Privacy policy
Last updated: 28 September 2026
This policy covers polybai.com, this website, and the Polybai app for students. It explains what this site records when you visit it, what happens if you message us, what the app collects, and how information is handled on the teaching platforms we build. It is written to be read, not to be waved at a regulator.
What this covers
This policy is about polybai.com and the Polybai student app, which we publish on the App Store and Google Play. Each teacher we build a platform for runs it on their own web address, and each of those sites publishes its own privacy policy written for the students using it.
The distinction matters. On a teacher's site, the teacher decides what is collected about their students and how long it is kept; we run the software on their behalf and act on their instructions. If you are a student or a parent asking about a student's record, your teacher is the right person to ask, not us, they hold the decision, and we cannot release a platform's records without them. The one exception is your own account: you can delete it yourself in the app, as described below.
What this site collects
There is no account, no sign-up and no form on polybai.com. Nothing you type is sent anywhere, because there is nothing here to type into.
- Server records. Like any web server, ours records the address of the page requested, your IP address, your browser's user-agent string, and the time. These are used to serve the site, to keep it running, and to investigate abuse or attacks. They are not used to build a profile of you and are not combined with anything else.
- Two settings in your browser. Your language choice and your light or dark preference are stored on your own device so the site remembers them next time. They never leave your device and are not sent to us. You can clear them by clearing this site's data in your browser.
There is no analytics on this site, and no advertising. No Google Analytics, no tracking pixels, no advertising cookies, and nothing that follows you to other websites. We do not know how many of you there are beyond what the server records show.
Fonts, and the one request that leaves our server
The typefaces on this page are served by Google Fonts. To deliver them, Google receives your IP address and basic browser information as part of the request, and this happens automatically when the page loads. It is the only third party this page contacts, and we mention it because a policy that claimed "no third parties" while quietly loading fonts from Google would be untrue.
If you message us
The contact button on this site opens WhatsApp. If you use it, your message travels through WhatsApp, which is operated by Meta under its own terms and privacy policy, we do not control that, and it happens before your message reaches us.
What we then hold is the conversation itself: your phone number, the name WhatsApp shows, and whatever you choose to tell us, usually the subject you teach and the web address you would like. We use it to reply and to set up your platform, and for nothing else. We do not add you to a mailing list and we do not pass your number to anyone. Ask us to delete the conversation and we will.
If we build a platform for you
Once your platform exists, your students' records live in a database of their own, separate from every other teacher's. No other teacher on the platform can reach yours. In practice that means:
- Passwords are hashed before they are stored, so nobody, not you, not us, can read a student's password.
- Uploaded files and lesson videos have no public address. Every request is checked against the viewer's access first, and video links are signed and expire.
- A backup of your data is taken nightly and kept for 30 days, then deleted automatically. Something deleted from your site may therefore still exist in a backup for up to 30 days.
- Lesson video is delivered by Bunny.net, which receives the technical information any video service needs to play a video, including the viewer's IP address.
- Our technical staff can reach your data only as far as is needed to keep the service running and to fix problems.
If you stop using the service, tell us and your whole database is deleted, backups included, once the retention window above has passed.
The Polybai app for students
The Polybai app on the App Store and Google Play is a way into your teacher's platform. When you first open it you type your teacher's web address, and from then on it talks only to that platform: what it sends is held there, exactly as if you had used the website. That is:
- Your account. Your name, email address and password when you create an account or sign in. The password travels over an encrypted connection and is stored only as a hash.
- What you hand in. Homework files and photos you choose to upload, and your exam answers and marks. The app asks for your camera or photo library only when you attach a photo to homework, and reads only the photo you pick.
- Notifications. If you allow notifications, your phone gives the app a notification token. It is stored on your teacher's platform with your language, so the platform can tell you when homework is set or graded, or a course request is decided. Notifications are delivered by Google (Firebase Cloud Messaging) on Android and by Apple (Apple Push Notification service) on iPhone, so they receive that token and the text of the notification, such as a homework title and a mark. You can turn notifications off at any time in your phone's settings.
- On your phone. Your sign-in, your teacher's web address and your language are kept in the phone's secure storage so you stay signed in. Signing out removes the sign-in.
There is no analytics and no advertising in the app. It contains no advertising or tracking code, and nothing it collects is used to follow you across other apps or websites.
Deleting your student account
You can delete your own account from the app at any time: open My account, choose Delete my account, and confirm with your password. This deletes, straight away:
- your account, with your name, email address and profile details;
- your exam answers and results, your homework and the files you uploaded, and your access to courses and lessons;
- your phones' notification tokens.
Access codes you have already used stay used: they are a record of a purchase, so they are not refunded and cannot be used again. Copies of deleted data can remain in the nightly backups for up to 30 days, after which they are gone. Deleting your account on one teacher's platform does not affect your accounts on other platforms. If you no longer have the app, ask your teacher to delete your account, or message us on WhatsApp with your email address and your teacher's web address, and we will pass the request to them.
Who your information is shared with
Nothing here is sold, rented, or shared for advertising, not to anyone, for any price. Beyond ourselves, information reaches only:
- The company hosting our servers, where this site and the platforms run.
- Google, for the fonts on this page, and for the app's notifications on Android, as described above.
- Meta, if you choose to message us on WhatsApp.
- Bunny.net, which delivers lesson video on teacher platforms.
How long things are kept
Server records are kept only as long as they are useful for security and troubleshooting, and are routinely discarded. Messages you send us are kept while we are talking and afterwards for as long as we work together; ask and we will delete them. Platform data is kept for as long as the teacher keeps their platform, and backups for 30 days as described above. A student's account is kept until the student deletes it or the teacher removes it.
Your rights
You can ask us what we hold about you, ask for it to be corrected, or ask for it to be deleted. Message us on WhatsApp and we will answer. If your question is about a student's record on a teacher's platform, please ask that teacher, the record is theirs, and we act on their instructions.
Students under 18
Teacher platforms are used by children. Accounts there are created by the teacher, or by a student with their family's knowledge, and a parent or guardian can ask the teacher at any time to see, correct or remove what is held about their child. A student can also delete their own account in the app at any time. polybai.com itself is aimed at teachers and collects nothing from students.
Changes to this policy
If this policy changes, the new version appears on this page and the date at the top changes with it. We do not change it quietly.