Datenschutzerklärung

This Privacy Policy explains what personal data Polyingo (the mobile apps for iOS and Android, the web app, and polyingo.com) collects, why, who it is shared with, how long it is kept, and the choices and rights you have.

Polyingo is developed and published by Mahmut Taşkıran, an individual developer based in Türkiye (“we”, “us”, “our”). We are the data controller for the personal data described here. You can reach us at hello@polyingo.com.

The short version

• You sign in with Google or Apple. We get your name, email address and profile picture from that account.
• We keep your learning progress (your saved words, grammar lessons and scores) on our servers so it follows you across devices.
• To translate, look up words, read text aloud and run the AI features, we send the text, or for voice calls the audio, to the service that does the work. We don’t send your name or email with it.
• Your Poly chats, voice call captions and recaps, and your word trail are kept on your device, not on our servers.
• We use Google Firebase for sign-in, analytics, crash reports and notifications. We use RevenueCat to handle purchases.
• We don’t show ads and we don’t sell your personal data.
• You can delete your account in the app at any time, and we then erase your personal data as described below.

What we collect

Account and profile

• From Google or Apple when you sign in: your name, email address, profile picture and an account identifier. If you choose Apple’s “Hide My Email”, we get a relay address instead.
• What you add to your profile: your username, display name, a short bio and a profile photo. You can take the photo with your camera or pick it from your photo library; we use only the photo you choose.
• Learning settings: your native language, the languages you are learning, your level, your interests and your notification preferences.

Learning activity

• The words you save and your practice progress on each of them.
• Your grammar course progress and bookmarks.
• Game scores, levels and leaderboard standing.

Community features

• The word posts you share, and your comments, likes, follows and blocks.
• Direct messages you send to other learners. These are stored on our servers so they can be delivered.
• Reports you send about other users, and reports others send about you.

Text and audio you ask us to process

• Words and text you search for, translate, ask to hear spoken, or send to Poly, our AI tutor.
• Text you select or share into Polyingo from other apps, through the Android “Translate with Polyingo” menu or the iOS share sheet.
• Your voice during voice calls with AI characters (see “Voice calls” below).
• When you use speech input in games and exercises, your device’s built-in speech recognition (Apple or Google) turns your speech into text. Depending on your device and settings, Apple or Google may process that audio on their own servers under their own privacy policies.

Purchases

When you buy Premium or voice-call minutes, Apple or Google processes the payment. We never see your card or bank details. We receive the purchase details, such as product, price, transaction id, renewal and expiry dates, and refunds, through RevenueCat. We also keep a ledger of the voice minutes you buy and use.

Device, usage and diagnostics

• Device and app information: device model, operating system and version, the device name, the language and region settings, the app version, and a notification token.
• Network information: your IP address, which every service you connect to receives, and request logs.
• Usage analytics: the screens you open and the actions you take, such as starting a game, saving a word, the words and searches involved, purchases, and permissions granted. These are tied to your Polyingo user id.
• Crash reports and performance data: stack traces and app state at the time of a crash, plus network timing for our own servers.
• Advertising identifiers: on iOS, only if you allow tracking when the app asks. On Android, the advertising ID that Google Play services provides (see “Advertising measurement” below).

We don’t collect your precise location, contacts, birth date or phone number.

How we use it, and our legal bases

Purpose	Data used	Legal basis (GDPR, UK GDPR and KVKK)
Create and run your account; sync your progress across devices	Account, profile, learning activity	Performing our contract with you
Translate, look up and speak words; run Poly, the AI games and voice calls	Text and audio you submit, learning settings	Performing our contract with you
Deliver messages, posts, follows and leaderboards	Community data, profile	Performing our contract with you
Sell and honour subscriptions and minute packs; enforce free limits	Purchases, account	Contract; legal obligations (tax and accounting)
Send notifications you turned on, such as reminders, messages and likes	Notification token, preferences	Contract; your consent where the OS asks for it
Keep the service safe, prevent abuse, handle reports	Account, community data, logs	Legitimate interests
Understand how Polyingo is used, fix crashes, improve features	Usage analytics, diagnostics	Legitimate interests
Measure which of our advertising campaigns brought people to Polyingo	Advertising identifiers, install and sign-up events	Your consent (iOS tracking prompt); legitimate interests elsewhere, which you can object to
Comply with the law and defend legal claims	As needed	Legal obligations; legitimate interests

Where we rely on consent, you can withdraw it at any time in your device settings or in the app. Doing so doesn’t affect what was processed before.

