Privacy Policy

Mathletic ("we", "us") is an education practice platform. This Privacy Policy explains what personal information we collect, why we collect it, and the choices you have. If you are in Australia, we aim to comply with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). If you are under 18, please read this with a parent or guardian.

This page is about data and privacy. Rules for using the product (acceptable use, eligibility, disclaimers) are in the Terms of Service.

Mathletic is operated for Asia Maths Alliance education projects. Contact for privacy requests: asiamaths@gmail.com.

• Account (Google sign-in) — email address, name, and profile photo provided by Google via Supabase Auth. We do not store your Google password.
• Profile — username, display name, country, optional school and grade, language, bio, topic preferences, notification and privacy settings, theme preferences.
• Learning activity — which questions you attempt or solve, attempt counts, timestamps, sprint session scores/answers, and achievements.
• Onboarding attestations — that you are 13+ (or have parental permission) and that you accepted these Terms/Privacy.
• Device / local data — solved progress and draft answers may be stored in your browser (localStorage) until synced to your account.
• AI answer checking — if you use AI check features, the question text and your submitted answer (and any uploaded image of work) are sent to our AI processing pipeline to generate feedback. We do not intend to use this content to train public models.
• Hosting logs — our host (e.g. Vercel) and database provider (Supabase) may process IP addresses and request metadata for security and reliability.

• Create and secure your account
• Personalise practice, progress, streaks, and leaderboards
• Provide sprint modes and achievements
• Show public profile fields you choose to share
• Improve reliability and prevent abuse

• Supabase (auth + Postgres) — account, profile metadata, practice and sprint data
• Vercel — application hosting
• Google — identity provider for sign-in
• AI inference — answer-checking may call a configured LLM provider (see your deployment env). Student answers may be processed to return feedback.
• Fonts — Google Fonts loaded by Next.js font optimization

We do not currently use advertising cookies or third-party analytics SDKs (such as Google Analytics or PostHog) in the application code. If that changes, we will update this policy and add consent where required.

Mathletic is intended for students aged 13 and older. Users under 13 should not create an account. During onboarding we ask you to confirm you are 13+ or have parental/guardian permission. We collect optional school and grade information to personalise learning — treat school names as potentially identifying for minors and keep your profile private if you prefer.

COPPA (US): We do not knowingly collect personal information from children under 13. If you believe a child under 13 has registered, contact us to delete the account.

Australia: We take reasonable steps to protect personal information of young people and recommend parental guidance for school-aged users.

If your profile visibility is public, other users may see your username, avatar, selected country/school (if enabled), activity heatmap, achievements, and leaderboard ranks. You can change these in Settings → Privacy.

We keep account and learning data while your account is active. You may delete your account in Settings → Danger Zone, which removes your Auth user and cascaded practice/sprint rows. Backups held by infrastructure providers may persist for a limited period according to their retention schedules.

Subject to applicable law, you may request to:

• Access the personal information we hold about you
• Correct inaccurate information (also via Settings)
• Delete your account and associated data
• Withdraw marketing notification preferences

Use Settings → Danger Zone for self-serve deletion, or email asiamaths@gmail.com.

We use Supabase Auth (Google OAuth), HTTPS, row-level security on database tables, and server-only access for answer keys where configured. No method of transmission or storage is perfectly secure.

We may update this policy. Material changes will be reflected by updating the "Last updated" date. Continued use after changes means you accept the updated policy.