Privacy Policy

Polymathic — web (polymathic.app) and iOS app · Effective 7 July 2026

Who we are

Polymathic is operated by its developer, based in Sweden, who acts as the data controller for the personal data described here. Contact: [email protected].

Three ways to use Polymathic

What we store for email accounts

• Your email address and chosen display name.
• Your learning data: study progress and review history, which briefs you have read, bookmarks (read-later and favourites), personal notes, placement-test state, study queue, and interface preferences (e.g. theme).
• If you use the AI Tutor: your tutoring conversations — the questions you ask and the tutor's replies — stored with your account so you can revisit and continue them across sessions. We also record technical usage of the tutor (which briefs or questions you asked about, model used, token counts and cost) to operate the paid service, enforce fair-use limits, and prevent abuse.
• If you subscribe to the AI Tutor, a record of your subscription status (active/expired) so premium access works. Payment itself is handled entirely by Apple (iOS) or Stripe (web) — we never see or store your card details.
• Timestamps of when this data was last updated.

That is the complete list. We collect no location data, no contacts, no advertising identifiers, and we use no analytics or tracking SDKs in the app or on the site.

The AI Tutor

The AI Tutor is an optional paid feature. When you send a message to the tutor, that message — together with the relevant authored study text it is grounded in and the recent conversation — is sent to an AI model provider, which generates the reply. We use providers that let us keep this processing in the European Union — Anthropic's Claude models served through Amazon Web Services (AWS Bedrock, EU regions) and Google Cloud's Vertex AI (EU regions), depending on which model serves your turn — rather than sending it to general-purpose consumer AI services. Your conversations are not used to train the providers' models. Your stored conversations are linked to your account, are covered by account deletion, and never leave your account for other users. You can rate any tutor answer with a thumbs-up or thumbs-down. A rating records only your vote — which answer, and which model produced it — so we can find weak spots; it contains no conversation text. Choosing thumbs-down additionally shares that one question-and-answer exchange with us, so we can see what went wrong and improve the tutor; the button tells you this before you tap it. A thumbs-up shares no conversation text, and nothing else from your conversations is ever shared for review.

Service providers (processors)

• Supabase — hosts our database and authentication service (account email, learning data).
• Cloudflare — hosts the website and provides the Turnstile challenge that protects sign-up/sign-in against bots.
• Resend — delivers account emails (sign-up confirmation, password reset). Your email address passes through Resend for delivery only.
• Apple — handles authentication if you choose Sign in with Apple, and processes AI Tutor subscription payments on iOS.
• Amazon Web Services (AWS Bedrock) and Google Cloud (Vertex AI) — process your AI Tutor messages to generate the tutor's replies (AWS serves Anthropic's Claude models). We run both in EU regions and do not permit your data to be used to train models. Used only if you use the AI Tutor.
• Stripe — processes AI Tutor subscription payments on the web. Your card details go directly to Stripe; we never receive them. Used only if you subscribe on the web.

Where a provider processes data outside the EU/EEA, the transfer is protected by EU-approved safeguards (such as standard contractual clauses or an adequacy framework).

Third-party content

Artwork shown in briefs is public-domain and loads directly from Wikimedia Commons. When those images load, your IP address and standard request headers are sent to Wikimedia's servers, as with any image on the web; the Wikimedia privacy policy applies to those requests. Some illustrative plate images in the app are generated with AI tools by the developer.

Legal bases

We process account data to provide the service you signed up for (performance of a contract, GDPR Art. 6(1)(b)) and operate security measures such as the sign-in challenge and database backups in our legitimate interest of keeping the service safe and recoverable (Art. 6(1)(f)). When you rate a tutor answer, we store that vote to monitor and improve tutor quality in our legitimate interest (Art. 6(1)(f)); when you choose thumbs-down, sharing that one exchange for review rests on your consent, given by that disclosed action (Art. 6(1)(a)), which you can withdraw by contacting us.

Retention and deletion

Account data — including your tutoring conversations, tutor usage records, and answer ratings — is kept until you delete your account. You can delete your account at any time, in the app (Settings → Account → Delete account) or on the website — deletion takes effect immediately and removes your account and all associated data from our database. Encrypted database backups are kept for up to 90 days and then expire automatically; deleted data disappears from backups on that schedule. Deleting your account does not cancel an active subscription; manage or cancel that through your Apple ID (iOS) or the billing portal (web).

Your rights

You can export your data as a JSON file from inside the app at any time. Under the GDPR you also have the rights of access, rectification, erasure, portability, restriction, and objection — for anything not covered by the in-app tools, email us. You can lodge a complaint with IMY (Integritetsskyddsmyndigheten, the Swedish data protection authority) or your local supervisory authority.

Children

Polymathic is a learning tool for adults and is not directed at children under 13.

Changes

If this policy changes, the new version will be posted here with an updated effective date. Material changes will be highlighted in the app.