Privacy Policy

This Privacy Policy explains what information [operator's legal name — to be completed] ("PolyGoft", "we", "us") collects when you use the PolyGoft website and the PolyGoft app for iPhone and iPad (together, the "Service"), what we do with it, who we share it with, and the choices and rights you have. It applies alongside our Terms of Service.

The short version

• To create an account we ask for a username, an e-mail address and a password. We do not ask for your real name, your address, your date of birth or any payment details.
• PolyGoft teaches with the help of artificial-intelligence ("AI") models. What you type and say while you learn is sent to AI providers that process it for us so that your answers can be graded, your questions answered and your lessons written. We do not send them your username or your e-mail address.
• We do not sell your personal information, we do not show advertising, and we do not use advertising or analytics trackers on the website or in the app.
• When you speak, your recording is sent for grading and is not kept.
• You can delete your account yourself at any time. We then remove what identifies you and keep your learning activity without your name or e-mail address. You can also ask us to erase what you typed.

1. Who is responsible for your information

[operator's legal name — to be completed], [operator's postal address — to be completed], is the controller of the personal information described in this policy. You can reach us about privacy at [privacy contact e-mail — to be completed].

2. The information we collect

Information you give us

• Account details. A username (we give you one when you sign up, and you can choose another in Settings), your e-mail address, and a password. We store the password only in hashed form and cannot read it.
• Profile details. Your settings, such as how much Persian script you want to see and whether you want e-mails from us.
• Your placement answers. When you join we ask a few questions — for example about your experience with Persian, your goal and how much time you have — so that we can start you at the right level. You can skip them.
• What you type and say while learning. Your answers to exercises, your messages to the tutor in chat, the requests you make when you ask for a lesson, a mission or a journey to be generated (for example a topic, a city and travel dates you choose to practise with), and notes you add when you report a problem with an exercise.
• Your voice. When you do a speaking exercise or dictate a chat message, the app or your browser records you through the microphone, with your permission. Section 4 explains what happens to the recording.
• Messages you send us. If you contact us, we keep the correspondence.

Information created as you use the Service

• Learning records. Which lessons you opened and finished, your scores and the feedback you received, the words, grammar points and error patterns we think you have or have not mastered, your review schedule, your level and its history, your streak, and points or standings you earn.
• Lessons generated for you, and whether other learners used them (see section 5).
• Technical and usage information. For each request the app makes to our servers we record the name of the feature that was called, the time, the result, how long it took, your account, and whether you were on the website or the iPhone app and which app version. We record events such as "account created", "lesson started" or "lesson generated". We also record your device's time zone so that overnight preparation of your review happens during your night. To protect accounts against password guessing, we record failed sign-in attempts: the username or e-mail address that was typed, the internet address (IP address) it came from and the browser or app identifier. Our hosting provider's infrastructure logs also record the IP address and browser or app identifier of each request, for security and troubleshooting.
• A record of each AI request made for you: which AI model was used, how much it processed, how long it took, what it cost us and whether it succeeded. Section 4 explains what happens to the text of those requests.

What we do not collect

We do not collect payment information (the Service is free and there is nothing to buy), your precise location, your contacts, photos or calendar, or advertising identifiers. The iPhone app asks for one permission only — the microphone — and optionally for permission to show reminders, which are scheduled on your device and do not pass through our servers.

3. How we use your information, and our legal bases

We do not use your information for advertising, and we do not make decisions about you that produce legal or similarly significant effects by automated means. Grades and levels in PolyGoft are produced automatically, in part by AI; they affect only what the Service teaches you next.

4. How AI providers process what you type and say

Most of what PolyGoft does for you is done by AI models operated by other companies on our behalf. When you answer an exercise that needs judgement, talk to the tutor, record yourself, or ask for a lesson, the relevant text or audio is sent to one of the providers listed in section 6. Whatever you write to say what you want — a mission's goal, a trip request, a lesson request — is sent word for word. It goes together with teaching context: your level and, for some steps, a summary of how you are doing: which of the things a lesson could teach you have met before, and how long ago, and whether a mistake you just made is one you have made before — never your past mistakes themselves. Practice built from one of your chats also carries your own messages from that chat, corrected.

