Polify

Legal

Privacy Policy

This site sets no tracking cookies, runs no analytics, and carries no advertising. The only personal data Polify holds from it is what you type into the careers form — your name, your contact details, a link to your work, and any files you upload. This page explains what happens to that, who else can see it, how long we keep it, and how to have it removed.

Last updated 8 September 2026

1. In short

  • No tracking cookies, no analytics, no advertising pixels, no fingerprinting.
  • We never sell, rent or trade personal data. We don't buy it either.
  • The only personal data we collect is what you send us through the careers form, or in a message to us.
  • We store a one-way hash of your IP address to stop the form being abused. We do not store the address itself.
  • You can ask us at any time for a copy of what we hold about you, or to delete it.

2. Who we are

Polify is a creative studio working with founders, protocols and products. For the data described on this page, Polify is the data controller: we decide what is collected and why. This policy covers https://www.polify.xyz and the careers form on it.

If Polify is processing data on behalf of a client as part of a project, that engagement is covered by the agreement with that client, not by this page.

3. What we collect

Browsing the site collects nothing about you. Data only starts existing when you send us something. That is:

Your application
Your name, your email address, and any of the handles you choose to add — Telegram, Discord or X. What you do (your discipline), the role you applied for as it was advertised at the time, and a link to your portfolio if you gave one.
Files you upload
The files themselves, plus each file's name, type and size. They are stored privately and are not readable from a public URL.
Anti-abuse and technical data
Your browser's user-agent string, the page that referred you, and a one-way salted hash of your IP address. The hash is what lets us rate-limit repeat submissions from the same source; it cannot be turned back into your IP address, and we do not store the address itself.
Anything you write to us
Messages you send on Telegram, X, LinkedIn or by email, and what you enter when booking a call, stay in those systems as well as ours.

There are no accounts on this site, no newsletter, and no payments taken through it. We ask for no more than the list above.

4. What we don't do

  • No analytics service, no advertising network, no third-party pixel or tag runs on this site.
  • We do not build a profile of you, and we make no automated decisions about you.
  • We do not sell, rent or trade personal data, and we do not buy it.
  • We do not use your application to market anything to you.

5. Cookies and browser storage

This site sets no cookies.

It writes one entry to your browser's session storage: a flag recording that the opening animation has already played, so it doesn't replay every time you move around the site. It holds no personal data, it is never sent to us, and your browser discards it when you close the tab.

The internal careers inbox at /applications stores an access token in the browser of whoever is signed in. That page is for the Polify team, is blocked from search engines, and is not part of the public site.

6. Why we use it

To consider your application and reply to you
This is the whole reason the form exists. Under the GDPR the basis is that these are steps taken at your request before entering into a contract, and our legitimate interest in hiring.
To come back to you about future roles
Our legitimate interest in keeping a record of people we'd like to work with. You can object at any time and we'll delete the record.
To keep the form from being abused
The hashed IP and the technical fields exist to rate-limit and to investigate abuse. Our legitimate interest in the security of the site.
To meet legal obligations
Where the law requires us to keep or produce something.

7. Who else can see it

Inside Polify, only the people who work the careers inbox. Outside, the four service providers that run the site's infrastructure. They process data on our instructions and are not allowed to use it for their own purposes:

Vercel
Hosting, and the private store the uploaded files live in.
Neon
The database that holds the applications.
Resend
Sends the emails we write back to applicants.
Sanity
Holds the site's own content — case studies, copy, images. No application data reaches it.

Beyond those, we share personal data with no one, unless the law requires it or we need it to establish or defend a legal claim.

8. When you leave the site

Booking a call takes you to Cal.com; the social links take you to Telegram, X and LinkedIn. Those are separate services with their own privacy policies, and what you do there is covered by them, not by this page.

9. Where the data is held

The providers above operate in the European Union and the United States, so your data may be processed outside the country you live in. Where data leaves the EEA or the UK, the transfer is covered by standard contractual clauses or an equivalent safeguard in our agreement with that provider.

10. How long we keep it

  • Applications: while the role is open, and for up to 12 months after a decision, so we can come back to you if something suitable opens up. Ask us and we'll delete it sooner.
  • Uploaded files: deleted with the application they belong to.
  • The hashed IP and technical fields: kept with the application record, and covered by the same deletion.
  • Email we've exchanged with you: kept as long as the conversation is relevant, then deleted.

11. Your rights

Wherever you are, you can ask us to:

  • Tell you what we hold about you, and give you a copy of it.
  • Correct anything that's wrong or out of date.
  • Delete it.
  • Stop or limit what we do with it, or object to it.
  • Hand it over in a portable format, or send it to someone else.

Ask through any of the channels at the end of this page. It's free, we don't need a reason, and we'll answer within 30 days. We may ask you to confirm who you are first, so we don't hand your data to somebody else.

If you're in the EEA or the UK and you think we've handled your data badly, you can also complain to your national data protection authority. We'd rather you told us first so we can fix it.

12. How we protect it

  • The whole site is served over HTTPS.
  • Uploaded files are stored privately: their URLs are not public, and reading one goes through an authenticated route on our side.
  • The internal careers inbox is behind a token and is blocked from search engines.
  • IP addresses are hashed with a secret salt before they are stored, so a copy of the database does not reveal them.
  • Access to the database and the file store is limited to the people who need it.

No system is perfectly secure. If a breach ever affects your data and puts you at risk, we'll tell you and the relevant authority as the law requires.

13. Children

This site isn't aimed at children, and we don't knowingly collect data from anyone under 16. If you're under 16, please don't send us an application. If you believe a child has sent us personal data, tell us and we'll delete it.

14. Changes to this policy

We update this page when what we do changes. The date at the top says when it last changed. If a change is significant and we hold your contact details, we'll tell you directly. This version took effect on 8 September 2026.

Contact us

For anything about your data — a copy, a correction, a deletion, or a question about this policy — reach us here: