Privacy Policy

What changed on 19 October 2026

• We say the weekly reflection also pauses for the rest of the day after the app has shown crisis support, and that a pause does not erase what was already sent or saved.
• We say the weekly reflection asks first: it runs only after you turn it on in its card or in Settings, and turning it off erases the saved reflection on this device.
• We added a section on the Poly Cube browser extension: what it reads and sends (only when you invoke it), where call transcription and on-device local search can run, the one-time model-weight downloads from Hugging Face, the opt-in analytics counters, and how its device-pairing sign-in works.
• The policy's scope now names the Poly Cube browser extension.
• We say the weekly reflection also sends your reading reflections, that it sends only your check-ins' emotion word and ratings — the words you type in a check-in are not sent — and that it pauses while the journal is Off.
• We say where your data is processed, including China for our default chat model, and that we have no documented transfer mechanism yet.
• We describe how analytics consent works in your region, and that Global Privacy Control and Do Not Track always stop it.
• We say which Psyche data reaches our servers without sync: readings, and a therapy message answered by a cloud model.
• We say that a cloud-run trading agent trades from a keeper wallet whose key we hold.
• We list our model providers, and say that their own terms decide whether they keep your requests.
• We no longer describe a model-training opt-in: we do not use your content to train AI models for anyone.
• A local model you choose is reached through our servers, and a cloud model can answer if it is unavailable.
• Server logs are described by criteria rather than a fixed period.
• Section 8 is now titled for what it covers: your recovery phrase and private keys.
• We no longer say deleting your account deactivates it at once or removes everything after 30 days: we list what the 30-day sweep deletes, what it does not yet remove, and that you can still sign in until it runs.
• We no longer say voice recordings are "Deleted after the transcript is produced": Workspace call and meeting recordings are stored until the call or meeting is deleted, are transcribed by Deepgram, and we do not tell the people recorded.
• We list three more model providers: Alibaba Cloud's DashScope (China, where we have configured it), Deepgram and Perplexity.
• We no longer say every sub-processor is under a contract limiting it to our instructions: they process data under their own published terms.
• We no longer say Psyche consent is given by using a feature: the consent we record is turning on sync, and the legal-basis row now covers all of Psyche, not only assessments.
• Security no longer claims isolated execution environments, and Build and Code are no longer called sandboxed.
• Product improvement now uses records of how features perform, instead of "aggregated, de-identified usage".
• New retention rows: consent records (kept after the account is deleted, with the IP address and browser) and the 90-day sign-in session.
• We no longer say backups are purged within 30 days: they age out on a rolling cycle, and we state no period.
• We previously said we relied on SCCs for transfers; that was not so, and we now say we have no documented transfer mechanism.
• We no longer claim to keep a card summary (last four digits, type, expiry): card details stay with Stripe.
• We no longer promise an unsubscribe we do not offer: to leave the newsletter, write to privacy@poly.inc.
• We say that this policy names no Article 27 representative in the EU or the UK, name Switzerland in the complaint right and the contact line, and say which information is required.
• The short version names every AI provider that can handle a request, including image and document readers, and section 1 points to our published Data Processing Agreement.
• We say that Psyche's weekly reflection, once you turn it on, sends the past week's journal entries and check-ins to our model provider when you open Psyche's home.

The short version

This summary is for orientation only — the numbered sections below are the binding text.

1. Who We Are

Polysystems, Inc. is the data controller for personal data processed through Poly. We are incorporated in Delaware and operate from the United States.

Where you use Poly as part of an organisation that has its own agreement with us, that organisation may be the controller and we the processor; in that case the data processing terms of that agreement govern, and you should direct data requests to your organisation first. Where you put other people's personal data into Poly as their controller, our Data Processing Agreement applies; questions about it go to legal@poly.inc.

