Privacy Policy

We collect the following:

• Account. Email signup collects an email address and a password, stored by Supabase Auth. A display name or avatar is collected only if you sign in with Google. Without an email and password, or Google sign-in, we cannot create an account or provide the Service. Exam date, timezone, and optional emails are not required.
• Learning. A Slavic or non-Slavic track, exam date, interface language, timezone, study streak, referral code, progress, exercise results, and completed modules.
• Content. Essay photos, speaking recordings, and text answers.
• Payments. We store a Stripe customer id and subscription status. When you pay, we also store the time you accepted the Terms, the plan, and the billing period. The card number, including the last four digits, and the billing country stay with Stripe. We do not store them.
• Referrals. Your referral code, who referred you, and any bonus Smart Grading credits earned through referrals.
• Email choices. Whether you turned on study emails or exam reminders, when you agreed, and the exam reminders we sent you. For a paid plan that has ended: the end date and whether we sent you an offer.
• Technical data. IP address, browser, device, operating system, pages in the Service, and timestamps in logs.
• Use of the app. Which screens of the app you open and when, and steps such as starting or finishing an exercise, seeing an upgrade offer or choosing a plan. We record these events with your account on our own servers, without cookies. They never include your answers.
• How you found us. Your optional answer to “How did you find PolishReady?” in onboarding.
• Where you signed up. If you create your account with a sign-up button in our free mock exam, we note that on the account. It comes from the sign-up link, not from a cookie.
• Cookies. Essential session cookies, one short first-party referral cookie, and, after consent, analytics. Details are in the Cookie Policy.
• Analytics, with consent. If you accept analytics cookies, we keep your Google Analytics browser ID with your account. Google Analytics then also receives a pseudonymous account ID (never your email or name), your plan, interface language and study track, and, from our server, your payments, renewals, refunds and cancellations (plan, amount, currency).

We process personal data under Regulation (EU) 2016/679:

• Contract (Art. 6(1)(b)): account, content, feedback, and the subscription.
• Legitimate interests (Art. 6(1)(f)): security, abuse prevention, enforcing the Terms, running the referral programme, and improving the Service from in-app usage events, the optional “How did you find PolishReady?” answer and whether you signed up from the free mock exam, where those interests are not overridden by your interests or fundamental rights and freedoms.
• Consent (Art. 6(1)(a)): optional analytics after you accept the cookie banner, and optional study emails (tips and check-ins, which can include an offer once a paid plan has ended) and exam reminders, each on its own switch in onboarding or profile. You may withdraw consent at any time. That does not affect processing before the withdrawal.
• Legal obligation (Art. 6(1)(c)): accounting and replies to authorities.

We use data to:

• run the Service and generate feedback for writing, speaking, and exercise explanations;
• match study to your level and to the Slavic or non-Slavic track;
• handle the subscription through Stripe;
• write about your account and support, and, with consent, send optional study emails and the exam reminders you ask for (14, 7 and 2 days before your exam, the day after, and about six weeks later);
• send a former subscriber an occasional offer, only if they turned on study emails;
• credit referrals;
• see where learners get stuck in the app and which channels bring new learners, from in-app usage events and the onboarding answer, so we can improve the Service;
• with consent, measure which pages, exercises and plans help learners (Google Analytics);
• detect abuse and incidents;
• meet legal duties.

We do not train our own models on essays or recordings. We send content to Google to generate feedback.

• Supabase (Supabase Inc.): authentication, database, and files.
• Stripe (Stripe Payments Europe, Ltd.): payments and the personal discount codes we create for you. Card data stays with Stripe.
• Resend (Resend, Inc.): verification and password-reset email and, if you opt in, study emails and exam reminders.
• Google Cloud / Gemini (Google LLC): essay photos, speaking recordings, and text (answers, quiz explanations, writing) in order to generate feedback.
• Vercel (Vercel Inc.): hosting and CDN.
• Cloudflare (Cloudflare, Inc.): Turnstile at signup. It receives an IP address and browser signals to block abuse.
• Google Analytics 4 (Google LLC): only after you accept the cookie banner. It then receives a pseudonymous account ID and payment events from our server.

We do not sell personal data for the recipient’s marketing.

We may disclose data when the law requires it, or when it is necessary to protect rights, property, or safety, or to detect fraud.

Stripe Payments Europe, Ltd. processes payments in the EEA. Any onward transfer by Stripe is under Stripe’s data-processing terms.

Supabase, Vercel, Google, and Resend may process data in the United States under the Chapter V safeguard that provider uses: the EU–U.S. Data Privacy Framework where the provider is certified, otherwise standard contractual clauses.

Email support@polishready.pl for a summary of those safeguards. Use of the Service is not consent to the transfer.

• Account, learning, content, and email choices: while the account is active. You can delete the account in profile. An email request is completed within 30 days. We then delete the data or irreversibly anonymise it, unless the law requires us to keep it.
• Financial records: 5 years from the end of the calendar year the record relates to.
• Technical logs: up to 90 days.
• In-app usage events: 12 months, then deleted. They are also deleted with the account.
• Analytics: up to 14 months in Google Analytics. We delete the stored Google Analytics browser ID the next time you open the app after you withdraw consent.

We do not keep content indefinitely in order to train models.

Which cookies we use, and how to change your choice, is in the Cookie Policy. Essential cookies keep you signed in. One short referral cookie records a referral code; it is described there too. We load Google Analytics 4 only after you accept the banner.

The controller is established in Poland, so GDPR rights apply whether or not you are in the EEA:

• access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), portability (Art. 20);
• objection to processing based on legitimate interests (Art. 21);
• withdrawal of consent where processing is based on consent.

Write to support@polishready.pl. We reply within one month. We may ask you to confirm that you are writing about your own data.

You may complain to the President of the Personal Data Protection Office, ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl, or to the authority in the country of your habitual residence.

If you live in California, you may have rights under the CCPA and CPRA: the right to know, to delete, to correct inaccurate information, to limit use of sensitive personal information, and not to be discriminated against for using those rights.

We do not “sell” or “share” personal information as those terms are defined in the CCPA/CPRA.

The Service is not for anyone under 16. If we collect a child’s data without a parent’s consent, we delete it. Email support@polishready.pl.

We protect data with TLS in transit, an encrypted database connection, access control, and security reviews. No internet transmission is completely secure. We do not promise absolute security beyond what the law requires.

Feedback on writing and speaking is generated by outside providers’ models. That processing is part of the contract. It is not a decision that produces legal effects or similarly significantly affects you (GDPR Article 22). The feedback helps you study. It is not an exam result.

We mark a material change with a new effective date. If the change affects data we already hold and needs advance notice, we write before that date. A new date does not refresh consent for analytics or optional emails. Those stay with the cookie banner and the profile control.