• What is not sent. We do not include your username or e-mail address in what we send to an AI model, with one exception: when you choose a new username in Settings, the name you typed — and nothing else about you — is sent to an AI model to check that it is suitable to show to other learners. Requests are associated with your account by an internal number only. Please remember that anything you choose to type or say about yourself is part of what is sent.
• Your voice. Your recording is sent to the AI provider to be transcribed or graded and is then discarded. We do not keep recordings of your voice, and we do not use your voice to identify you.
• Request logs. So that our staff can find and fix teaching problems, the full text of each AI request and response — which includes what you typed — is stored with our observability provider, Langfuse (section 6), identified by the internal account number and not by your name or e-mail address. If Langfuse cannot be reached, the text is held temporarily in our own database and deleted after at most 30 days. Our own database otherwise keeps only the facts about each request (model, size, duration, cost, outcome).
• Training. We do not use what you type or say to train AI models of our own. The terms under which we use the AI providers in section 6 do not permit them to use it to train their models.
• Accuracy. AI output can be wrong. See the Terms of Service.

5. Lessons you generate are shared with other learners

Every lesson that PolyGoft generates is added automatically to a shared pool and may be recommended to other learners at the same level, who receive their own copy. A generated lesson contains teaching material built from your request — for example its topic or the city you chose — but not your answers, your chats or your account details. By default a shared lesson carries no name. If you choose to be credited on a lesson, your username — the one we gave you when you signed up, or the one you chose in Settings — and a standing based on how useful other learners found your lessons are visible to other learners and on the publishers' board. You can change your username, or remove your name from a lesson, at any time. If you edit a lesson, the edited version is shared only after our staff have reviewed it.

6. Who we share information with

We share personal information only with companies that process it for us, under contracts that limit what they may do with it, and in the limited situations described below. We do not sell personal information and we do not share it for cross-context behavioural advertising.

We may also disclose information if the law requires it, or where we believe in good faith that it is necessary to protect the rights, safety or property of our learners, the public or PolyGoft; and, if we are involved in a merger, acquisition or sale of assets, to the other party under confidentiality, in which case this policy continues to apply to your information until you are told otherwise.

The website serves its typefaces from our own servers, not from a font provider's. If you install the app from Apple's App Store, Apple processes information about your download and device under its own privacy policy.

7. Where your information is processed

Our servers are located in the United States, and our providers process information there and in other countries. If you use the Service from outside those countries, your information will be transferred to and processed in them. Their data-protection laws may differ from yours. Where the GDPR or UK GDPR applies, we rely on appropriate safeguards for such transfers, such as the European Commission's standard contractual clauses.

8. How long we keep information

We keep your account and your learning records for as long as your account exists, because they are what makes the Service work for you. We do not yet apply fixed deletion periods to most activity logs; the table shows what is true today. When we introduce shorter periods we will update this policy.

9. Deleting your account

You can delete your account yourself, at any time, from Settings on the website or in the app. We ask for your password to make sure it is you. Deletion is immediate and cannot be undone.

• Removed at once: your username, e-mail address, password, time zone, and the settings and preferences stored on your profile, together with any stored recordings of your voice and the records of failed sign-in attempts made with your username or e-mail address. You are signed out on every device, and the account can never be signed into again. The same e-mail address can be used to open a new, unrelated account.
• Kept, without your name or e-mail address: the lessons you generated, which stay available to other learners without a name; and your answers (including the answers you gave when we placed you), your chats, your learning records and the records of AI requests made for you. They remain attached to a closed account that carries a random label instead of your details, and we keep no table that links that label back to you. We use this information to study and improve how the Service teaches. We do not try to re-identify it.
• What you typed may still describe you. If you told the tutor something personal, those words remain in the kept records. If you want the text you typed erased as well — before or after deleting your account — write to us at [privacy contact e-mail — to be completed] from the e-mail address of your account, or, if the account is already deleted, with enough detail for us to find the records. We will then erase the account's chats, answers and other typed text from our systems and have the copies held by our providers deleted.
• Copies held by our observability provider are deleted according to the retention period we have set there, and backups are overwritten on their normal cycle.

