Privacy Policy

Your first name, your family name, an email address, and a password — which is not stored; a one-way hash that cannot be turned back into it is.

Your date of birth, to confirm you are 18 or over. It is shown to nobody and used for nothing else.

The record of your agreement to the terms: when you agreed, and to which version.

What you choose to add to your profile: a handle, a photo and a short bio. These are public — anybody who opens your profile sees them.

Reels: the video, including your face and voice, with its description and tags. It is published only after a person on our team has reviewed it, and then anybody visiting the site can see it. We keep, with it, when you confirmed you have the right to publish it.

Comments on reels, and what you write in a science café — posts, pictures, clips, voice notes, polls and sources: seen by the other members of that world.

Debates: the question and the rounds are seen by signed-in members; the messages arranging the time are between the two sides only.

Study partners: your request appears on the world’s board, under an alias if you choose one; the conversation is between you and your partner only.

Who you follow and who follows you is visible to signed-in members. Who you block is visible to nobody but you, and the person is not told.

An academic standing granted by the administrators appears beside your name in the world it was granted in.

Which lessons you have finished, which programmes you subscribed to with each subscription’s status and dates, and messages you send through the contact page.

The notifications you receive, and which you have read.

What you watch in reels: how many seconds, whether you finished, what you liked or saved, and when you asked for “more like this” or “less”. From this we compute an interest score per hashtag that decides the order of your feed. This is profiling of your interests; it stays inside the site, is never used for advertising or given to anybody, and you can see all of it in your data export.

A reel’s text is checked automatically against a word list before anybody sees it, and then a person decides. Nothing is published by an automatic decision alone.

When you report something we keep who reported it, what, why, and a copy of the words as they were at that moment. The writer is not told who reported them. For a private conversation, only the reported line reaches the review team — never the conversation around it.

If you file a copyright complaint, we keep what you wrote, your name and email address, and the IP address it was sent from, as the record of the complaint and of what was decided. Only the review team sees it, and your name and address are not given to the reel’s author.

Documents you upload to be granted an academic standing — a certificate or the like — are seen only by you and the person reviewing them, and are deleted as soon as a decision is made, either way. Only the decision remains.

Failed sign-in attempts on your account, and a temporary lock once there have been enough of them.

A log of administrative actions: who did it, their address, what they did, when, and how the request ended.

The IP address a request comes from, used at that moment to rate-limit requests, and not used to follow you.

The session tokens that keep you signed in. With each session we keep the browser and device it came from, its IP address and when it was last used, so you can see them on your account page and end any that are not yours. They are deleted within 30 days of the session ending, and we write to you when your account is signed in to from a device not seen in the last 30 days.

If you turn on two-step sign-in, we keep the key your authenticator app shares with us, encrypted, and your recovery codes only in a form they cannot be read back from. All of it is deleted when you turn it off.

Two, and both are for signing in: one for the session and one to renew it. Both are hidden from scripts in the browser (httpOnly), restricted to this site (SameSite), and sent only over an encrypted connection in production.

There is no advertising cookie, no analytics cookie and no third-party tracker of any kind. The fonts are served from our own server, so opening a page asks Google for nothing.

What you write and draw on a book in the reader, your notes on a page, and your pen, background and toolbar settings are kept in your browser alone and never sent to us.

So we cannot read them, cannot restore them if you clear your browser data, and cannot move them to another device.

Address confirmations, password resets and email-change confirmations: messages your own action asks for.

Security notices: when your password changes, when a move of your account to another address is asked for and when it happens (sent to the old address), when your account is signed in to from a new device, and when two-step sign-in is turned on or off. These cannot be turned off, because they are how you find out that somebody else is in your account.

Letters about study partners: when someone accepts your offer, and when a partner writes to you while you are away. These are the only ones that can be turned off — from your account page, or from the link at the bottom of the letter itself.

We send no marketing email.

We do not sell your data, rent it or trade it, and we show no advertising.

Beyond what you publish, as described above, your data is seen only by the site’s team, as far as their work needs it.

Email passes through our mail provider, which receives only the address and the message. Data and files are stored on our hosting provider’s servers; both providers, and where the servers are, will be named here before launch.

We may disclose what we hold if a valid legal order compels us, and will tell you when we are permitted to.

To see everything we hold about you: “Download” under “Your data” on your account page gives you a complete copy — your account, what you wrote and uploaded, who you follow, what you watched and what was concluded from it, your sessions and your reports.

To correct it: your name, email, password and profile from your account page. A date of birth is corrected on request through the contact page.

To delete: what you write and upload, one piece at a time, or your whole account (see below).

To object or withdraw consent: by turning off the optional letters, or by closing your account.

For any other request, or to complain, write to us from the contact page. You also have the right to complain to the personal data protection authority in your country.

Your data is kept for as long as your account is open, except where a shorter time is given above.

Closing your account deletes: your name, email and password; your handle, photo, bio and date of birth; every reel you uploaded, and every picture, clip or voice note you attached in a café — the files themselves, not just the references to them; your academic standing and its documents; who you follow, who follows you and who you blocked; your notifications, your viewing history and what was concluded from it; and your sessions and lesson progress.

What you wrote in a public discussion — a post, a comment, a debate round, a message to a study partner — stays where it is without your name, under “Deleted account”, because other people’s replies answer it. If you want any of it gone, delete it before closing the account.

Subscription records stay, linked to an identifier that says nothing about you: they are the record of what was sold and to whom, and deleting them would be destroying an accounting record.

Polymath is for people aged 18 and over. We do not open accounts for anybody younger, and if we learn that an account holder is under 18 we close the account and delete its data as described above.

There are no payments on this site today.

When paid subscriptions begin, this page will be updated before they are switched on, to name who processes payment and what reaches them. Card numbers never reach our servers and are never stored by us.

If what we collect changes, this page and its date change with it. If the change is material — something new collected, or a new purpose — we ask for your agreement on your next visit, and it does not apply to you before you give it.