Privacy Policy

• You can use Pomelo without an account. We create an anonymous guest session so your course survives a page refresh — no email required.
• If you create an account, we collect your email address, a password (or a Google/Apple sign-in), and an optional display name.
• We store what you tell us during the qualifying chat — your topic, what you already know, what you want to learn — because that is what the course is generated from.
• We store the courses and chapters generated for you, your chat messages with a chapter, and your progress.
• Your topic, your qualifying answers and your chat messages are sent to our AI model provider to generate the course and answer your questions. Under that provider’s commercial API terms, this content is not used to train their models.
• We use a product analytics provider for usage metrics and session recordings. We do not sell your data, and we do not run advertising.
• We have never taken a payment, so we hold no payment or financial data.

2.1 Information you give us

2.2 Information collected automatically

• Usage events. We record a small set of product events: starting a qualifying chat, finishing one, opening a chapter, completing a chapter, and creating an account. These carry properties such as the course topic, chapter number, course ID, and whether you were a guest or a registered user.
• Page views and errors. Which pages you visit, and unhandled errors your browser hits, so we can find crashes.
• Session recordings. We may record a replay of your session — mouse movement, clicks, scrolling and page content — to see where the product confuses people. Password fields are masked by our analytics provider.
• Device and connection data. IP address, browser and OS, device type, screen size, referring page and any UTM campaign parameters in the link you arrived from.
• Cookies and local storage. See section 7.

Client-side analytics requests are routed through a first-party path on our own domain before being forwarded to our analytics provider, so that ad-blockers don’t silently break our metrics. It is the same data going to the same provider — the path just isn’t on a blocklist.

2.3 Information from third parties

If you sign in with Google or Apple, we receive your email address and basic profile information from them. We do not receive your password, and we do not get access to your Google or Apple account beyond sign-in.

2.4 Mobile app

The Pomelo app collects everything above, plus:

• Session tokens stored in the device keychain (iOS Keychain / Android Keystore), not in ordinary app storage.
• Push notification token and your time zone, if you turn on daily reminders. Used only to send the reminder you asked for, at the hour you chose.
• Microphone access, only if you use a voice feature and only after you grant permission at the system prompt. Audio is used to produce the response and is not retained as a recording.

The app does not collect your contacts, photos, precise location, or advertising identifier.

You can generate a course and read it without signing up. When you do, we create an anonymous account for you, which holds the same course data as a registered account but has no email attached to it. If you later sign up, that guest account becomes your real account and your course comes with it.

Guest accounts and their courses may be deleted after a period of inactivity. If you want to keep a course, create an account.

We use it to:

1. Run the product — generate your course, generate chapters, answer your questions, save your progress, keep you signed in.
2. Send you service email — account confirmation, password reset, a one-time welcome email from one of the founders, and (if you enable them) daily learning reminders.
3. Understand how Pomelo is used — which steps people abandon, what share of opened chapters get finished, which topics people pick. Some of this analysis links your account to your activity, so we can tell a real user from a test account and understand individual journeys during our early stage.
4. Fix and improve things — diagnose errors, watch session recordings, review feedback and interviews.
5. Keep it secure — detect abuse, rate-limit generation, and enforce quotas.
6. Meet legal obligations and respond to lawful requests.

If you’re in the UK or EEA, our legal bases are: performance of a contract for everything in (1) and the service email in (2); legitimate interests for (3), (4) and (5) — our interest in running and improving a product people can actually use; consent for reminder notifications; and legal obligation for (6).

What we don’t do

• We don’t sell your personal information, and we don’t “share” it for cross-context behavioural advertising.
• We don’t run ads or ad-tracking pixels.
• We don’t use your course content or chats to train our own models.

Pomelo is built on large language models. This is the part most people care about, so it’s spelled out.

What gets sent to our AI model provider: your course topic, your qualifying-chat answers and resulting learner profile, your course preferences and directives, the chapter text being read, and the message you type into a chapter chat or highlight question.

Training. We use this provider under its commercial API terms, which provide that inputs and outputs submitted through the API are not used to train its models. It retains API data for a limited period for trust-and-safety purposes. We will tell you here if we change providers to one whose terms differ.

Web search grounding. When generating a chapter we may run web searches to check facts and find citations. The search queries are derived from your course topic and chapter title — not from your personal details — and are executed by our AI provider’s search infrastructure.

