Privacy Policy

Polygloat — Last updated: October 2026

1. Who We Are

Polygloat is operated by Polygloat, a sole proprietorship (eenmanszaak) based in Amsterdam, the Netherlands. We are the data controller for the personal data described in this policy.

For privacy questions or requests, contact us at: legal@polygloat.com

2. What Data We Collect and Why

Account data

• Username — your unique identifier within the app, publicly visible
• Display name — the name shown on your profile, publicly visible
• Email address — used to sign you in: we send a login code to it, or receive it from Apple or Google when you sign in with them. Not shown to other users. If you sign in with Apple and choose to hide your email, we only receive a private relay address that Apple forwards to you.
• Sign in with Apple or Google — if you choose to sign in with Apple or Google, they confirm your identity to us and share an identifier for your account with them and your email address. Google also shares the name and profile photo link of your Google account; our authentication system stores them with your sign-in record, but we do not use or show them. For Sign in with Apple we also keep a token from Apple, used only to disconnect Polygloat from your Apple ID when you delete your account.
• Profile avatar — an optional photo or image you choose to upload
• Bio and social links — optional profile fields, publicly visible
• Age confirmation — a timestamp recording that you affirmed being 16 or older when you signed up — see section 9.

Technical data

• Timezone — collected to schedule your spaced repetition reviews at the correct local time. This is a functional requirement of the app.
• Device record — while you're signed in, we keep a record of the device you use the app on, linked to your account: its push notification token, whether it runs iOS or Android, whether notifications are switched on, the app version, and where the app was installed from (App Store, Google Play or a test build). We use it to deliver reminders and update notifications, and to see which versions of the app are still in use so we can fix problems and retire old versions safely. You can disable push notifications at any time in your device settings.
• Login email records — to stop our login emails being abused, we keep a record of each login email we send (when, and whether it was sent) for 30 days. It is stored under a scrambled, keyed form of your email address, not the address itself.
• Crash and performance diagnostics — if the app crashes or runs slowly, a diagnostic report (device model, OS version, app state, network timings) is collected via Firebase so we can find and fix the problem. Crash reports are tagged with your user ID so we can investigate issues affecting your account.

Device permissions

When you upload content, the app may request access to:

• Camera — to record a video directly in the app
• Microphone — to capture audio during recording
• Photos — to select a video or image from your library

These permissions are used only for the purpose you grant them. We do not access these resources in the background.

Learning activity data

• Watch history — which videos you watched, when, and for how long, including playback segments
• Vocabulary state — which words (lemmas) you have encountered, and when they are scheduled for review
• Interactions — videos you liked, profiles you visited, users you blocked, reports you submitted, and translations you opened
• Content you create — videos, transcripts, and associated metadata if you upload to the platform, and reactions you leave on other people's videos. A reaction is shown under the video with your username, to its creator and to other viewers, and the creator is notified of it.
• Reminder choices — when the app offered to turn on reminders, what you answered, and the moment of the day you said you would watch (for example "before bed"). We use it to time your first reminders and to see whether these offers help people keep learning.
• Invitations — when you use "Invite friends": from which screen and for which language, whether the share went through and to which app, and how many times your link was opened (not by whom). We use it to see how people find Polygloat.
• Announcements — when the app showed you a notice about something new (for example a newly available language), where it appeared (between videos or on the Progress tab, and how many videos into your session), and whether you opened it, closed it or scrolled past. We use it to avoid showing the same notice too often and to learn which notices are useful and where they disturb least; to learn that, where a notice appears in your feed can vary.
• Widgets — if you add a Polygloat widget to your home or lock screen: which widget sizes you added and when the app last saw them, how often you used the widget's next-word button, which of your words we sent to it, and which words you opened from it. The words a widget shows and your widget settings are kept on your device so the widget can show them, and are removed from it when you log out. We use this to keep the widget working and to learn whether it helps people remember words; to learn that, some of your words may be left off the widget.

We collect learning activity data because it is the core of the Polygloat service. Without it, personalised video recommendations and spaced repetition scheduling cannot function.

What we do not collect

We do not ask for your real name (Google shares it if you sign in with Google, see section 2), and we do not collect your date of birth, phone number, precise location, or payment information.

3. Legal Basis for Processing

We process your data on the following legal bases under GDPR:

• Performance of a contract — account data, timezone, and learning activity data are necessary to provide the service you signed up for
• Legitimate interest — analysing usage patterns, crash/performance diagnostics, which app versions are in use, whether our reminder offers, announcements and widgets help, and how people find and share Polygloat, to improve the app, enforcing these terms against abusive users, and ensuring platform integrity (including preventing abuse of our login emails)
• Consent — push notifications and optional device permissions (camera, microphone, photos)

4. Third-Party Services

We use the following third-party services (data processors) to operate Polygloat. Each acts on our instructions and under a data processing agreement.