2. Information We Collect

We collect what you give us and what your use of the service generates. Account information is needed to provide an account; everything else is optional, and without it the feature that needs it will not work.

a. Account information

Email address, a hashed password, and — optionally — a display name and profile photo. If you enable two-factor authentication we store the secret needed to verify your codes. We keep a login history (time, IP address, device) so you can review access to your own account.

b. Content you create

Messages and prompts; uploaded files (documents, images, PDFs); research plans and sources; journal and notebook entries; office documents, spreadsheets and presentations; drawings and design systems; canvases; projects, boards and tasks; and any other content you create or submit. When you upload a file we process its contents server-side — text extraction and OCR — to make the relevant features work.

c. Section-specific data

Poly is a suite of workspaces, and some of them process categories of data the others do not:

• Psyche: assessments and their scores, therapy sessions and messages, journal and check-ins, games and readings. See section 3 for what reaches our servers — we treat this as sensitive data.
• Finance and Wallet: public blockchain addresses you link (proved by a signature; for wallets you connect and the Poly Credit wallet, we never receive your private keys or recovery phrase), watchlists, strategy configuration, and a record of transactions initiated through Poly. See section 10.
• Mail: the content, headers, recipients and attachments of messages you send or receive through Poly.
• Voice: audio you record for speech-to-text is sent to our speech provider to produce the transcript and is not stored by us; text you submit for speech synthesis is sent to a speech provider to produce the audio.
• Workspace calls and meetings: recordings uploaded to a workspace are stored with the call or meeting and transcribed by Deepgram (or, where Deepgram is not configured, OpenAI), unless the workspace transcribes on your own device. A recording stays until the call or meeting is deleted, which deletes it too; a workspace's meeting-retention setting removes old meetings from view but does not delete their recordings, and deleting your account does not remove them. The people in a recording are often not the person who uploaded it. We do not tell the people in a recording that it was uploaded; if you record other people, you are responsible for telling them.
• Build and Code: source code you write or generate, and the output of running it, on infrastructure we operate or, where you connect it, on your own machine.
• Studio: generation prompts and the images, video and audio produced from them.
• Agents and automations: the instructions, schedules and run history of any agent you configure, including agents that continue running while you are away.

d. Usage data

Which features you use, session timestamps, page views, actions taken, request volumes against your plan limits, and error logs.

e. Device and technical data

IP address, browser type and version, operating system, referring URL, and device identifiers — used for security, fraud prevention, rate limiting and service optimisation.

f. Payment data

Payments are processed by Stripe. We never receive or store full card numbers. We retain your subscription status and billing history; card details stay with Stripe.

g. Connected accounts

If you connect a third-party account (GitHub, Google, X, LinkedIn, Telegram and similar) we store the access token and the profile information that provider returns, limited to the scopes you authorise. You can disconnect at any time, which revokes our stored token.

h. Communications

If you subscribe to our newsletter we store your email address for that purpose alone until you ask us to remove it at privacy@poly.inc; there is no self-service unsubscribe yet. Support correspondence is retained so we can answer you.

3. Sensitive Data (Psyche)

Psyche data — assessments and scores, therapy, journal, check-ins, games and readings — can reveal information about your mental health. We treat it as special category data under GDPR Article 9 and as sensitive personal information under the CCPA, which means:

• Psyche — assessments, therapy sessions and messages, journal and check-ins, games and readings — is stored on your device. Copies reach our servers only after you turn on sync, with two exceptions: readings are produced by our servers and the conversation that produced each one is kept in your account's chat history; and a therapy message answered by a cloud model because a local model you chose was unavailable is kept there too. When you use an AI feature (a therapy message, a reading, a journal action), the text you send passes through our servers to our model provider. Turning on sync is the consent we record: it is saved in your browser and, when you are signed in, against your account. Using a Psyche feature without sync is not recorded as a consent. Turning sync off stops syncing, and deleting removes the copies on our servers. Psyche's weekly reflection runs only after you turn it on — the card or Settings asks first. Once it's on, it runs without a separate action: when you open Psyche's home, it sends the past week's journal entries and reading reflections, and your check-ins' emotion word and ratings (the words you type in a check-in are not sent), as plain text, through our servers to our model provider to write the reflection. It does not run while incognito is on, it pauses while the journal is off, and turning it off erases the saved reflection on this device. It also pauses for the rest of the day after the app has shown crisis support — a pause does not erase what was already sent or saved.
• Results belong to the person who took the assessment. We do not disclose individual results to an employer, insurer, or any other third party.
• Where Poly is used in a workplace, an employer sees only an aggregate wellbeing band for groups of at least five people, or a working-style card you write and choose to share — never your answers or scores. Inferring emotional state from what you write is not offered in a work context.
• We do not use this data for advertising, profiling unrelated to the feature, or model training.

