Privacy policy
This policy explains how Polymorphism Ltd handles personal data in connection with this website.
Who we are
Polymorphism Ltd (“we”, “us”) is the data controller for personal data processed via this site. We are registered in England and Wales (company no. 04658986), at Electric Works, Sheffield, S1 2BJ, United Kingdom. You can contact us at enquiries@poly.io.
What we collect
The pages of this site are static and have no contact forms. We use Cloudflare Web Analytics to understand how the site is used. It is privacy-friendly and cookieless: it does not set cookies, does not track you across other websites, and does not collect or store any personal data — only aggregated, anonymous measurements such as page views, referrers and country.
Our content delivery network keeps server access logs of requests to this site — the page requested, the referring site, the country, the browser’s user-agent string and the response status. A request to the social card API made through this site’s own address, www.poly.io/api/og, includes the address of the page you asked about, so that address appears in these logs too. We do not record IP addresses in these logs. We use them to understand traffic and diagnose problems, and they are deleted automatically after 90 days.
The map on our contact page is embedded from Google Maps. Showing it connects your browser to Google, which may set cookies and receives your IP address, under Google’s own privacy policy. Apart from the analytics above and the image of a page you ask us to check (see the social card API below), it is the only thing on this site that a third party serves, and it loads only on that page.
The only personal data we receive is what you choose to send us — for example, when you email us via the links on our contact or careers pages. That typically includes your name, email address, and anything you include in your message (such as a CV).
The social card API
We run a free API at api.poly.io, used by the social card preview tool and callable directly. It reads the page you ask it about; it does not need to know anything about you, and by default we do not learn anything about you.
Two things are optional and only happen if you choose them. If you send an x-og-contact header or ?contact= value to raise your daily allowance, we store that string — usually an email address — in our request logs, so that we can reach you if your script causes a problem. It is deleted with those logs after 90 days. If we issue you an API key, we store the label and contact address you gave us alongside a one-way hash of the key, and keep them for as long as the key exists, including after it is revoked, so that we have a record of who had access. We delete them on request.
To apply a daily limit fairly we count requests per caller. We do that using a salted one-way hash of the network address the request arrived from, never the address itself. The hash is keyed with a secret we hold, so the address cannot be read from it without that secret. The counter deletes itself after two days. The same hash also appears in the API’s logs, which are kept for 90 days.
When you check a page, the API also fetches its preview image (or images) to measure it: its size, format and shape, and whether a card would cut off its edges or show through its transparency. It reads the image in memory and discards it when the check is done. We do not store, cache or republish images. The social card preview and goosey then show the image from the checked page’s own site, so your browser fetches it from there, as it would on that page, and goosey may fetch it a moment early when you point at a page in its list.
The API's own logs record which site you asked us to look at, the site the request came from, whether it worked, the site any redirect ended at, and the counts above. They also record what kind of page it was, as a label from a fixed list such as “film” or “post”, “/” for a home page, or “other”, and how many parts its path has, but not the page’s address. To tell how many different pages a caller checks, they record a salted one-way hash of each page’s address, which shows whether two requests were for the same page without storing the page. They are not used for anything except running the service and keeping it within its budget, and they are deleted automatically after 90 days.
How we use it
We use the information you send only to respond to your enquiry or application, to correspond with you about it, or — for the API — to operate your allowance and contact you if something needs attention. Our lawful basis is our legitimate interest in responding to people who contact us, and taking steps at your request prior to entering into a contract.
Sharing and retention
We do not sell your personal data or share it for marketing. Email is handled by our email provider on our behalf. We keep correspondence only as long as needed for the purpose it was sent, after which it is deleted.
Your rights
Under UK data protection law you have rights to access, correct, or delete your personal data, and to object to or restrict our processing of it. To exercise any of these, email enquiries@poly.io. You also have the right to complain to the Information Commissioner’s Office (ico.org.uk).
Changes
We may update this policy from time to time; the current version always appears on this page.