• Supabase — hosts our database, authentication, and storage services in the European Union (EU region). Your account data and learning activity data live here.
• Cloudflare R2 (US provider) — stores the video, audio, and avatar files themselves.
• Apple and Google (both US) — if you choose Sign in with Apple or Sign in with Google, they confirm your identity to us. For the sign-in itself they act as independent controllers under their own privacy policies; we receive only what section 2 lists.
• Google Firebase (US) — four narrowly scoped services: Cloud Messaging delivers push notifications (receives your device push token); Analytics receives events about the upload flow, with no personally identifying parameters; Crashlytics receives crash reports tagged with your user ID; Performance Monitoring receives network and app timing measurements.
• Deepgram and Soniox (both US) — transcribe the audio of uploaded videos (speech-to-text). An uploaded video is personal data of the people in it: it contains the uploader's face and voice, and it is that voice which is sent for transcription. Under Soniox's terms, Soniox retains uploaded media until deletion is requested.
• ElevenLabs (US) — aligns uploaded audio with its transcript (forced alignment) to produce word-level subtitle timing.
• Google Translate (US) — translates sentence text from content, including translations you request on demand in the app.
• OpenAI and Anthropic (both US) — language processing of content text: transcripts, dictionary glosses, and example sentences. They never receive private messages — Polygloat has none — and uploaded content is public by design.
• Amazon Web Services (US) — generates reference pronunciation audio (Polly text-to-speech) and stores the generated files (S3). Only dictionary text is involved — no personal data.
• SMTP2GO (New Zealand) — sends our transactional email: login codes and launch-list emails. Receives your email address.
• Google Cloud Run (US) — runs the natural-language-processing services that analyse content text.

We do not sell your data. We do not use your data for advertising.

5. Data Retention

When you delete your account, we delete the following within 30 days:

• Your username, display name, bio, and email address
• Your sign-in link with Apple or Google; for Sign in with Apple we also ask Apple to disconnect Polygloat from your Apple ID
• Your profile avatar and any social links on your profile
• Your device records (push notification tokens, notification settings, app version and install source), your reminder choices, the record of which announcements you were shown, and your widget records (widget settings, which widgets you added, which words were sent to them and which you opened)
• The reactions you left on videos, and the invitations you sent (clicks on your invite link remain only as anonymous counts)
• Your social connections (accounts you follow and your followers), your activity feed, and your saved collections
• Any video files you uploaded (unless you choose to keep them anonymously — see the Content Upload Policy)

Your learning activity data (watch history, interactions, vocabulary state) and the transcriptions and vocabulary analysis of videos you uploaded are retained only in de-identified form: the identifiers listed above are deleted, and what remains is held under a random internal identifier that is not connected to your name, email address, or any other identity data. We commit to never attempting to re-identify this data.

We retain this de-identified data under Articles 17(3)(d) and 89(1) GDPR (retention for statistical purposes, with safeguards) and use it solely for aggregate statistics and to improve the learning system — for example, modelling how difficult words are for learners in general. It is never used to make decisions about you, and it is never shared in a form that could identify anyone.

Some records are kept for legal reasons in restricted form: proof that you accepted our terms, reports you submitted, blocks you created, and moderation records. These are kept only while a legal need exists — such as demonstrating compliance or handling a dispute — and we review at least every 24 months whether that need still applies. Security logs (such as authentication logs) are kept for up to 12 months. Widget records are kept for up to 12 months. Login email records are deleted after 30 days.

6. Your Rights Under GDPR

As a user in the European Union you have the following rights:

• Access — request a copy of the data we hold about you
• Rectification — request correction of inaccurate data
• Erasure — request deletion of your data (right to be forgotten)
• Portability — receive your data in a machine-readable format
• Objection — object to processing based on legitimate interest
• Restriction — request that we limit how we use your data

To exercise any of these rights, contact us at legal@polygloat.com. We will respond within 30 days.

You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) at autoriteitpersoonsgegevens.nl.

7. Data Security

We implement appropriate technical and organisational measures to protect your personal data. Access to personal data is restricted to systems that require it to function.

8. International Transfers

Your data is primarily stored within the European Union (Supabase, EU region). However, several of the providers listed in section 4 are based in the United States and process content or telemetry there. For those transfers we rely on the safeguards required by GDPR:

• Google, Amazon Web Services, Cloudflare, and ElevenLabs are certified under the EU-U.S. Data Privacy Framework.
• OpenAI, Anthropic, and Deepgram process data under the EU Standard Contractual Clauses. Soniox processes data under Standard Contractual Clauses or another appropriate safeguard mechanism.
• SMTP2GO is based in New Zealand, which the European Commission has formally recognised as providing adequate data protection (an adequacy decision).

You can obtain a copy of the relevant safeguards by contacting legal@polygloat.com.

9. Children

Polygloat is not directed at children under 16, and you must be 16 or older to create an account (Terms of Service, section 3). This requirement is stated next to the signup button, and creating an account affirms it; we record only a timestamp of that affirmation. We do not ask for or store your date of birth. Where Apple's App Store or Google Play provide an age signal indicating a user is under 16, we refuse or block the account. If we learn that an account belongs to someone under 16, we will delete it. Parents or guardians can contact us at legal@polygloat.com.

10. A Note on AI

Parts of the learning content in Polygloat — transcripts, translations, dictionary glosses, and example sentences — are machine-generated with AI assistance and curated by humans. Polygloat has no AI chat, and we make no automated decisions about you that produce legal or similarly significant effects (GDPR Article 22).

11. Cookies on Our Website

The Polygloat website uses a single functional cookie that remembers your language preference. We do not use analytics or tracking cookies.

When you open a polygloat.com/app link (for example from an invitation or a poster), we count the visit anonymously: which app store we sent you to, your country, and which link it was. We do not store your IP address or set a cookie for this.

12. Changes to This Policy

When we make material changes to this policy that affect how we collect or use your data, we will ask you to review and accept the updated version before continuing to use the app.

13. Contact

legal@polygloat.com