Assessments provided through Poly are for self-understanding. They are not a diagnosis and are not a substitute for a qualified clinician.

Psyche keeps its own plain-language record of what it stores on this device and what it never does — see Data & privacy (Psyche); how a reading is generated is documented step by step at How this reading was made.

4. How We Use Your Information

• Provide, operate, secure and maintain Poly and its features.
• Route your messages to the AI model provider for the model you selected, or our default, in order to generate a response.
• Authenticate you and manage sessions.
• Process payments, apply plan limits, and manage subscriptions and credit balances.
• Send transactional email — account confirmations, security alerts, receipts.
• Send the newsletter, if you asked for it.
• Detect and prevent abuse, fraud and security incidents, and enforce our Terms.
• Count page views with Vercel Web Analytics — in the EEA, the UK and Switzerland, or where we cannot tell your location, only if you accept; elsewhere unless you turn it off; never while your browser sends Global Privacy Control or Do Not Track (section 15).
• Use records of how features perform, such as which model answered and how long it took, to improve Poly.
• Answer your support requests.
• Comply with legal obligations.

We do not sell your personal data. We do not use your content to train AI models for us or anyone else. The one model trained on your content is a custom style model (LoRA) you ask for in Studio, trained on the images you choose, for your use.

5. Legal Bases for Processing (GDPR / UK GDPR)

If you are in the EEA, the UK or Switzerland, we rely on the following bases:

Where we rely on legitimate interests, we have assessed that those interests are not overridden by your rights. You may object at any time (section 12).

6. AI Processing

Cloud models. When you send a message to a cloud-hosted model, the message and any attached context are transmitted to that provider (see section 9) and processed under that provider's own terms. Different sections of Poly may use different providers for different tasks.

Local models. When you choose a local model (Ollama or OMM), Poly's server sends your message to the local model runtime configured for the service. If that runtime is unavailable, your message is sent to a cloud model provider through our servers instead; in Chat, a notice tells you so.

Training. We do not use your content to train AI models for us or anyone else. The one model trained on your content is a custom style model (LoRA) you ask for in Studio: it is trained, through Replicate, on the images you choose, for your use. Model providers process your requests under their own terms, which decide whether and how long they keep them; our list of model providers links each provider's terms.

Provenance. When you download media you generated in Poly, using Poly's own download control, we embed a machine-readable marker in the file recording that it was produced or substantially modified by a generative model. We can write that marker into PNG, JPEG, WebP and SVG images, and into the container of a video — whether you generated it in Studio or in a chat conversation. Some files go out without one: a GIF and generated audio have no layer here that can carry the marker. The marker also follows what we recorded about a file when it was made, rather than the screen you download it from — so media you imported yourself, and anything stored before we recorded provenance at all, is downloaded unmarked. A copy you obtain any other way will not carry it either: saving a file directly out of your browser, opening the provider's original link, or any download we could not fetch ourselves gives you the provider's bytes untouched. The marker describes the file, not you — it records the tool and its version, a timestamp and a per-file identifier, and contains nothing about your account or what you typed.

7. Automated Decisions and Autonomous Agents

Poly lets you configure agents that act on your instructions — including on a schedule and while you are not present. These agents act for you, on parameters you set; we do not use them to make decisions about you.

