Polylex (polylex.app) is a spaced repetition language learning app. This policy explains what we collect, why, and the choices you have. We keep it short because we collect little.
Polylex (polylex.app) is operated by Silvio Di Stefano, trading as Polylex, who is the controller of your personal data. For any privacy question or to exercise your rights, contact [email protected]. We are established in the EU, so we are not required to appoint a separate EU representative, and the scale of our processing does not require a Data Protection Officer.
Polylex lets you share a word you are studying to your own TikTok account as a short generated video clip. This feature is entirely optional and only works if you explicitly connect your TikTok account, through TikTok's official Login Kit sign-in.
Payments and gift purchases are handled by Stripe, which acts as the merchant of record and processes your card. We never see or store your full card details. Stripe's handling of your payment data is governed by Stripe's privacy policy.
We send only transactional email: password reset links and, if you buy a gift, the gift code. These are delivered through our email provider. We do not send marketing email.
We use a small set of processors to run the service: Cloudflare (hosting, content delivery, DNS, email routing, and cookieless Web Analytics), Stripe (payments), and a transactional email provider. Audio and card content are generated from dictionary words, not from your personal data.
Separately from the user feature above, we promote Polylex by publishing short vocabulary videos on our own TikTok and YouTube channels. An internal publishing tool connects to those accounts through the platforms' official APIs (TikTok Login Kit and Content Posting API; YouTube Data API). It authenticates only our own channel accounts, uploads videos generated from dictionary content, and stores the OAuth tokens for our own accounts on our own infrastructure. It does not access or store any data about your TikTok, YouTube, or Google account, and it does not share any Polylex user data with TikTok or Google. Your own use of those platforms (for example, watching our videos there) is governed by TikTok's privacy policy and Google's privacy policy, not by this one.
We use only strictly necessary cookies, so we do not show a cookie banner and do not ask for cookie consent: a single sign-in session cookie that keeps you logged in, and a security cookie set by Cloudflare to protect the site from abuse. For visitor statistics we use Cloudflare Web Analytics, which is cookieless: it sets no cookies and does not track you across sites, which is why we still show no cookie banner. We use no advertising or cross-site tracking cookies.
Payment happens on Stripe's own checkout pages, not on ours, so any cookies Stripe sets there (for example to prevent fraud) are set on Stripe's domain under Stripe's own notice. We do not embed Stripe scripts on our pages.
Only to provide the service: to keep you signed in, sync your progress across your devices, serve audio and card content, process payments, send the transactional emails above, and — if you connected TikTok — share the clips you explicitly ask us to share. We do not sell your data.
We process your data to perform our contract with you (creating your account, running your spaced-repetition study, sharing clips you request, and taking payment for a paid plan), and, for keeping the service secure, preventing abuse, and measuring aggregate, privacy-first usage statistics, on the basis of our legitimate interests. We do not use your data for advertising.
We keep your data while your account is active. TikTok connection data is deleted as soon as you disconnect the account. If you delete your account or ask us to, we delete your personal data, except where we must keep limited records (for example, payment records) to meet legal obligations.
Under the GDPR you have the right to access your data, to have it corrected or erased, to restrict or object to processing, and to receive a copy in a portable format. To exercise any of these, email [email protected] and we will respond.
You also have the right to lodge a complaint with a data protection supervisory authority, in particular in your country of residence. In Greece this is the Hellenic Data Protection Authority (dpa.gr).
Passwords are stored only as bcrypt hashes, never in plain text, and all traffic to polylex.app is encrypted in transit over HTTPS. Access tokens for connected accounts are held on our own infrastructure with access restricted to the operator.
Polylex is not directed at children under 16, and we do not knowingly collect their data.
Our providers may process data in countries other than yours. We rely on those providers' safeguards for any such transfer.
If we change this policy we will update the date at the top of this page.