Privacy Policy

Last updated: July 14, 2026

Introduction

PokiSpokey ("we", "us") is committed to protecting your privacy. This policy explains what personal data we collect when you use our language learning platform, how we use it, who we share it with, and what rights you have. By using the Service you agree to the practices described here.

Data We Collect

Account data

Email address, display name, and profile picture if you sign in with Google. Passwords are stored as one-way hashes — we never see your plain-text password.

Usage data

Search queries, language preferences, and monthly search and AI credit counts. This data powers your usage meter and enforces plan limits.

Technical data

IP address (for security and rate limiting), browser type, and device type. Used for diagnostics and abuse prevention only.

Billing data

Payments are processed by Paddle.com, our Merchant of Record. We store only your subscription status and a customer reference ID — no card details, billing addresses, or payment information ever touch our servers. Paddle collects and processes your payment data directly under their own Privacy Policy.

How We Use It

We use your data strictly to operate and improve the Service. We do not sell your personal data.

  • Authenticate you and manage your account
  • Deliver search, video playback, and AI features
  • Enforce plan limits and track usage
  • Send transactional emails (verification codes, billing receipts)
  • Detect and prevent abuse and unauthorized access
  • Improve the Service using anonymized, aggregated data

Our legal basis for processing under GDPR is performance of a contract (providing the Service you signed up for) and legitimate interests (security and abuse prevention).

Data Sharing

We share data only with the services required to operate PokiSpokey:

  • Paddle.com — payment processing and order fulfillment. Paddle acts as our Merchant of Record and processes buyer data (name, email, billing address, payment details) directly under their own Privacy Policy. Per our Data Sharing Addendum with Paddle, they may share with us: your name, email address, and purchase history for subscription management purposes.
  • Groq — AI inference; your message is sent to generate a response
  • YouTube — video playback via the official IFrame API
  • Vercel — frontend hosting
  • Resend — transactional email delivery

We do not share your data with advertisers or data brokers.

Retention

  • Account data is kept until you request deletion
  • Usage counters reset monthly; aggregate totals are retained for analytics
  • AI conversation logs are kept for up to 90 days for abuse monitoring, then permanently deleted
  • Billing history is retained for a minimum of 5 years for financial and legal compliance

Security

All data is transmitted over TLS/HTTPS. Passwords are hashed before storage. We use short-lived authentication tokens with automatic rotation, rate limiting, and IP-based abuse detection. PokiSpokey is PCI-DSS compliant by virtue of using Paddle as Merchant of Record — we do not store, process, or transmit any cardholder data. In the event of a confirmed data breach, we will notify affected users promptly.

Your Rights

Depending on your location, you may have the right to:

  • Access a copy of your personal data
  • Correct inaccurate information
  • Request deletion of your account and all associated data
  • Export your data in a portable format
  • Object to or restrict certain types of processing
  • Withdraw consent at any time (where processing is based on consent)

To exercise any of these rights, email support@pokispokey.com. We respond within 30 days. For rights relating to payment data held by Paddle, please contact Paddle directly via paddle.com/legal/privacy.

GDPR (EU & EEA Users)

If you are located in the European Union or European Economic Area, the following applies:

  • Legal basis for processing: Contract performance (providing the Service), legitimate interests (security, abuse prevention, analytics), and legal obligation (billing record retention).
  • Data transfers: Some service providers (e.g., Groq, Vercel) are based in the United States. Data transfers are covered by Standard Contractual Clauses or equivalent safeguards.
  • Right to lodge a complaint: You have the right to complain to your local data protection authority if you believe we have violated your rights.
  • Data controller: PokiSpokey (contact: support@pokispokey.com). Paddle.com is an independent data controller for payment data they collect.

CCPA (California Residents)

If you are a California resident, the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA) grant you the following rights:

  • Right to know: You may request a copy of the personal information we have collected about you in the past 12 months.
  • Right to delete: You may request that we delete your personal information, subject to certain exceptions.
  • Right to correct: You may request that we correct inaccurate personal information.
  • Right to opt-out of sale: We do not sell your personal information to third parties.
  • Right to non-discrimination: We will not discriminate against you for exercising any of these rights.

To exercise these rights, email support@pokispokey.com with the subject line "CCPA Request". We will respond within 45 days.

Cookies

We use only strictly necessary cookies for authentication. We do not use tracking, advertising, or analytics cookies. Disabling cookies in your browser will prevent login from functioning.

Policy Changes

We may update this policy. The "Last updated" date at the top reflects the most recent revision. We will notify registered users of material changes via email or an in-app notice before they take effect.

Contact

Questions or requests? Email us at support@pokispokey.com.