10. Your rights

Depending on where you live, you may have the right to ask us for access to the personal information we hold about you and for a copy of it; to have inaccurate information corrected (you can change most of it yourself in Settings); to have it erased; to restrict or object to certain processing, including processing based on our legitimate interests; to receive information you provided in a portable format; and to withdraw consent where we rely on it. We will not treat you differently for exercising any of these rights.

• How to ask. Write to [privacy contact e-mail — to be completed]. We will need to confirm that the request comes from the account holder, and we will reply within the period the law requires — one month under the GDPR, 45 days under California law.
• European Economic Area, United Kingdom and Switzerland. You also have the right to complain to your local data-protection authority.
• California and other US states. In the last twelve months we collected these categories of personal information: identifiers (username, e-mail address, internal account number, and IP address in sign-in security records and infrastructure logs); internet or other network activity (usage records); audio information (voice recordings, which are processed and not retained); education-related information and inferences (your learning records, your level and what we think you have mastered); and the contents of what you typed. We disclosed each category to the service providers in section 6 for the purposes in section 3. We do not sell personal information or share it for cross-context behavioural advertising, and we do not use sensitive personal information for purposes that would give rise to a right to limit its use. You may make requests through an authorised agent. If we decline a request you may appeal by replying to our decision.

11. Your choices in the app

• What the tutor remembers. In Settings you can stop the corrections the tutor makes in chat from being added to your long-term learning record. Your messages are still processed so that the tutor can answer.
• E-mail. You can turn off review summaries in Settings, and every summary tells you how. We will still send messages you need, such as password resets. We do not send marketing e-mail.
• Username. You can change it in Settings, and being credited with it on shared lessons is optional.
• Microphone and reminders. You can withdraw either permission in your device or browser settings. Speaking exercises need the microphone.

12. Cookies and similar technologies

The website uses two cookies, both strictly necessary: one keeps you signed in (it lasts up to two weeks), and one protects forms against forgery (up to one year). We also store a few display preferences in your browser — for example whether Persian script is shown — and the last time zone we recorded for you. The iPhone app keeps your sign-in tokens in the device's secure keychain and a copy of your profile for fast start-up; both are removed when you sign out. We do not use advertising or analytics cookies, pixels or software development kits, on the website or in the app, and we do not track you across other companies' apps and websites.

13. How we protect information

We use measures appropriate to the information we hold: encrypted connections to the Service, passwords stored only as salted hashes, sign-in locked for an hour after five failed attempts, a database that is not reachable from the public internet, secrets held in a managed secret store, files served through short-lived signed links rather than public addresses, staff access granted individually and by invitation to a separate administration site, and sign-in tokens that are revoked when you sign out or delete your account. No system is perfectly secure; if we learn of a breach that affects you we will notify you and the authorities as the law requires.

14. Children

The Service is not directed to children under 13, and we do not knowingly collect personal information from them. In the European Economic Area and the United Kingdom, if you are under the age at which you can consent to the use of your information in your country (between 13 and 16), you need a parent's or guardian's permission to use the Service. If you believe a child has given us personal information without that permission, contact us and we will delete it.

15. Changes to this policy

We will update this policy when the Service or the law changes. The version and effective date appear at the top of this page. If a change is material we will give you notice that is reasonable in the circumstances, for example by e-mail or in the Service, before it takes effect.

16. Contact

[operator's legal name — to be completed]
[operator's postal address — to be completed]
Privacy: [privacy contact e-mail — to be completed]
Support: [support contact e-mail — to be completed]