Privacy Policy

§ 01Information we collect

a.Account information

If you create an account, we collect your email address and a password (the password is stored only as a secure hash by our backend provider, Supabase). Your account has an internal user identifier (a random UUID).

b.Learning progress

If you sign in with an email account, your learning progress is backed up to our backend so you can restore it on another device. This includes: your courses, per-exercise and per-word mastery, saved phrases, activity dates, streak state, and a history of finished practice sessions. It does not include free-text you write. Without an account, this data stays only on your device.

c.Usage analytics

To understand how the App is used and where people get stuck, we collect product-interaction analytics through PostHog (a third-party analytics provider). This includes app-defined events (e.g. onboarding steps, a course being created, a practice session started/finished, the paywall being shown), together with your account identifier (not your email address) and standard technical context (operating system and version, device model, app version, language, time zone). On native builds we also record session replays — playbacks of on-screen interactions within the App — to diagnose usability problems. We do not capture free-text or the content of your answers, and we do not read any advertising identifier (no IDFA).

d.Subscription information

If you buy a subscription, the purchase is processed by Apple, and your subscription status is managed through RevenueCat (a third-party subscription provider). RevenueCat receives your account identifier and purchase/subscription data (plan, status, renewal). We never receive or store your full payment card details — those are handled entirely by Apple.

e.Notifications

Daily reminders and streak alerts are scheduled locally on your device. We do not register push tokens and transmit nothing to deliver them.

f.Information that stays on your device

Your app settings (haptics, audio, notification preferences) and usage counters remain on your device and are not sent to us.

§ 02Third-party processors

We share the data described above only with the providers that operate the App's infrastructure, each acting on our behalf:

• Supabase
  Backend · auth, database, storage

  Email, account id, learning progress

  Privacy policy ↗
• PostHog (EU region)
  Product analytics · session replay

  Account id (not email), usage events, session replays, technical context

  Privacy policy ↗
• RevenueCat
  Subscription management

  Account id, subscription/purchase status

  Privacy policy ↗
• Apple
  Distribution · payment processing

  Purchase transaction

  Privacy policy ↗

We do not sell your personal data, do not use it for third-party advertising, and do not share it with data brokers.

§ 03Why we process your data (legal bases)

• To provide the App (accounts, sign-in, progress backup/restore, subscriptions) — performance of our contract with you.
• To improve the App (analytics, session replay) — our legitimate interest in understanding and improving the product, or your consent where required.
• To comply with legal obligations.

Where the GDPR applies, this is our legal basis for each purpose.

§ 04Data retention

We keep account data and progress for as long as your account exists. Analytics data is retained by PostHog for the period configured for our project. When you delete your account (see §5), your account and backed-up progress are removed from our backend.

§ 05Your rights and choices

• Delete your account and data: in the App, go to Settings → your email → Delete Account. This permanently deletes your account and your backed-up progress from our backend. (Progress kept only on your device is removed by uninstalling the App.)
• Access, correction, portability, objection, restriction: you may request these by contacting us at support@getpo.co.
• Manage your subscription in your device's App Store settings.
• Depending on your location (e.g. the EEA/UK), you may also lodge a complaint with your local data-protection authority.

§ 06International transfers

Our providers may process data on servers outside your country. Where required, such transfers rely on appropriate safeguards (e.g. the European Commission's Standard Contractual Clauses).

§ 07Children

Poco is not directed to children under 14, and we do not knowingly collect personal data from them. If you believe a child has provided us personal data, contact us and we will delete it.

§ 08Security

We use industry-standard measures (encryption in transit, access controls, row-level security so each user can only access their own data). No method of transmission or storage is completely secure, however, and we cannot guarantee absolute security.

§ 09Changes to this Policy

We may update this Policy from time to time. We will post the new version here and update the "Effective date". Material changes will be brought to your attention where appropriate.

§ 10Contact

Questions or requests: support@getpo.co · PE Daniil Lugovskyi, Ukraine.