Privacy Policy

Last updated: July 21, 2026

The short version for parents: you create the account with your email and your consent. From your student we collect only a first name, their learning progress, and their tutor conversations (stored without their identity attached). We show no ads inside the learning environment, we never sell data, and you can see or delete everything by emailing us.

1. Who we are

themath.com is operated by [COMPANY NAME], [ADDRESS] ("we", "us"). This policy explains what we collect, why, and the choices you have. Because our service is designed for students — including children under 13 — this policy is written to comply with the U.S. Children's Online Privacy Protection Act (COPPA) and similar laws.

2. Parental consent (how accounts work)

Accounts are created by a parent or legal guardian, using the parent's email address. During signup the parent gives explicit consent (we record the date, time, and IP address of that consent) and must then click a verification link sent to their email before the student can use the learning environment. A parent may withdraw consent at any time by emailing us — we will then delete the account and the student's information.

3. What we collect

From the parent: name, email address, password (stored hashed), consent record, and — for paid plans — subscription status. Payment card and PayPal details are handled entirely by Stripe or PayPal; we never see or store card numbers.

From the student: a first name (or nickname — a nickname is fine!), a chosen avatar, learning progress (skills, mastery levels, lessons completed), and messages sent to the AI tutor. Tutor conversations are stored under an anonymized identifier, not the student's name. We intentionally collect no birthdate, address, school, photos, or contact information from students, and the tutor instructs students not to share personal details.

Automatically: IP address and browser type at login/registration (for account security and abuse prevention), and session cookies needed to keep you signed in.

4. How we use information

To run the service: authenticate accounts, save progress, power the Mastery Matrix, and let the AI tutor respond in context. To keep the service safe: security logs, abuse and bot prevention (reCAPTCHA). To bill paid plans. To review anonymized tutor conversations for teaching quality and safety. To email parents about their account (verification, receipts, and — if enabled — progress reports). We do not sell personal information, we do not use student data for advertising, and we show no third-party ads inside the logged-in learning environment.

5. Third-party services we rely on

We share only what each provider needs to do its job:

  • Google Gemini API — processes tutor messages to generate responses. Messages are sent without the student's name or account identity.
  • Stripe / PayPal — payment processing for the parent's subscription.
  • Google reCAPTCHA — bot protection on parent-facing forms (signup, password reset).
  • Our hosting provider — stores the service's database and files.
  • Google AdSense — appears only on public marketing pages for visitors who are not signed in; never inside the learning environment.

These providers are contractually bound to use the data only to provide their service to us.

6. Parents' rights (COPPA)

As the parent, you may at any time: review the information we hold about your student, request deletion of it, withdraw consent (which ends the student's use of the service), or refuse further collection. Email support@themath.com from the account's parent email and we will respond within 30 days. We will never require a child to disclose more information than is reasonably necessary to participate in an activity.

7. Data retention & security

We keep account data while the account is active. If you delete the account (or withdraw consent), personal data is deleted within 30 days; anonymized tutor transcripts (which contain no identity) may be retained for quality review. Passwords are hashed, connections use HTTPS, and access to personal data is limited to administrators who need it. No system is perfectly secure — if a breach affects your data we will notify you promptly.

8. Cookies

We use essential cookies only in the learning environment: a session cookie (keeps you signed in) and a CSRF token (security). Public marketing pages may set cookies from Google AdSense/reCAPTCHA as described by Google's own policies.

9. Changes & contact

If we materially change how we handle children's data, we will notify parents by email and obtain new consent where required. Questions or requests: support@themath.com, or write to [COMPANY NAME], [ADDRESS].