Privacy Policy

Last updated: 10 October 2026 · Version 3.6 · Effective immediately

1. Who We Are

Poly-Puff ("we", "us", "our") is an AI-powered English language learning application operated by Mark Middleton, based in Cape Town, South Africa. We operate the website at poly-puff.com and the Poly-Puff mobile application.

Contact: support@poly-puff.com

2. What Data We Collect

2.1 Account Data

• Email address (required to create an account)
• Display name (optional)
• Authentication provider (Google, Apple, or Facebook, if used)
• Password (stored as a secure hash - we never see your actual password)

2.2 Learning Data

• Your translated sentences and exercise responses
• Anonymous copies of the sentences you submit for AI feedback (the sentence you wrote, the reference answer, and which grammar rules were triggered). These copies are not linked to your account, name or email, and are kept for up to 30 days to help us improve our grammar rules.
• Grammar scores and accuracy results
• Module progress, streaks, and daily challenge completions
• Placement test results and CEFR level
• Your native language setting
• Short voice recordings submitted when you choose to use Pronunciation assessment

2.3 Technical Data

• Device type and operating system
• App version
• General usage patterns (which features you use)
• Error logs (to fix bugs)
• Your IP address, captured when you sign up and each time you sign in - your sign-up IP is converted to an approximate country (stored as a 2-letter code, not the IP itself) for internal usage analytics; each sign-in's IP is kept in a sign-in log for account security

2.4 Payment Data

Subscription payments are processed by Paddle, our payment provider. We do not store your card details. Paddle acts as the Merchant of Record for all transactions. See Paddle's Privacy Policy for how they handle payment data.

2.5 Browser Extension Data

The Poly-Puff Vault browser extension sends the following to our backend for processing, the same way the website and mobile app do:

• Text you select on a page and choose to save, or ask us to look up - to generate a definition, translation, or example sentence for your Vocabulary Vault (Poly-Puff Pro).
• With the inline writing assistant switched on (Poly-Puff Pro), the text you type into a field you're actively writing in - sent for grammar and style checking as you write.

This data is processed by the same AI provider described in Section 4 below, is not stored beyond what's needed to return a result, and is never sold or used for advertising. The extension does not read or transmit anything from a page unless you select text to save/look up, or turn on and actively use the writing assistant. See the extension's own listing for the specific permissions it requests.

3. How We Use Your Data

4. AI Processing - OpenAI Disclosure

Poly-Puff is classified as a Limited Risk AI system under the EU AI Act (Regulation 2024/1689). This means we are required to be transparent about AI use. All AI-generated feedback is clearly labelled with an "AI" badge in the app.

We use OpenAI's API at a temperature of 0.0-0.1 for deterministic, consistent grammar correction. Your exercises are not used to train OpenAI's models. See OpenAI's Terms of Use and OpenAI's Privacy Policy.

For users in Saudi Arabia (SDAIA), Egypt (PDPL), and the EU (GDPR): by using the translation and grammar features, you consent to your exercise data being transferred to OpenAI's US-based servers for processing. This transfer is necessary to provide the core service.

5. Voice & Microphone Access (Mobile App)

The mobile app may ask for permission to use your device's microphone for voice dictation and the optional Pronunciation assessment feature. You can refuse this permission, or revoke it later in your device settings. The microphone-based features will then be unavailable, but the rest of the app remains accessible.

5.1 Voice Dictation

When you use a dictation button, audio is processed by your device's built-in speech recognition engine - on Android typically Google's speech service, and on iOS Apple's. Only the resulting transcribed text is returned to the app. Poly-Puff does not receive or store dictation audio.

The speech recognition service is provided by your device manufacturer or operating system. We have no control over how that service handles audio, and its processing is governed by the relevant manufacturer's privacy policy (Google or Apple).

5.2 Pronunciation Assessment

When you deliberately start a Pronunciation assessment, the app records a short audio sample and securely uploads it to Poly-Puff's backend. The backend processes the recording temporarily in memory, may convert it to a compatible audio format, and sends it to Microsoft Azure AI Speech to calculate pronunciation scores and word-level feedback.

Poly-Puff does not write these pronunciation recordings to disk or keep them after the assessment request is complete. The recording is used only to provide the pronunciation assessment you requested. Microsoft processes the audio as our service provider in accordance with the Microsoft Privacy Statement. The request is associated with your authenticated account only to confirm access, enforce usage limits, and return the result.

6. Children's Privacy & Age Gates

We apply regional age thresholds in line with applicable law. Users below the threshold in their region require verifiable parental consent before using the app:

Users aged 13-17 in a "grey zone" region automatically have data sharing and public profile features disabled. We never knowingly collect data from children below the applicable threshold without parental consent.

7. Data Sharing

We share data only with the following trusted third parties, and only as necessary:

• OpenAI - grammar and AI feedback processing (USA)
• Microsoft Azure AI Speech - temporary processing of pronunciation recordings to provide pronunciation scores and feedback. Audio is sent only when you use Pronunciation assessment and is not permanently stored by Poly-Puff. See the Microsoft Privacy Statement.
• Paddle - payment processing and subscription management
• Railway - backend hosting (our Node.js server)
• Netlify - website hosting
• Sentry - mobile app crash and error diagnostics (Germany, EU region). Receives device model, OS version, app version, and error stack traces. IP addresses and user identifiers are not sent. See Sentry's Privacy Policy.

We do not sell, rent, or trade your account information to third parties for their direct marketing. Our use of advertising technology on the blog is described in Section 11 below.