We do not make decisions producing legal or similarly significant effects concerning you by solely automated means, with one exception: automated abuse and fraud controls may rate-limit or suspend an account. You can contest such a decision and obtain human review by writing to privacy@poly.inc.

8. Your Recovery Phrase and Private Keys

Never give your recovery phrase or private keys to anyone, including Poly staff, and never paste them into a chat, message or document. The only place Poly asks for a recovery phrase is the Poly Credit wallet's own setup and restore screen, which encrypts it in your browser; it is never sent to us. No member of our team will ever request them, and we will never send you a contract address or a payment request by direct message.

9. Sharing and Sub-processors

We do not sell or rent personal information. We share it only with the categories of recipient below. They process it under their own published terms (each model provider's is linked in the list below); we have not yet put a data processing agreement in place with each of them. Ask legal@poly.inc for details.

The model providers we send your requests to, and where each says it processes them:

A current list of the named sub-processors in the other categories is available on request from privacy@poly.inc. We may also disclose information where required by law, court order or governmental authority; where necessary to protect the rights, property or safety of Poly, our users or the public; and as part of a merger or acquisition, in which case we will notify you before your data becomes subject to a materially different policy.

10. Blockchain Data

Wallets you connect, such as Phantom, and the Poly Credit wallet keep their keys with you; we never receive those keys. If you run a trading agent in the cloud, it trades from a keeper wallet that Poly creates and holds for you: its private key is generated and stored, encrypted, on our servers. Trades from a keeper wallet run only while we have switched keeper execution on for the service.

Understand that public blockchains work differently from our systems:

• Transactions are public, permanent and irreversible. They are recorded on a network we do not control and cannot be edited or deleted by us or by you, including in response to a deletion request.
• A wallet address is a persistent identifier. Linking one to your Poly account may make your on-chain activity associable with you by anyone who learns that link.
• Deleting your Poly account removes the association we hold; it does not and cannot remove anything from a blockchain.

11. Retention and Deletion

Delete your account from Settings > Account > Delete Account. It signs you out everywhere at once. Until the 30-day sweep runs you can still sign in, and signing in does not cancel the deletion; we have no way in the product to restore an account deleted from Settings. Some records are retained for a limited period where the law requires it.

12. Your Rights

Depending on where you live, you may have the right to:

• Access — get a copy of the personal data we hold about you.
• Correct — have inaccurate or incomplete data fixed.
• Delete — have your personal data erased, subject to legal retention duties.
• Port — receive your data in a structured, machine-readable format.
• Object — object to processing based on legitimate interests.
• Restrict — limit how we process your data in certain circumstances.
• Withdraw consent — at any time, without affecting prior lawful processing.
• Not be discriminated against for exercising any of these rights.

Email privacy@poly.inc. We respond within 30 days (45 where the law allows an extension). We may need to verify your identity first. You may use an authorised agent where the law provides for one.

If you are in the EEA, the UK or Switzerland you also have the right to complain to your local supervisory authority (in Switzerland, the FDPIC). We would appreciate the chance to address your concern first.

13. California Privacy Rights

In the twelve months preceding the date above, we collect the categories of personal information described in section 2: identifiers, customer records, commercial information, internet activity, geolocation inferred from IP address, audio where you use voice features, professional information where you provide it, and — for Psyche — sensitive personal information. Sources, purposes and recipients are described in sections 2, 4 and 9.

We do not sell personal information, and we do not share it for cross-context behavioural advertising. We use sensitive personal information only to provide the feature you requested, which does not trigger a right to limit its use — you can nonetheless delete it at any time.

California residents may exercise the access, deletion, correction and non-discrimination rights in section 12 by the same route.

14. International Transfers

Poly is run from the United States, and our service providers process data in other countries too, including the United States and the People's Republic of China: DeepSeek, our default chat model, says it stores data there, and Alibaba Cloud's DashScope, which some chat, research and agent features use where we have configured it, stores requests in its Beijing region. We have not yet put in place a documented transfer mechanism, such as Standard Contractual Clauses, with these providers. Ask legal@poly.inc for details.

