MathBound for school IT

Ways in that need no IT setup

• Class code: the teacher makes a class in the portal and shares its six-letter code. Students type the code, a first name and last initial, and a password; MathBound gives them a username. No email is asked for.
• Teacher-made accounts: the teacher types a list of first names and last initials and prints the usernames and passwords.
• Email accounts: a student signs up with an email and a password, then joins the class with its code or accepts the teacher's invitation. Under-13s give a parent's email for approval.

Sign in with Google (Workspace for Education)

Google blocks third-party apps it has not been told about for users your domain marks as under 18. Teachers are usually allowed already. To allow students:

1. Admin console → Security → Access and data control → API controls.
2. Manage Third-Party App Access → Configure new app.
3. Search for MathBound's client ID:
   459584642748-dl2gseae5v67ab9r9pc012t3of2sj83a.apps.googleusercontent.com
4. Choose the organizational units (your students, or the whole domain).
5. Access: Limited is enough (MathBound asks only for the basic sign-in scopes, which are not restricted Google services); Trusted also works. Click Configure.

Sign in with Microsoft (Entra ID)

If students see "Need admin approval", an administrator who can grant consent (Global, Cloud Application or Application Administrator) does one of these once:

• Open this link, sign in and accept for the organization:
  https://login.microsoftonline.com/organizations/adminconsent?client_id=428b92e7-d848-47f9-846a-2a9616d9b1a8
  (You return to MathBound's sign-in page afterwards; any "sign-in didn't finish" note there is expected.)
• Or sign in to MathBound with your admin account and tick Consent on behalf of your organization.

Application (client) ID: 428b92e7-d848-47f9-846a-2a9616d9b1a8

What either provider shares

Scopes openid email profile only: the person's name, email address (used only when the provider confirms it) and an account identifier. No password, contacts, files, calendar or classroom data, and no access once sign-in is done.

Web filters and email

• Allow mathbound.org and play.mathbound.org (www.mathbound.org only redirects). Everything the game and portal use is served from these: fonts, maths typesetting, pictures and sounds are bundled. They load nothing from third-party domains.
• Only if you use single sign-on: accounts.google.com or login.microsoftonline.com, which most schools allow already.
• Account emails (confirm an address, reset a password, a parent's approval, a teacher adding a student to a class, staff notices) come from hello@mathbound.org; let it through spam filters.
• HTTPS only (HSTS), no browser extensions, no pop-ups, no downloads.

Student data

• Collected: a display name (class accounts: first name and last initial) and a username or email; a password, stored only as a salted hash; birth month and year for email accounts (never the full date); a parent's email for under-13s; game progress; and for each question, the skill, whether it was right and how long it took. Optional: friends and head-to-head challenges (13 and over, or under 13 with a parent's approval; never class-made accounts, and teachers can switch challenges off), and problem reports a student chooses to send.
• Not collected: address, phone, photos, voice, location, grades, demographics, student or state ID numbers, or special-education data.
• Who sees it: teachers see their own classes; school administrators see their school's. Nothing is sold, rented or used for advertising.
• Hosting: Cloudflare (Workers and D1 database), stored in the United States. Email is sent through Resend. Passwords and sign-in links are hashed; staff can turn on an authenticator app.
• Deletion: teachers delete the accounts they made, students and parents delete their own, and we delete a school's data on request. Unapproved under-13 accounts are deleted after 30 days.

COPPA, FERPA and agreements

• COPPA: under-13s need a parent's approval before progress is kept, or the school's consent for school use (a class code or teacher-made account), which we use only for the school's educational purposes.
• FERPA: we act as a school official under the school's direct control. Student data stays the school's.
• Data privacy agreement: we sign the Student Data Privacy Consortium's National Data Privacy Agreement (NDPA v2.2, Standard) with your state's supplement, with no changes. Status: ready to sign; no signed agreement on the SDPC Resource Registry yet. Write to us and we will complete our parts.
• Privacy policy: mathbound.org/privacy

Contact