Narration and podcast audio. If you play a chapter as audio, the chapter text is sent to a third-party text-to-speech provider to be synthesised into speech. The generated audio file is stored in a private bucket under our control and served to you over short-lived signed links.

Illustrations and video. To illustrate a chapter we search open image libraries and the YouTube Data API using search terms derived from the chapter content. These searches carry no personal information about you. See section 6 for what embedded YouTube videos mean for your data.

We don’t sell your data. We do use service providers (“subprocessors”) who process it on our behalf, under contract and only on our instructions. All of them are based in the United States:

If you need the specific identity of a provider — for a due-diligence review, a data-subject request, or your own records — email support@learnpomelo.com and we’ll tell you.

Content sourcing. To illustrate chapters we query open image libraries and the YouTube Data API with search terms derived from the chapter content. These requests contain no personal information about you, so those services are not recipients of your personal data.

YouTube. Chapters can embed YouTube videos. Pomelo’s use of the YouTube API Services means you are also bound by the YouTube Terms of Service, and Google’s handling of your data is governed by the Google Privacy Policy. When a chapter containing an embedded video loads, YouTube receives your IP address and may set cookies directly, independently of us. You can revoke Pomelo’s access to your Google data at Google’s permissions page.

We may also disclose information if we’re legally required to, to enforce our terms, to protect someone’s safety, or as part of a merger or acquisition — in which case we’ll say so here before your data moves.

We don’t use advertising cookies.

We don’t currently show a cookie consent banner. You can opt out using your browser’s Do Not Track / Global Privacy Control signal, a tracker blocker, or by emailing support@learnpomelo.com.

• Account data — kept while your account exists.
• Courses, chapters, chats and progress — kept while your account exists, so you can come back to a course.
• Guest sessions and their courses — may be deleted after a period of inactivity.
• Analytics events and session recordings — retained by our analytics provider under its retention policy; session recordings are kept for a much shorter period than events.
• Generated audio— cached so a chapter doesn’t have to be re-synthesised; removed when the chapter or account is deleted.
• Support email — kept as long as needed to handle the conversation and any follow-up.

When you delete your account, we delete your courses, chapters, chats and progress. Backups roll off on their own schedule, typically within 30 days.

Whoever and wherever you are, you can email support@learnpomelo.com and ask us to:

• tell you what we hold about you,
• give you a copy of it,
• correct it,
• delete it,
• stop using it for a particular purpose.

We’ll respond within 30 days. We won’t treat you differently for asking.

UK / EEA (UK GDPR and GDPR). You additionally have the right to restrict processing, to data portability, to object to processing based on legitimate interests, and to withdraw consent at any time without affecting processing already carried out. You can complain to your national supervisory authority — in the UK, the ICO.

California (CCPA/CPRA). You have the right to know, delete, correct, and opt out of sale or sharing. We do not sell or share personal information as those terms are defined, and we do not knowingly process the personal information of anyone under 16 for those purposes. We honour Global Privacy Control signals. The categories we collect are listed in section 2; the business purposes in section 4; the recipients in section 6.

Other US states (Virginia, Colorado, Connecticut, Utah, Texas and others with comprehensive privacy laws) — the same access, correction, deletion, portability and opt-out rights apply, and you may appeal a refusal by replying to our decision.

Passwords are hashed by our authentication provider and never stored in plaintext. Every table holding your data is protected by row-level security, so one account cannot read another’s courses. Mobile session tokens live in the device keychain rather than general app storage. Generated audio sits in a private bucket and is served through short-lived signed URLs. Traffic is encrypted in transit.

No system is perfectly secure. If we ever have a breach affecting your personal data, we’ll notify you and the relevant regulator as the law requires.

We are based in the United States and our providers are in the United States. If you use Pomelo from the UK, EEA, or elsewhere, your information will be transferred to and processed in the US. Where required, these transfers rely on the European Commission’s Standard Contractual Clauses (and the UK Addendum) in our agreements with our providers.

Pomelo isn’t for children. You must be at least 13 to use it (16 in the EEA and UK where local law requires it). We don’t knowingly collect personal information from children below that age. If you believe a child has given us information, email support@learnpomelo.com and we’ll delete it.

If we change this policy we’ll update the date at the top. For changes that materially affect how we use your information, we’ll tell you by email or in the app before they take effect.

Email: support@learnpomelo.com
Operators: Ananth Preetham and Siddharth Preetham, United States

If you’re in the EEA or UK and want to raise something formally, use the same address and mark it “Data protection request”.