Privacy Policy

This Privacy Policy describes how we handle personal data when you use the Sink In mobile app, its browser extension, this website and related services. For general policies across all Pomisoft products, see our company privacy policy.

1. Who We Are

Pomisoft OÜ ("we," "us," or "our") is the data controller for personal data processed in connection with Sink In unless we state otherwise (for example, where a processor acts strictly on our instructions).

Contact: hello@pomisoft.dev, Estonia.

2. Data We Collect

Sink In is designed to need as little personal data as possible. Most learning happens entirely on your device. Depending on how you use Sink In, we may process:

• Account data: Email address and profile details you provide if you sign in to enable cross-device sync of Pro features (including through Apple, Google, or other providers we support).
• App content: Phrasal verbs and meanings you bookmark, learning status, and review history. This is stored on your device and, if you sign in, synced to your account.
• Usage and device data: App interactions, diagnostics, crash data, device type, OS version, and approximate region as needed to run and improve the service.
• Purchase data: Subscription status and transactions processed by Apple or Google; we receive limited receipt or entitlement information from those platforms or our payment partner as described in the App.
• Support communications: Information you send when you contact us.

3. Our Website (sink-in.app)

When you visit sink-in.app, we process the following data:

• Analytics without cookies: We use PostHog, on its EU servers, to see how the website is used. It sets no cookies and stores nothing on your device. We record the pages you view, clicks, how far you scroll, time on a page, page speed, the page or ad that sent you (including campaign tags and ad click IDs in the link), browser, device type, and country. To count unique visitors, PostHog turns your IP address and browser details into a one-way code with a key that changes every day and is then deleted. Your IP address is not stored with the analytics data. We do not use this data to identify you or to show you ads.
• Google Ads tag: We advertise on Google, so the website loads a Google Ads tag. It runs with consent set to denied, which means Google sets and reads no cookies. When a page loads, and when you tap an App Store or Google Play link, the tag sends Google your IP address, browser details, the page address, and the ad click ID if you came from one of our Google ads. Google uses this to count how many ad clicks led to a store tap. Google handles this data under its own privacy policy.
• App store links: When you tap an App Store or Google Play link, we add the place on the page and any campaign tag to the link, so the store can tell us how many installs came from the website. Apple and Google handle this under their own privacy policies.
• Level test and practice quiz: Your answers stay in your browser. If you continue on an iPhone, we keep your answers together with your IP address (for IPv6, your network prefix) for up to one hour, so the app can load them the first time it opens. We delete them when the app collects them, or after one hour. On Android, the answers are passed to the app through Google Play.
• Hosting: Cloudflare hosts the website. It processes your IP address and browser details to deliver pages and protect the site from abuse.

We rely on our legitimate interests to understand how the website is used and which campaigns work. You can object at any time by contacting us, or block analytics with your browser settings or a content blocker.

4. Browser Extension

The Sink In extension for Chrome, and for Safari on iPhone and iPad, highlights phrasal verbs on the web pages you visit and shows their meanings. You can use it without an account. When you use it, we process:

• Page text stays in your browser: The extension finds phrasal verbs on a page inside your browser. It does not send the pages you visit, their addresses, or your browsing history to us.
• Saves without an account: In Chrome, the phrasal verbs you save and mark as known stay in the browser's extension storage on your device. The extension does not send them to us. In Safari, the extension and the Sink In app on the same device share your saves and learning statuses through storage on that device. The extension does not send them to us; the app syncs them only if you use cloud sync, as described in this policy.
• Sign-in (Sink In Pro, Chrome): If you have Sink In Pro, you can sign in with Apple or Google through our server, and the extension keeps a session token in the browser's extension storage until you sign out. When you sign in, the saves you made in Chrome join your account. In Safari the extension uses the account you are signed in to in the Sink In app on the same device.
• Your study list (Sink In Pro, Chrome): After you sign in, the extension downloads the learning status of your phrasal verbs from your account and sends back the meanings you save or mark as known, the same data the app syncs.
• Meaning detection with AI (optional, Sink In Pro): If you turn on meaning detection, the extension sends the sentence around each highlighted phrase (at most about 500 characters), the phrase, and its possible meanings to our server. It sends only sentences from the part of the page you are looking at, and only for highlighted phrases. Our server asks an AI model through OpenRouter with the setting that neither OpenRouter nor the model provider stores the text or trains on it. We keep the sentence and the answer in a cache that all users share, without your account or any other identifier, so the same sentence is not checked twice. The cache holds about 50 MB and deletes the entries that have not been used for the longest time. To prevent abuse, we count how many new sentences each account sends per day; this count is deleted after one day. You can turn detection off at any time in the extension's popup, or for one website in the meaning card.
• No analytics: The extension sends no analytics and no crash reports.

