Privacy Policy

Who we are

MathXY ("we", "us", "our") provides an online math practice platform available at mathxy.org. For any privacy question, contact us at support@mathxy.org.

Information we collect

When a parent signs in

Parents sign in using a third-party provider — currently Google, with Microsoft coming soon. We do not create or store passwords. From the provider we receive only:

• Your email address — used to identify your account.
• Your display name — shown in the app. You can change it to a nickname.

Student profiles you create

• Display name — may be a first name, nickname, or initials. A real name is not required.
• Age group — an age range (e.g. "6-7"), never a birthdate.
• Student PIN — an 8-digit PIN you set, stored only as a one-way (SHA-256) hash.

Learning & progress data

• Practice sessions, scores, streaks, achievements, and topic settings.
• A short-lived, randomly generated session token and a coarse device label (e.g. "Windows PC (Chrome)") so parents can see where an active session is running. This is not a hardware identifier and expires after inactivity.

Guest mode

No account If you use "Try Without Signup", practice data stays on your device (in your browser's local storage) and is not uploaded to our servers.

Usage analytics

We use Google Analytics to understand anonymous, aggregated usage (such as which screens are viewed) so we can improve the app. This data is not used to identify individual children and is not sold.

What we do NOT collect

• No required real names
• No birthdates or exact ages
• No location data
• No photos, media, or contact lists
• No payment information — MathXY is 100% free
• No advertising or cross-site tracking identifiers

How we use information

• To create and secure your account and student profiles.
• To save and display learning progress across your devices.
• To operate features such as leaderboards and session safety.
• To understand aggregate usage and improve the app.

We do not sell your personal information.

Service providers

We rely on a small number of trusted providers to run MathXY:

• Supabase — authentication and database hosting.
• Google (and Microsoft, coming soon) — sign-in (OAuth) providers.
• Google Analytics — anonymous usage analytics.
• GitHub Pages — static website hosting.

Each provider processes data only as needed to deliver its part of the service.

How we protect your data

• Encrypted in transit (HTTPS) and at rest.
• No passwords are stored — sign-in is delegated to your provider.
• Student PINs are stored only as one-way hashes.
• Row-level security ensures you can only access your own family's data.
• An optional parental PIN adds another layer of protection.

Children's privacy (COPPA)

MathXY is designed for children but intended to be set up and managed by a parent or guardian. Accounts are created by adults, and student profiles use minimal, non-identifying information by design. We do not knowingly collect more personal information from a child than is necessary to provide the service. If you believe a child has provided us information without parental consent, contact support@mathxy.org and we will delete it.

Data retention & your rights

• You can view your data at any time within the app.
• You can delete a student profile, or your entire account, at any time.
• You may request access to or deletion of your data by emailing support@mathxy.org.

We retain account and progress data until you delete it. Guest data lives only on your device until you clear it.

Changes to this policy

We may update this policy from time to time. Material changes will be reflected by the "Last updated" date above, and significant changes may be announced in the app.

Contact us

Questions about your privacy? Email support@mathxy.org. We aim to respond within 24-48 hours.