8. Your Rights

Depending on your location, you have the following rights regarding your personal data:

• Access - request a copy of the data we hold about you
• Correction - ask us to correct inaccurate data
• Deletion - request deletion of your account and all data (Right to Erasure / GDPR Art. 17 / POPIA Section 24)
• Portability - receive your data in a machine-readable format
• Objection - object to certain types of processing
• Withdraw consent - withdraw any consent you have given at any time

To exercise any of these rights, visit poly-puff.com/delete-account.html or email support@poly-puff.com. We will respond within 30 days.

9. Data Retention

We retain your data for as long as your account is active. If you delete your account, all personal data is permanently erased within 30 days. Anonymised, aggregated statistical data (e.g. which grammar rules are most commonly missed) may be retained indefinitely as it cannot be linked back to you.

The anonymous copies of submitted sentences described in Section 2.2 are deleted automatically after 30 days and are not affected by account deletion, because they cannot be linked back to you.

10. Security

We use industry-standard security measures including HTTPS encryption, hashed passwords, HMAC authentication tokens, and rate limiting on all sensitive API endpoints. While no system is perfectly secure, we take reasonable and proportionate steps to protect your data.

11. Cookies & Analytics

Our website uses cookies and similar tracking technologies. Here is what we use and why:

Strictly Necessary Cookies: These keep the website functioning (e.g., keeping you logged in). They cannot be disabled.

Analytics Cookies: We use the following third-party analytics services to understand how visitors use our website:

• Google Analytics (provided by Google LLC) - collects anonymised usage data such as pages visited, time on site, and referring sources. Google may transfer this data to servers in the United States. Google's privacy policy: https://policies.google.com/privacy
• Microsoft Clarity (provided by Microsoft Corporation) - captures anonymised session recordings, heatmaps, and interaction data to help us improve usability. Clarity masks sensitive content by default. Microsoft's privacy policy: https://privacy.microsoft.com/privacystatement

We do not sell data to third parties for their direct marketing.

If you choose practice from a blog or News page, we remember that public page and its practice destination in this browser for up to seven days so you can continue after account verification or profile setup. This navigation preference works with Necessary Only selected.

Only if you accept analytics, Google Analytics also receives the public article identifier and events for article views, practice, signup or Pro-plan clicks, Android store clicks, successful email account creation, successful sign-in, and the first completed web exercise in that content journey. We do not include your email address, exercise answers, scores, or authentication tokens in these events. A store click does not tell us whether you installed or used the mobile app.

Advertising on blog pages

When advertising is enabled, we use Google AdSense to display ads on blog pages. Google and its advertising partners may use cookies and similar technologies to select and deliver ads, limit how often an ad is shown, measure ad performance, prevent fraud, and personalise ads based on visits to this or other websites. Google describes its advertising cookies and data practices in its Advertising Privacy and Terms.

Google and participating advertising partners may receive information such as the page being viewed, a cookie or advertising identifier, IP address, browser and device information, and interactions with an ad. Google determines the advertising partners used for each ad request. Processing and storage are governed by Google's and those partners' privacy notices and settings.

Where Google shows its European regulations message, visitors can consent, decline, or manage their advertising choices. The message is provided by Google's consent management platform and applies to advertising; it is separate from Poly-Puff's analytics cookie choice. Google's message supplies a way to revisit those choices on pages where it appears. Visitors can also manage personalised advertising in Google Ads Settings or use the Digital Advertising Alliance opt-out page. Availability and the ads shown depend on location, consent choices, and Google's settings.

Your Choices: When you first visit our website, a cookie consent banner will ask for your permission before any analytics cookies are set. You can change your preferences at any time through Cookie Settings in the site footer or by clearing cookies in your browser settings.

For users in the European Economic Area (EEA) and South Africa: Analytics cookies are only activated after you provide explicit consent, in accordance with the GDPR and POPIA.

12. International Transfers

Poly-Puff is based in South Africa. Your data may be transferred to and processed in the United States (OpenAI, Railway, Netlify), the European Union - specifically Germany (Sentry, for mobile app diagnostics), and the Microsoft Azure region configured for our Speech service (for pronunciation assessment). Where required by law, we implement appropriate safeguards including standard contractual clauses for EU/UK data subjects.

13. Regional Disclosures

South Africa (POPIA)

We process personal information in accordance with the Protection of Personal Information Act 4 of 2013. You may lodge a complaint with the Information Regulator at inforegulator.org.za.

European Union (GDPR)

We process EU personal data under GDPR (Regulation 2016/679). You may lodge a complaint with your local supervisory authority.

United Kingdom

We comply with the UK GDPR and the Data (Use and Access) Act 2025 (SI 2026/82). You may contact the ICO at ico.org.uk.

United States (COPPA)

We comply with the Children's Online Privacy Protection Act. We do not knowingly collect personal information from children under 13 without verifiable parental consent.

Brazil (LGPD)

We process Brazilian personal data in accordance with Lei Geral de Proteção de Dados (Law 13.709/2018).

Egypt (PDPL)

We process Egyptian personal data in accordance with Personal Data Protection Law No. 151 of 2020 and its Executive Regulations (Decree 816 of 2025). Compliance deadline: 1 November 2026.

Saudi Arabia (SDAIA)

Cross-border transfers of Saudi personal data to OpenAI's US servers are disclosed. Users are notified at the point of data collection.

14. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by email and by updating the "Last updated" date above. Continued use of the app after changes constitutes acceptance of the updated policy.

15. Contact Us

For any privacy-related questions, requests, or complaints:
Email: support@poly-puff.com
Address: Cape Town, South Africa