Privacy Policy

Polly ("we", "us", or "our") provides language-learning services through our website, mobile application, and browser extension.

Account information

• Email address
• Authentication credentials handled by our authentication provider
• Display name and language selections
• Account preferences you choose to save

Learning data

• Progress, scores, completed lessons, and review history
• Study activity such as session timing, streaks, and feature usage
• Saved words, notes, captured phrases, and similar user-created learning content

Spoken practice and optional research audio

• Operational spoken-practice audio is processed ephemerally to detect speech and validate an expected phrase. It is not retained after the request.
• Operational recognition text stays request-scoped and is not returned to the app or written to product analytics, logs, or error telemetry.
• If an adult explicitly opts in through account settings, encrypted copies of practice recordings and limited lesson context may be retained for human-reviewed speech research and offline model training.
• Research consent is versioned and records the opt-in, 18+ attestation, acceptance time, and any revocation time.

Extension and device data

• Text, words, or phrases you choose to submit through the browser extension or related tools
• Browser, device, operating system, and app version information
• Technical logs, diagnostics, and crash information

Payments

• If paid subscriptions or purchases are enabled, payment processing is handled by our payment providers.
• We do not store full card numbers or security codes.

We use essential cookies and similar technologies to keep you signed in, remember your preferences, and keep the service secure. Optional product analytics remain off unless you choose Accept all, whether you are anonymous or signed in. Account, security, payment, referral-fulfillment, and learning features can operate without optional analytics.

See our Cookie Policy for more detail.

We share limited personal data with service providers that help us run the product, such as hosting, authentication, infrastructure, customer support, and payment providers where applicable.

Analytics providers receive optional product-analytics data only after you choose Accept all.

When enabled, Cloudflare Turnstile verifies authentication requests as an essential abuse-prevention check. This security verification does not require optional analytics consent.

Spoken-practice validation is performed by our self-hosted speech service. Hosting and encrypted storage providers may process retained research audio on our behalf under access controls. Authorized human reviewers may access opted-in research samples for annotation and quality review. We will update this policy before adding a new speech-processing provider that changes these disclosures.

We may also disclose information when required by law, to protect rights and safety, or as part of a merger, acquisition, financing, or asset transfer.

You may have the right to request access to, correction of, deletion of, or export of your personal data, and to object to or restrict certain processing.

California residents may also have rights to know, delete, correct, opt out of sale or sharing, and limit the use of sensitive personal information where applicable.

Adults who opted in to spoken-audio research can revoke that consent in Profile. Revocation stops future retention and immediately queues retained recordings for verified deletion.

Signed-in learners can download a bounded account-and-learning snapshot or request a full personal-data export or account deletion in Profile. Requests are reviewed by an operator; submission does not itself erase data or cancel paid billing. You can cancel a queued request before review begins.

For other privacy requests or questions, contact romanj1997@gmail.com.

• We retain information for periods needed to operate the service and meet applicable requirements.
• Retention of optional analytics, including data held by service providers, varies by configuration and applicable requirements.
• Withdrawing optional analytics consent stops future optional collection in the product; it does not automatically delete records already transmitted to remote systems.
• Operational spoken-practice audio is deleted at the end of each validation request and is never placed in research storage.
• Opted-in research audio expires after 180 days. Revocation queues immediate deletion with retries, audit history, orphan cleanup, and storage-to-metadata verification.
• Research metadata is purged only after object deletion is verified; append-only lifecycle audit records may be retained for security and compliance evidence.

Your information may be processed in the United States and other countries. Where required, we rely on appropriate safeguards for international data transfers, such as Standard Contractual Clauses or comparable protections.

We use reasonable administrative, technical, and organizational safeguards designed to protect personal data, including access controls, encryption in transit, and security review practices. No system can be guaranteed to be perfectly secure.

The service is not intended for children under 13, and we do not knowingly collect personal information from children under 13 without legally required parental consent.

The spoken-audio research program is limited to accounts with an explicit 18+ attestation. Operational speech validation remains ephemeral and does not retain a child learner's recording.

If you believe a child under 13 has provided personal data to us, contact romanj1997@gmail.com so we can investigate and, where appropriate, delete the data.

We may update this Privacy Policy from time to time. If changes are material, we will notify you through the service, by email, or by another appropriate method.