15. Cookies and Tracking

We use a deliberately small set of cookies and similar technologies:

• Essential — three cookies, all strictly necessary, for signing in and loading your own previews (see our Cookie Policy). Cannot be disabled without losing the ability to sign in.
• Preference — interface settings such as theme and sidebar state. Functional only; they do not track you across sites.
• Analytics — page views counted with Vercel Web Analytics, which sets no cookies: in the EEA, the UK and Switzerland, or where we cannot tell your location, only if you accept; elsewhere unless you turn it off. What it records is listed in our Cookie Policy.

We do not use advertising trackers. While your browser sends Global Privacy Control or Do Not Track, analytics does not run, whatever you chose. Withdrawing consent stops it at once, in every open tab, without reloading.

16. Security

We protect personal data with encryption in transit (TLS), hashed password storage, optional two-factor authentication, scoped access controls, rate limiting, and a visible login history so you can audit access to your own account.

No system is perfectly secure, and we do not claim otherwise. If a breach affects your personal data we will notify you and the relevant supervisory authority without undue delay, and within 72 hours of becoming aware where the GDPR requires it.

Found a vulnerability? Report it to security@poly.inc. We will not pursue legal action for good-faith research that respects user privacy and does not degrade the service.

17. Age Requirement

Poly is for adults. You must be at least 18 (or the age of majority where you live, if higher) to hold an account — see our Terms of Service. We do not knowingly collect personal data from anyone under 18. If you believe a minor has provided us data, write to privacy@poly.inc and we will delete it promptly.

18. Changes to This Policy

We may update this policy. Material changes will be posted at this URL and, where appropriate, sent to the email address on your account before they take effect. The "Last updated" date above reflects the most recent revision. Continued use after the effective date constitutes acceptance.

19. The Poly Cube browser extension

The Poly Cube browser extension is a client of your Poly account. It reads page content only when you invoke the assistant on that page — to answer a question about it, save a selection, or launch a research run — and sends it to your account for those purposes. It is never read or transmitted silently.

Call capture starts only on your explicit action. Where audio is transcribed is your choice in Settings: the cloud default sends it to the server-side Whisper in your Poly account; an on-device model transcribes in your browser, and On-device only mode refuses cloud transcription categorically — audio the model cannot run is dropped, never sent anywhere. Transcripts and digests are stored in your account as documents you control and can delete.

On-device transcription downloads open-source model weights — data files, never executable code — from the Hugging Face hub and caches them in your browser.

The extension's usage analytics are strictly opt-in and off by default, enforced on our servers: twelve event names carrying counters, durations, and device booleans — never page content, URLs, or titles — pruned after 180 days by default. Bounded retention is part of the design. Turning the toggle off purges the not-yet-sent queue on your device.

The extension's optional on-device local search (off by default) — over your notes boards and saved call transcripts — performs a one-time download of a ~22 MB model file from huggingface.co. That file contains model weights — numeric parameters, not code; all AI code ships inside the extension package. Your notes and saved call transcripts used for local search, and the audio used for on-device transcription, are processed on your device and are never transmitted to us or to Hugging Face; after the one-time download the feature works offline.

The extension authenticates by device pairing, not your password: an access token and a refresh token are kept in the extension's own local storage, which websites cannot read. Removing the browser in your account's Devices settings invalidates them.

The extension contains no advertising trackers, and we do not sell or share data collected through it except as described in this policy.

20. Contact

• Privacy and data requests: privacy@poly.inc
• Data protection / GDPR: dpo@poly.inc
• Security reports: security@poly.inc
• Everything else: hello@poly.inc

This policy names no representative in the EU or the UK under Article 27 of the GDPR or the UK GDPR. If you are in the EEA, the UK or Switzerland and have a question about your data, write to privacy@poly.inc or dpo@poly.inc.

Polysystems, Inc. · Wilmington, Delaware, United States