Privacy policy

What we collect and why

• Account and access: your email address, account identifier, verification-code records, hashed session tokens, sign-in timestamps, device associations and license or trial status. We use these to authenticate you and provide access. Email codes are delivered through Resend. Optional Google sign-in supplies a verified identity token and email.
• Trial eligibility and abuse prevention: hashed installation and Android identifiers, salted IP/network hashes, browser identifiers, trial scores and reasons, and promotion-redemption history. These are pseudonymous, not anonymous. Automated checks can shorten or refuse a trial; contact us to request review.
• Payments: Stripe processes website payments. We store transaction and customer references, amounts, currency, status and timestamps, not full payment-card numbers. Stripe also processes information you enter at checkout under its own privacy policy.
• Support and AI-output reports: your chosen category, message, optional contact address, app version and device/OS description; reports may be linked to your signed-in account. Reporting an AI response sends its identifier and the text you submit, not the full conversation automatically. Do not include secrets or unnecessary personal information.
• Optional web remote access: when enabled and used, our relay processes phone name, network state, commands and responses. Payloads can include messages, conversation content, configuration and workflows. This feature is not entirely local or end-to-end encrypted against the service operator.
• Website and service requests: infrastructure providers receive IP addresses, browser/device information and request metadata to deliver and secure the service. The website uses necessary authentication and trial cookies. Google Fonts receives network requests when website fonts load. We do not use these records for targeted advertising.

Your workspace and AI providers

Projects, terminal history, agent settings and conversations can be stored on your phone. When you use a cloud AI provider, the prompts, selected files, tool output and other context needed for your request are sent to the provider or endpoint you configure. Your chosen agents, integrations and build servers can transmit additional data according to the commands and permissions you approve. API keys are used to authenticate those services; never paste a key into a report.

We do not sell personal data or use it for targeted advertising. We do not use account or support data to train our own general-purpose AI models. Your chosen AI providers have their own retention and training settings; check their policies before sending sensitive content. Local execution does not mean all features work offline or that no data leaves your device.

Optional phone tools and permissions

Phone automation through Shizuku requires a separate in-app disclosure and permission. Depending on the task you approve, tools can read screen/UI text, capture screenshots, inspect logs, tap or type, and install a build you request. Screen content and tool results may become AI context sent to your selected provider. Do not grant access to other people's information without permission. You can decline the disclosure, revoke Shizuku permission or stop using phone tools; this does not delete copies already sent.

Files you choose, microphone input if you use voice input, and other task content are processed for the features you invoke. Android permissions and visible task controls govern access. Package installations contact the repositories named in the commands; the Play build asks for terminal approval before supported installation flows run.

Who receives information

Cloudflare hosts our website, account database, downloads and relay. Resend delivers account email. Stripe handles payments. Google handles optional Google sign-in and website fonts. Your selected AI, code-hosting, package-repository, integration and build-service providers receive data when you use them. Providers may process information outside your country. We do not claim all data stays in a particular region.

Authorized operators can access account and support records to run the service, investigate abuse and process rights requests. We may disclose limited information where required by law or necessary to protect users and the service. We use HTTPS, access controls and hashed session tokens; no service can guarantee perfect security.

Retention and your choices

See the retention policy for periods, manual processing and exceptions. Request account deletion from a browser without reinstalling the app. You may also request access, correction, a copy of your data, deletion of particular data, or review of a trial decision through Contact. We verify ownership before releasing or deleting private information. Depending on your location, you may have additional rights and may complain to your local data-protection authority.

Account deletion does not wipe projects on your phone or independently held copies at services you selected. Remove local data through Android app storage controls or delete the files yourself; request deletion from independent providers separately. We handle deletion instructions to our processors where applicable.

Age and changes

Polariton is intended for adults aged 18 and over, not children. If you believe a child has supplied personal information, contact us for review and deletion. We update this page when practices change, date the policy, and give notice of material changes through the website or app. This notice does not waive rights granted by applicable law.