Privacy policy

Poesy is a place to read poems and keep track of the ones you love. You can read every poem without an account; we only hold personal data if you sign in. This policy explains what we keep, why, who helps us run the service, and how you stay in control.

Who we are

Poesy (poesyapp.com) is run by Nimrod Konforty, an individual based in Israel, who is responsible for your data (the “controller”). Write to contact@poesyapp.com about anything in this policy.

What we keep

• Your account: your email address. If you sign in with Google, also the name and profile picture on your Google account, your Google account ID, and the sign-in tokens Google issues.
• Your sign-ins: for each signed-in device, a session with its IP address and browser type, kept until the session ends (at most 7 days without use) or you sign out.
• What you do on Poesy: the poems you've read and when, your ratings, the poems you like, and your lists. Lists and your own ratings are private. A poem’s average rating is shown to everyone, but never who gave which rating.
• Error reports: when something breaks, a report of the error, the page and your browser type. We set our error reporting not to include your IP address, cookies, or what you typed.
• Server logs: our server keeps short-lived technical logs (errors, and failed attempts to log in to the server itself), overwritten as new ones arrive. They don’t record your visits.

We don’t use analytics, advertising or tracking of any kind, and we don’t sell or share your data with anyone beyond the providers below.

Why we keep it

• To provide the service you signed up for: signing you in and keeping your reads, ratings, likes and lists (necessary for our agreement with you, GDPR article 6(1)(b)).
• To keep Poesy secure and working: sessions, sign-in tokens and error reports (our legitimate interest in running a safe, reliable service, article 6(1)(f)).

Cookies

We use only the cookies needed to keep you signed in. They aren’t used for anything else, so we don’t ask for consent to them. If you never sign in, we set none.

Who helps us run Poesy

• Hetzner Online (Germany) hosts the website.
• Neon hosts the database, on Amazon Web Services servers in Frankfurt, Germany.
• Resend (United States) sends sign-in emails, so it receives your email address.
• Google, if you choose to sign in with Google.
• Sentry stores error reports, in its EU region.

Each processes data only on our behalf and under a data processing agreement. Where data goes outside the EU (Resend, and Google if you use it), it is protected by the EU–US Data Privacy Framework or the EU’s standard contractual clauses.

How long we keep it

Everything tied to your account stays until you delete the account. Deleting it, from the Account page, removes your account, sessions, reads, ratings, likes and lists at once. Copies in our database provider’s backups expire within 7 days. Error reports are deleted after 30 days; server logs are overwritten as newer ones replace them.

Your rights

You can ask to see the data we hold about you, correct it, receive a copy in a portable form, restrict or object to how we use it, or have it deleted (which you can also do yourself by deleting your account). Write to contact@poesyapp.com and we’ll answer within a month. You can also complain to the data protection authority where you live.

Children

Poesy accounts are for people aged 16 and over.

Changes

If we change this policy, we’ll update the date above, and tell you by email before any change that affects how we use your data takes effect.