We rely on the performance of our contract with you for the highlights and the sync, and on your consent for meaning detection with AI.

5. Ads and App Installs

We advertise Sink In, and we measure which ads lead to installs and subscriptions:

• iPhone and iPad (App Store version): The app uses Google Analytics for Firebase, a Google service. It records when the app opens for the first time, when you finish the first level check, when you start a free trial, and when you buy a subscription (with its price and currency). With these events it sends a random app ID, device model, system version, app version, and your approximate country, which Google works out from your IP address. Google uses this data to tell us which Google ads led to installs and subscriptions, and to decide where to show our ads. The app does not ask for permission to track you and does not read your device's advertising identifier (IDFA). Google handles this data under its own privacy policy. Test and development versions of the app do not send it.
• Install from sink-in.app on iPhone: If you tapped the App Store link on sink-in.app after clicking one of our ads, we keep the ad's campaign tag with your IP address (for IPv6, your network prefix) for up to one hour. When the app opens for the first time, it asks our server for a tag that matches its IP address. We use the tag only to count installs and subscriptions per campaign in our own analytics. We never send this match to Google or any other ad network.
• Apple Ads: When the iPhone or iPad app opens for the first time, it asks Apple whether the install came from one of our ads in the App Store. Apple answers with the campaign, ad group, keyword, country or region, and the date of the click. It does not include your name, your Apple Account, or a device identifier. We keep this answer in our analytics and with our subscription provider, so we can count installs and subscriptions per campaign.
• Android: Google Play tells the app which campaign, if any, led to the install. Google Play reports installs and purchases to Google Ads through our store account. The Google Play version of the app also uses Google Analytics for Firebase. It records when the app opens for the first time, when you finish the first level check, when you start a free trial, and when you buy a subscription (with its price and currency). With these events it sends a random app ID, device model, system version, app version, and your approximate country, which Google works out from your IP address. Google uses this data to tell us which Google ads led to installs, and to decide where to show our ads. The app does not read your advertising ID. Test and development versions of the app do not send it.

We rely on our legitimate interests to measure our advertising. You can object at any time by contacting us.

6. How We Use Data

We use personal data to:

• Provide, operate, and secure Sink In (sync, accounts, spaced repetition)
• Process subscriptions and restore purchases
• Improve reliability and performance, including debugging and abuse prevention
• Communicate with you about the service or respond to requests
• Comply with legal obligations

7. Legal Bases (GDPR)

Where GDPR applies, we rely on:

• Performance of a contract: providing the App you requested
• Legitimate interests: security, product improvement, and analytics that are not overridden by your rights
• Consent: where we ask for it (you may withdraw consent where applicable)
• Legal obligation: where required by law

8. Retention

We keep personal data only as long as needed for the purposes above, including providing the service and meeting legal, tax, or accounting requirements. When data is no longer needed, we delete or anonymize it.

Level test answers, practice quiz answers, and ad campaign tags that we hold with an IP address are deleted after one hour at most.

9. Your Rights

Depending on your location, you may have rights to access, rectify, delete, restrict, or object to certain processing, and to data portability. To exercise these rights, contact hello@pomisoft.dev. You may also lodge a complaint with your local supervisory authority.

10. Third Parties

We use trusted service providers (for example, cloud hosting, authentication, analytics, ad measurement, crash reporting, and subscription management) under agreements that require appropriate safeguards. Those providers may process data only as instructed and for defined purposes.

The main providers are:

• PostHog (EU servers): app and website analytics, and crash reports.
• RevenueCat: subscription status and purchase history.
• Google: Google sign-in, Google Play, Google Ads, and Google Analytics for Firebase in the store versions of the app.
• Apple: Sign in with Apple, the App Store, and Apple Ads.
• Cloudflare: hosting for sink-in.app.
• OpenRouter: AI meaning detection in the browser extension, with no storage of the text by OpenRouter or the model provider.

App stores (Apple, Google) process payment and account data under their own privacy policies when you purchase or manage subscriptions.

11. Security

We implement technical and organizational measures designed to protect your data. No online service can guarantee absolute security.

12. International Transfers

If we transfer data outside the European Economic Area, we use appropriate safeguards such as standard contractual clauses where required.

13. Children

Sink In is not directed at children under 16. We do not knowingly collect personal data from children under 16. If you believe we have, contact us and we will take steps to delete it.

14. Changes

We may update this Privacy Policy. We will post the new version here and update the "Last updated" date. Where required, we will provide additional notice.

15. Contact

Questions or requests: hello@pomisoft.dev
Pomisoft OÜ, Estonia