are retained only in de-identified form: the identifiers listed above are deleted, and what remains is held under a random internal identifier that is not connected to your name, email address, or any other identity data. We commit to never attempting to re-identify this data.

We retain this de-identified data under Articles 17(3)(d) and 89(1) GDPR (retention for statistical purposes, with safeguards) and use it solely for aggregate statistics and to improve the learning system — for example, modelling how difficult words are for learners in general. It is never used to make decisions about you, and it is never shared in a form that could identify anyone.

Some records are kept for legal reasons in restricted form: proof that you accepted our terms, reports you submitted, blocks you created, and moderation records. These are kept only while a legal need exists — such as demonstrating compliance or handling a dispute — and we review at least every 24 months whether that need still applies. Security logs (such as authentication logs) are kept for up to 12 months.

6. Your Rights Under GDPR

As a user in the European Union you have the following rights:

• Access — request a copy of the data we hold about you
• Rectification — request correction of inaccurate data
• Erasure — request deletion of your data (right to be forgotten)
• Portability — receive your data in a machine-readable format
• Objection — object to processing based on legitimate interest
• Restriction — request that we limit how we use your data

To exercise any of these rights, contact us at legal@polygloat.com. We will respond within 30 days.

You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) at autoriteitpersoonsgegevens.nl.

7. Data Security

We implement appropriate technical and organisational measures to protect your personal data. Access to personal data is restricted to systems that require it to function.

8. International Transfers

Your data is primarily stored within the European Union (Supabase, EU region). However, several of the providers listed in section 4 are based in the United States and process content or telemetry there. For those transfers we rely on the safeguards required by GDPR:

• Google, Amazon Web Services, Cloudflare, and ElevenLabs are certified under the EU-U.S. Data Privacy Framework.
• OpenAI, Anthropic, and Deepgram process data under the EU Standard Contractual Clauses. Soniox processes data under Standard Contractual Clauses or another appropriate safeguard mechanism.
• SMTP2GO is based in New Zealand, which the European Commission has formally recognised as providing adequate data protection (an adequacy decision).

You can obtain a copy of the relevant safeguards by contacting legal@polygloat.com.

9. Children

Polygloat is not directed at children under 16, and you must be 16 or older to create an account (Terms of Service, section 3). This requirement is stated next to the signup button, and creating an account affirms it; we record only a timestamp of that affirmation. We do not ask for or store your date of birth. Where Apple's App Store or Google Play provide an age signal indicating a user is under 16, we refuse or block the account. If we learn that an account belongs to someone under 16, we will delete it. Parents or guardians can contact us at legal@polygloat.com.

10. A Note on AI

Parts of the learning content in Polygloat — transcripts, translations, dictionary glosses, and example sentences — are machine-generated with AI assistance and curated by humans. Polygloat has no AI chat, and we make no automated decisions about you that produce legal or similarly significant effects (GDPR Article 22).

11. Cookies on Our Website

The Polygloat website uses a single functional cookie that remembers your language preference. We do not use analytics or tracking cookies.

12. Changes to This Policy

When we make material changes to this policy that affect how we collect or use your data, we will ask you to review and accept the updated version before continuing to use the app.

13. Contact

legal@polygloat.com