Privacy Policy
Last updated: 12 July 2026
Poly is a small, independently-run project. This page explains what data it collects, why, and how you can access, export, or delete it — in plain language, not legalese.
What's collected
| Data | Why |
|---|---|
| Email, hashed password, username | Account creation and sign-in |
| Bio, avatar, bio photos, badges | Your public profile |
| Published packages, download counts | The community registry |
| Follows, friends, notifications | Social features, opt-out per type in account settings |
| Hashed personal access tokens | CLI and AI assistant (MCP) sign-in, revocable any time |
| Browser push subscription endpoint | Real OS notifications, only if you opt in; revocable any time |
| Payment confirmation (not full card details) | Poly Pro one-time purchase, handled entirely by Stripe |
Who processes it
Poly doesn't run its own servers. It relies on a small number of infrastructure providers:
- Supabase — database, authentication, file storage, and the backend functions that power the site, CLI, and MCP server.
- Stripe — payment processing for the one-time Pro purchase. Poly never sees or stores your card details.
- Hostinger — hosts the static website (poly.candygate.eu).
- GitHub — hosts the open source code and CLI release downloads.
Cookies and local storage
No advertising or tracking cookies. The site stores a couple of small preferences in your browser's local storage — theme (dark/light) and language — and Supabase stores your sign-in session so you don't have to log in on every page. Nothing is shared with ad networks or analytics trackers.
Retention and deletion
Your data is kept while your account is active. You can permanently delete your account and all associated data (profile, packages, tokens, social graph, notifications) from your account settings at any time — this can't be undone. You can also email open.corp.2030@gmail.com to request deletion or an export of your data.
Your rights
If you're in the EU/EEA or a similar jurisdiction, you have the right to access, correct, export, and delete your personal data, and to object to specific processing (like optional notifications). Most of this is self-service in account settings; anything else, email us.
Children
Poly isn't directed at children and shouldn't be used by anyone under 16.
Changes
This policy may be updated as the product evolves. Meaningful changes will be reflected here with an updated date at the top.
Contact
Questions, exports, or deletion requests: open.corp.2030@gmail.com. See also the Terms of Service.