AI features

Polyingo’s AI features include:

• Poly chat
• word explanations and example sentences
• AI translations
• stories
• grammar help
• AI-powered games
• voice calls with AI characters

When you use one, we send what is needed to answer you to an AI provider. That means your message or the words in question, your languages and your level, and recent chat messages for context. We don’t send your name, email address or account identifiers to AI providers.

• Text AI goes through OpenRouter, Inc. (United States), which routes the request to the model provider we choose. Today that is DeepSeek.
• Voice calls use OpenAI, L.L.C. (United States).

These providers process the data under their API terms. We don’t use your conversations to train AI models. AI output can be inaccurate, so please don’t rely on it for anything important. See our Terms of Use.

Voice calls

Before your first call, the app explains what happens and asks for your agreement. It uses the microphone only while a call is on.

• During a call: your voice streams directly from your device to OpenAI, so the character can hear you and reply. OpenAI also receives the call’s settings: your languages, your level, the character, and the topic, including any words or grammar lesson you chose to practise. OpenAI also sees your device’s IP address. We don’t record or store the audio.
• Captions: the call’s captions are saved only on your device, in your call history.
• After the call: the captions are sent through our servers to our text AI provider to write your recap. We don’t keep the captions on our servers. The recap is saved on your device with the call.
• What our servers keep: a record of each call (when it started and ended, the character and type of topic, the minutes used, and its cost to us), so we can count and bill your minutes.

What stays on your device

Some things are kept only on your device and never on our servers:

• your Poly chat history
• your voice call history, with its captions and recaps
• your word trail (words you met in reminders, Wiktionary lookups and shared translations)

So that they survive reinstalling the app, they’re also backed up the way your device backs up apps. On Android, that’s your device backup in your Google account. On iOS, it’s the device Keychain, which travels with encrypted backups. Deleting your account deletes them from the device you delete it on. A device backup made before then is managed by Apple or Google and is under your control.

The app also caches translations, audio and other data on your device to work faster and offline. Signing out clears this cache.

Who we share data with

We don’t sell your personal data. We don’t share it for third-party advertising. We share it only as described here.

Other Polyingo users

• Your username, display name, profile photo, bio, follower counts, word posts, comments and likes are visible to other users.
• Your leaderboard score and rank are visible unless you hide yourself from leaderboards in settings.
• Direct messages are visible to the people you send them to.

Service providers who process data for us

Provider	What they do	Data involved
Google (Firebase and Google Cloud)	Sign-in, hosting our servers (United States), file storage for profile photos, push notifications, analytics, crash reports, performance monitoring, remote configuration, translation, text-to-speech	Account identifiers, profile photo, notification token, usage and diagnostics, text sent for translation or speech
MongoDB Atlas	Our database	The account, learning and community data described above
RevenueCat	Purchase management	Your Polyingo user id, name, email address and purchase details
OpenAI	Voice calls	Voice audio, call settings, IP address
OpenRouter and the model provider it routes to (DeepSeek)	Text AI features	The text described in “AI features”
Apple and Google	Sign-in, payments, app distribution, device speech recognition	As set out in their own policies
Wikimedia Foundation	Wiktionary pages you open inside the app	The word you look up, IP address

The app also checks which language selected or shared text is in, and if our translation service is unreachable it translates directly. For both, it sends that text to Google Translate.

Others, when required

• We share data when the law requires it, or when it’s needed to protect the rights, safety or property of our users, the public or us.
• If Polyingo is transferred to a new owner, your data moves with it, still under this policy, and we will tell you first.

Advertising measurement

Polyingo doesn’t show ads. We do advertise Polyingo elsewhere, and we use Google Analytics for Firebase to measure which campaigns lead to installs and sign-ups.

