Privacy Policy

Last updated: August 6, 2026

1) Who we are

The App is a time-driven spaced repetition system (SRS) for practicing multiplication facts. The App uses Firebase services (Authentication, Firestore, Cloud Functions, Storage, and (where available) Analytics and App Check) to provide accounts, sync progress, and enable features like session history and scene customization. On production pages, we may also use Contentsquare/Hotjar behavior analytics to understand how visitors use the App and where the experience needs improvement.

2) Information we collect

We collect information in three main ways: (a) information you provide, (b) information generated by your use of the App, and (c) technical data collected by our service providers.

A. Account and profile information

• Anonymous account identifier

  If you use the App without signing in, Firebase Authentication may create an anonymous account ID so your progress can be saved on that device/session.

• Sign-in information

  If you choose to sign in or upgrade an anonymous account, we may receive your email address and/or a provider identifier from Google, Apple, or an email-link sign-in flow (depending on what you use).

• Username and settings

  We store a display username (which may be randomly generated) and preferences like theme and session length.

B. Learning and usage data (App content)

The App is designed to adapt to performance. We store learning progress and session data, which may include:

• Practice data

  Your multiplication facts, review history, spaced-repetition scheduling fields (e.g., next due time, box/interval/ease factor), and performance stats such as correct/incorrect counts and response-time averages.

• Session summaries

  Information about sessions (e.g., start/end time, session length, and aggregate results).

• Scene builder data

  If you use the scene builder, we may store scene metadata and user-uploaded images/assets in Firebase Storage.

C. Technical and analytics data

Our hosting and backend providers (including Firebase) may collect technical information such as device/browser type, IP address, app interaction events, and crash/diagnostic signals. Where Firebase Analytics is enabled and supported by your environment, Analytics may collect usage data to help us understand performance and improve the App. On production pages where Contentsquare/Hotjar is installed, that provider may process interaction data such as pages viewed, clicks or taps, scrolling, browser/device information, and session-replay or heatmap signals. We use this for product analytics, not advertising or sale of personal information.

3) Optional Google Classroom roster import

A teacher or tutoring-center owner may choose to connect Google Classroom to import a roster. This connection is optional. Copying a Math Builders class link or using Share to Classroom does not connect an account or give Math Builders access to private Google Classroom data.

• Google data we access

  With the teacher’s permission, Math Builders uses read-only access to the teacher’s active Classroom courses and class roster membership. We process course name, section, and state; learner display name; and Google course and user identifiers needed to recognize the same course and roster member during re-import. We derive active or removed roster status locally from membership changes. We do not request student email addresses, profile photos, assignments, submissions, grades, guardian data, or permission to change Google Classroom.

• How we use and store Google data

  We use this data to let the teacher choose a course; create or update learner names and class membership; support the imported learner’s class-code and PIN practice, login cards, progress attribution and reporting; let the teacher create parent claim cards; identify roster changes; and show the import result. The raw selected course identifier is transiently returned to the signed-in teacher’s browser for the course picker and sent back for import. Raw Google user identifiers and all persisted client-readable provider identities use server-only or one-way keyed values. OAuth access and refresh tokens are encrypted and stored only on our server.

• Sharing and advertising

  We do not sell Google user data or use it for advertising, credit decisions, surveillance, or unrelated purposes. Our cloud service providers process it only on our behalf to operate and secure this teacher-requested feature. A teacher may share class links, login or parent-claim cards, and reports containing imported learner names for the educational workflows described here. Anyone with a valid teacher-shared class code can view that class’s name and active learner display-name list to choose a learner; a separate PIN is required to sign in. Math Builders does not use, transfer, or disclose raw or derived Google Workspace API data to develop, improve, or train generalized or non-personalized artificial intelligence or machine-learning models.

• Retention, disconnection, and deletion

  A pending authorization state expires after about ten minutes. One encrypted Google connection is stored per Math Builders teacher or tutor account and can be used across classes that account owns. Disconnecting applies to all owned classes, immediately stops Math Builders from using the connection, and asks Google to revoke the grant. If Google cannot confirm revocation, Math Builders keeps only the encrypted credential and server-only cleanup record needed to retry. Cleanup stops after 10 attempts or 30 days, and Math Builders then deletes the local credential even if the Google grant can still be live. The teacher can also remove Math Builders in Google Account permissions. Learner names and roster records already imported into Math Builders remain so the classes keep working. Deleting the Math Builders account removes its classrooms, imported roster records, and import history. It removes the account identifier from any pending cleanup record but can keep the encrypted credential for the same bounded revocation period.

Math Builders' use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including its Limited Use requirements.

4) How we use information

• Provide core functionality

  Authenticate users, save and sync progress, schedule reviews, and load your selected packs/scenes.

• Improve and secure the App

  Monitor performance, troubleshoot issues, prevent abuse, and maintain reliability.

• Communicate

  Respond to support requests and feedback you submit through the App.

5) How we share information

We do not sell your personal information. We share information only in the following circumstances:

• Service providers

  We use Firebase (Google) to provide authentication, databases, cloud functions, file storage, and analytics. We use Contentsquare/Hotjar for production behavior analytics, heatmaps, and session replay. These providers process data on our behalf.

• Legal and safety

  We may disclose information if we believe it is reasonably necessary to comply with law, protect users, or prevent fraud or security issues.

• Business changes

  If the App is involved in a merger, acquisition, or asset transfer, information may be transferred as part of that transaction.

6) Data retention

We keep account and progress data as long as needed to provide the App. If you delete your account or request deletion, we will take reasonable steps to delete or de-identify your personal information, subject to legal, security, and operational requirements (e.g., backups and logs may persist for a limited period).

7) Security

We use reasonable administrative, technical, and organizational measures designed to protect information. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

We use reCAPTCHA to help prevent automated bot traffic. This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

8) Children’s privacy (COPPA)

Please see our COPPA notice for additional information about children’s privacy.

9) Educational institutions (FERPA)

If your school uses the App, please see our FERPA notice for more details.

10) Your choices and requests

• Account choices

  You can use the App anonymously, or you can sign in (Google, Apple, or email link) to sync across devices.

• Account deletion

  Signed-in users can permanently delete their account from the Danger Zone on the Profile page. This cancels any active subscription and removes learner profiles, practice history, classrooms, saved scenes, and sign-in credentials.

• Access requests

  You may request access to your information. Contact us via the in-app Feedback button and include the email you use for sign-in (if applicable).

• Analytics controls

  Some analytics controls may be available through your device/browser settings (e.g., blocking cookies or scripts). You can also turn off production behavior analytics for this browser below.

11) Changes to this policy

We may update this Privacy Policy from time to time. We will change the “Last updated” date above and may provide additional notice in the App if required.

12) Contact

Questions or requests? Use the in-app Feedback button or email us at support@mathbuilders.com