Privacy policy

Effective October 22, 2026

Who we are

MathBound (mathbound.org and play.mathbound.org) is operated by:

Write to us at that address or email with any question about privacy, or to use any of the rights below.

What we collect

When someone makes an account

• Email address, a display name they choose (checked by a filter for unkind words), and a password, which we store only in scrambled form that cannot be read back.
• Birth month and year (never the full date), to know whether a parent's approval is needed.
• For a child under 13: a parent or guardian's email address, used only to ask for approval and to send the parent links to manage the account.
• If they sign in with Google or Microsoft: we receive their name, their email address and whether that email is confirmed, and an identifier for the account. We do not receive their password or anything else in their Google or Microsoft account.
• For teachers and school administrators: their name, email and school.

Accounts a teacher makes

A teacher can make accounts for a class, or students can join a class with its code. These accounts use a username and the first name and last initial the student or teacher gives, and no email address.

While playing

• Game progress: the explorer, level, skills, stars and settings.
• Answers: for each question, which skill and level it was, whether the answer was right, and how long it took. This is what teachers see in their reports and what we use to make the questions better.
• Friends and challenges, for players allowed to use them: the friends they accept, the challenges they send and play, and the results. There is no messaging between players.
• What players choose to send us: a "Report a problem" note (what was on the screen, and any short comment they type) or a request for a textbook. We ask them not to include names or personal details.

Automatically

• Cookies that keep someone signed in, and one that remembers a browser a staff account has used before. We use no advertising or analytics cookies.
• The game also saves progress in the browser itself, so it can be played without an account.
• Internet (IP) address and browser type, used to keep accounts safe (for example, to slow down someone guessing passwords) and kept only briefly; and short records our hosting provider keeps to run and secure the service.

How we use it

• To run the game and the teacher portal: sign-in, saving progress, classes, assignments and reports.
• To send the emails the service needs: confirming an email address, resetting a password, asking a parent's approval, inviting teachers, telling a student their teacher has added them to a class, and telling staff about a sign-in from a new browser. We do not send marketing email to students.
• To improve the questions and fix problems, using answers and reports.
• To keep the service safe and secure.
• To bill schools that have a contract with us, by the number of students in their classes during the contract's term, and to send the school's administrators and business office notes about it, and invoices from our accounting service, Wave. These give counts, never students' names.

We do not use anyone's information for advertising, we do not build profiles of students for any purpose other than the learning in the game, and we do not sell, rent or trade it.

Who can see it

• Teachers see the progress and answers of the students in their own classes. School administrators can see their school's classes and, for a school with a contract, the list of its students counted for billing. When a student joins a class, the teacher sees their display name.
• Friends a player has accepted see their display name, their email address (which they used to connect), and their challenge results.
• Service providers that run MathBound for us, only to do so: Cloudflare (hosting and data storage), Resend (sending email), Wave (invoicing schools and taking their payments: it gets only a school's billing contacts and the amounts, never student information), and Google or Microsoft when someone chooses to sign in with them. They may not use the information for anything else.
• We may disclose information if the law requires it, or to protect the safety of players or others.

Children under 13

MathBound is made for students, including children under 13, and follows the Children's Online Privacy Protection Act (COPPA).

• When a child under 13 makes their own account, they give a parent's email address. We email the parent, explaining what we collect, and ask for approval. Until the parent approves, we keep only what we need to ask: the child's email, display name, scrambled password, birth month and year, and the parent's email. The child can play, but their progress stays only on their own device. If no one approves within 30 days, the account and the parent's email are deleted.
• Once a parent approves, we also keep the child's progress and answers. Friends and challenges are available to a child under 13 only after a parent approves.
• Schools: when a school uses MathBound for its students, the school (for example, a teacher making accounts or giving out a class code) may give consent on parents' behalf for use in school, as COPPA allows. We use that information only for the school's educational purposes.
• Parents can see what we hold about their child, have it deleted, and refuse further collection, at any time: use the links in our email, or write to us at the address above. Deleting the account deletes its progress and answers; we may keep anonymous totals that identify no one.

Students and schools

When a school or teacher uses MathBound, the information about their students belongs to the school, and we act on the school's behalf (as a "school official" under FERPA). We use it only to provide MathBound to the school, never for advertising, and we delete it when the school asks. Schools that need a signed data privacy agreement can write to us.

For a school with a contract, we keep a record that a student was in one of the school's classes during the contract's term (from when, and in which class), because the school pays for each student enrolled during the term. Only the school's administrators and we can see who is on it.

How long we keep it

• Accounts and their progress are kept until the account is deleted: by the player (in the game's settings), by a parent, by the teacher who made it, or on a school's request.
• Unapproved accounts of children under 13 are deleted after 30 days.
• Sign-in sessions end on their own; password and email links expire within hours or days; records of failed sign-ins are cleared within a day.
• When an account is deleted, problem reports it sent keep only what was on the screen, without the account or any comment.
• For a school with a contract, the record that a student was in its classes during a term is kept for billing as long as the school uses MathBound, or until the school asks us to delete its data. When the student's account is deleted, the record no longer says who they were: only an anonymous count remains.
• Our database keeps automatic backups for up to 30 days, so deleted information is fully gone from them within 30 days of being deleted. Backups are used only to recover from a fault, never to bring back deleted accounts.

Keeping it safe

Everything travels over encrypted connections (HTTPS). Passwords are stored only in scrambled form. Links in our emails work once and expire. Staff can add a second sign-in step with an authenticator app. No system is perfectly secure, but we take care to protect what we hold, and we will tell those affected if a breach puts their information at risk, as the law requires.

Your choices and rights

Anyone with an account can see and change their information in the game, and delete their account and everything in it. Depending on where you live, you may have further rights to access, correct or delete your information; write to us and we will help, after checking it is you (or your child's account).

Changes

If we change this policy, we will post the new version here with its date. If a change affects children's information, we will ask parents again before using it in a new way.

Contact

To report a security problem: security@mathbound.org.