Privacy

The one thing to read first

When you look up a word, that word and its translations are written to a shared cache that every Polygelato user reads from. It is what makes a repeated lookup instant and free.

Those cache rows contain the word, its translations, and the language it was detected as. They do not contain your account, your email, an identifier, or a timestamp that could be traced back to you. Nobody — including us — can tell who looked a word up from the cache.

But it does mean the words themselves outlive your account. If you look up a term you would not want in a shared dictionary, do not look it up here. Deleting your account removes everything tied to you; it does not remove a word from the shared cache, because at that point the word is no longer connected to you.

What we store, and why

Email address

To sign you in, to reset your password, and for study reminders if you turn them on. Nothing else.

Early-access email

To send one message when new accounts open. Not used for a newsletter.

Words you look up

Answered, then cached as described above.

Words you save

Your wordbank. Yours, kept until you delete them.

Language set and colours

So the grid looks the same each time.

Notification devices

If you turn on study notifications on a device: the address your browser’s push service gave it, its keys, and when we last sent to it, so we can send one reminder a day there. Removed when you turn them off or sign out on that device, or when your browser tells us it is gone.

Lookup counts and cost

To enforce your monthly allowance and to know whether the service pays for itself.

Subscription status

To know which plan you are on.

We do not store payment card details. When billing launches, card data will go to the payment provider shown at checkout and never touch our servers.

Who else sees your words

Four companies currently process data on our behalf. A payment provider will process billing data only after paid checkout opens:

Anthropic (US)

Receives the word you type, to translate it and explain its origins. Anthropic does not train models on it.

Supabase (South Korea, Seoul)

Runs our database and sign-in. Stores everything in the table above.

Vercel (US)

Runs the application and serves the pages.

Resend (US)

Delivers our sign-in and account emails. Receives your email address.

Toss Payments (KR) / Stripe (US)

The provider shown at checkout will process payment details when paid billing opens. Neither is receiving card data from Polygelato today.

If you turn on study notifications, each one travels through the push service your browser uses (Google for Chrome and Android, Apple for Safari, Mozilla for Firefox, Microsoft for Edge on Windows). It is encrypted for your device before it leaves us, so that service sees only that a message was sent, not what it says.

We do not sell your data, we do not share it with advertisers, and there are no analytics or tracking scripts on this site.

What you can do, right now

Both of these are in Settings › Your data, and neither requires asking us:

• Download everything. One file, JSON, containing every word you have saved and everything else listed above. Free on every plan — it is your data, not a feature.
• Delete your account. Immediate and irreversible. Your saved words, settings, and subscription are erased. Billing records are kept as required by law, with your identity stripped from them.

If you are in the EU or UK, these are your rights under GDPR Articles 15, 17 and 20; in California, under the CCPA. We have built them as buttons rather than an email address because a right you have to request is a right with a queue in front of it.

If you joined the early-access list

The list is separate from an account — joining it creates no account and no profile. We store the address you typed, which page you typed it on, the date, the IP address the signup and the confirmation came from, and a random token that makes your confirm and unsubscribe links work. We keep the IP addresses because they are the record that you asked for this — without them we could not answer someone who says they never did.

We email that address twice at most: once to ask you to confirm, and once when access opens. If you never confirm, the second email never comes. We do this because the form cannot tell whether the address belongs to the person typing it, and an unconfirmed address is one we have no permission to write to.

Every email we send carries a link that removes you. It deletes your address — we do not keep a copy of it afterwards. What we do keep is a one-way fingerprint of it, which cannot be turned back into an address and cannot be mailed: it exists only so that someone else cannot put you back on the list after you have left. Your mail provider may also keep its own record of messages we sent you; that part is theirs, not ours. If the link no longer works, write to us and we will remove you by hand. We never sell, rent, or share the list.

How long we keep things

Saved words and settings: until you delete them or your account. Your lookup history (what you looked up, and its answer): until you remove it or delete your account; removing a lookup also takes what you typed off your usage record. A lookup still in progress is kept as a working record for at most an hour after it finishes, or a day if it failed. Lookup counts: 24 months, for billing. A daily count of the lookups and dives refused by your plan's limits or by our daily capacity limit, with your plan at the time: 24 months, to see whether the limits are set fairly and how often they lead to an upgrade. Anonymous cost records: kept, as accounting records. Early-access emails: until launch, or until you use the remove link in any of them — whichever is first. An address that never confirms is deleted after 60 days. Sign-in sessions expire after 400 days of inactivity.

Age

Polygelato is not for children under 13, and in the EU/UK not for anyone under 16. We ask your age at sign-up and do not knowingly keep accounts below it. If you believe a child has created an account, write to us and we will remove it.

Contact

Questions, corrections, or a complaint: privacy@polygelato.app. If you are in the EU or UK you also have the right to complain to your local data protection authority.