• On iOS, the app asks for permission to track. If you allow it, Firebase can use your device’s advertising identifier (IDFA) for this measurement. If you decline, the IDFA is never accessed. You can change this at any time in Settings → Privacy & Security → Tracking.
• On Android, Firebase may use your advertising ID for the same purpose. You can reset or delete it in your device settings, under Google → Ads (the exact path varies by device).

Our website

polyingo.com uses Google Analytics to understand which pages help people. It runs only if you accept analytics in the banner; until then, no analytics cookies are set. IP addresses are anonymised, and advertising storage is always off. Your choice is remembered in your browser’s local storage. To change it, clear this site’s data in your browser. Our hosting provider (Google Firebase Hosting) keeps standard server logs of requests, including IP addresses.

Where your data is processed

Our servers and database run in the United States. Our service providers may process data in the United States and other countries. When personal data leaves the European Economic Area, the United Kingdom, Switzerland or Türkiye, we rely on the safeguards the law provides. These include the European Commission’s Standard Contractual Clauses and equivalent mechanisms offered by our providers, or your explicit consent where the law requires it.

How long we keep it

• Account, profile, learning and community data: for as long as you have an account. You can delete individual items, such as saved words, posts, comments and messages, at any time.
• Daily and weekly leaderboards: daily boards are removed after 7 days and weekly boards after 8 weeks. All-time scores are kept with your account.
• Server request logs: 30 days.
• Purchase and minute records: as long as tax and accounting law requires.
• After you delete your account: see the next section.

Deleting your account

You can delete your account at any time in the app: Profile → Settings → Delete my account permanently. If you no longer have the app, email us. See our Account Deletion page.

When you delete your account, we:

• erase your profile: name, email address, username, bio and profile photo;
• delete your saved words, grammar progress, scores, word posts, comments, likes, follows, blocks, the messages you sent, and the reports you filed;
• delete your sign-in from Firebase, revoke Sign in with Apple if you used it, and delete your record at RevenueCat;
• delete your Poly chats, voice call history and word trail from the device you delete from.

We keep a small amount of data after deletion, without your name, email or profile:

• Purchase and minute records: what was bought, when, and how many minutes were used, for tax and accounting.
• Reports other users made about your account: to keep the community safe.
• A one-way hash of your Google or Apple account identifier: so a new account cannot claim the one-time free allowances again. It can’t be turned back into your identity.

Server logs expire after 30 days. Apple and Google keep their own payment records under their own policies.

Deleting your account doesn’t cancel a subscription. Cancel it in the App Store or Google Play first.

Your rights

Depending on where you live, you may have the right to:

• access your personal data
• correct it
• delete it
• restrict or object to our processing it
• receive it in a portable format
• withdraw consent

Where we rely on legitimate interests, you can object, and we will stop unless we have compelling grounds.

To exercise these rights, email hello@polyingo.com from the address on your account. We will reply within 30 days and may need to confirm that the account is yours. You can also correct your profile and delete your data yourself in the app.

If you’re unhappy with how we handle your data, you can complain to your local data protection authority. In Türkiye, that’s the Personal Data Protection Authority (KVKK). In the EU or UK, it’s your national authority or the ICO. We would appreciate the chance to resolve it with you first.

California and other US states: we don’t sell personal information. We don’t share it for cross-context behavioural advertising, apart from the campaign measurement described above, which you can turn off as explained there. You have the right to know, delete and correct your data, and we won’t treat you differently for using these rights.

Children

Polyingo isn’t directed at children. You must be at least 13 years old to use it. If you live somewhere that sets a higher age for consenting to the processing of your personal data, such as up to 16 in parts of the EU, you must be at least that age or have a parent’s or guardian’s permission. If we learn that we hold data from a child below these ages without valid consent, we will delete it. If you believe this has happened, contact us.

Security

We protect your data with industry-standard measures:

• encrypted connections between the app and our servers
• access-controlled cloud infrastructure
• secrets kept in a managed secret store
• the least data possible sent to each provider

No system is perfectly secure. If a breach affects your personal data, we will notify you and the authorities as the law requires.

Changes to this policy

We will update this policy when Polyingo changes. The date at the top shows the latest version. If a change significantly affects how we use your data, we will tell you in the app before it takes effect.

Contact

Mahmut Taşkıran · Polyingo · Türkiye hello@polyingo.com