Privacy Policy

Last updated: October 2026

Pennwald (“we”, “our”, “the app”) is operated by its individual founder. This policy explains what data we collect, how we use it, and your rights.

What we collect

Account data: your email address and hashed password, stored in Supabase (supabase.com). When you choose a password we check whether it appears in known public breaches, by sending only the first five characters of its hash to HaveIBeenPwned — your password never leaves your device.
The text you write or upload: we do not store it. Your text is sent to Google Gemini to produce the correction, lookup or answer you asked for, and the result is returned to your browser. Neither the text nor the result is saved to our database. Unsent drafts are kept only in your own browser's local storage, on your device, until you clear them.
Your chosen languages: the languages you select are saved to your account so they follow you between devices. That is a preference, not content — it says nothing about what you wrote.
Words you save: when you tap save on a word, we store that word, its meaning, the one sentence you met it in, and how many times you have told us you knew it. The sentence is kept because it is what makes the word memorable later; it is a single sentence from what you were reading, never the page, its address, or anything else on it. You choose what goes in this list, you can remove any entry while practising, and it is deleted with your account.
Which of your own documents a word came from: if you save a word while reading something in your library, we also store which document it was and which page, so the word can link back to it. That is a reference to a document already stored on your account — nothing new about you. Removing the document leaves the word and its sentence intact and simply drops the link. Words you save with the browser extension have no such record: they keep the sentence and nothing else, because we do not collect the addresses of pages you visit.
Documents in your library: text you add to your library — a pasted article, an extracted PDF, an imported EPUB or free book, or a text written for you — is stored with your reading position so you can pick it up on another device. You choose what goes in, you can remove any document, and it is deleted with your account. Your draft at the writing desk is different and is never stored.
What the browser extension reads: only the word you click or the passage you select, plus the sentence around it so the meaning fits the context. We do not collect the pages you visit, your browsing history, or the rest of the page's text, and the extension reads nothing at all until you switch it on for a page or a site.
How much you use it: we count how many word lookups you make each day, and whether they came from the website or the extension, so that the free daily allowance can be applied and so we can see whether the product is being used. We also record the date you first connected the extension and the date of your first lookup. A count and a date — never the word you looked up.
Payment data: your card is handled entirely by Stripe (stripe.com). We never see or store your full card number. We store your Stripe customer ID and subscription status.
Usage data: standard server logs (IP address, timestamps, page routes) are retained for up to 30 days for debugging purposes only.

How we use your data

To operate the service — deliver corrections, word lookups and answers to the questions you ask.
To process payments and manage subscriptions via Stripe.
To send transactional emails only (email confirmation, password reset, welcome) via Resend (resend.com). We do not send marketing or reminder emails.
AI corrections, lookups and answers are generated by Google Gemini (Google LLC). The text you submit is sent to Google's API to produce them. We do not use your data to train AI models.

Third-party services

We use the following sub-processors:

Supabase — database and authentication (EU region)
Vercel — hosting and edge functions (global CDN)
Stripe — payment processing
Resend — transactional email delivery
Google Gemini — AI language correction (text you submit for correction is processed by Google)

The browser extension

The Pennwald extension lets you click a word on any website and get the same explanation the reader gives you. Because it runs on other people's pages, it is worth being precise about what that means.

It is off until you turn it on. Nothing is read on a page until you press Read this page, or until you explicitly choose Read on a particular site. It is installed asking for permission to reach one website — ours. Any other site is a permission you grant one at a time, and withdrawing it switches the extension off there.
What leaves your browser is the word, not the page. When you click a word or select a passage, that text and the sentence around it are sent to us, and on to Google Gemini, to produce the explanation — exactly as in the app. The page itself, its address and your browsing history are not sent, stored or logged.
Definitions are cached on your own device so that looking the same word up again is instant and costs nothing. That cache lives in the extension's local storage and is removed when you uninstall it.
It has no login form. You sign in on this website, and the extension inherits that session. It never sees or asks for your password. Signing out here signs the extension out too.
Words you save from the extension go to the same list as words saved in the app, and are covered by everything said about them above.

Data retention

The data we retain is your account record — email address, Stripe customer ID, subscription status — your chosen languages, the words you explicitly saved, the documents you added to your library, and daily counts of how many lookups you made. We keep it for as long as your account is active. Because we never store the text you write or read, there is no learning history to retain or delete. When you delete your account, your account record is removed immediately and all personal data is permanently deleted within 30 days. Stripe may retain payment records for up to 7 years as required by financial regulations.

Your rights

You have the right to access, correct, export, or delete your data at any time. Settings → Your Data → Download my data gives you everything we hold as a single JSON file, including the full text of your library. Settings → Delete Account removes it all. For any other GDPR request, contact us at the email below and we will respond within 30 days.

A note on what this policy does not cover

This policy is written by Pennwald's founder, not by a lawyer, and is not legal advice. It describes the app's actual behaviour as of the date above.

Cookies

We use only session cookies required for authentication (via Supabase). We do not use advertising or tracking cookies.

Children

Pennwald is not directed at children under 16. We do not knowingly collect data from anyone under 16.

Changes

If we make material changes to this policy, we will notify you by email at least 7 days before they take effect.

Contact

Questions? Email us at hello@pennwald.com. We typically respond within 2 business days.