Privacy Policy

1. Data We Collect

Account Data

• Email address and full name (provided by your school or teacher during enrollment)
• Password (hashed via Bcrypt — never stored in plaintext)

Device Information

• iOS identifierForVendor or Android device ID
• Device model and name
• Client app version, locale/language, platform (iOS/Android)

Problem-Solving Data

• Session events, problem descriptions, and timestamps
• Solution images (photos of handwritten work captured via the device camera)
• Correctness scores, hints used, and session progress

Behavioral Analytics

• Custom in-app events (app lifecycle, connectivity status, error events)
• Network type, connectivity status, error codes, and retry attempts
• All analytics are sent to our own backend — not to any third-party analytics service

2. Data We Do Not Collect

• No IDFA or advertising identifiers
• No location data
• No contacts, calendar, health, or biometric data
• No third-party analytics SDKs (no Firebase Analytics, Google Analytics, etc.)
• No advertising SDKs
• No crash reporting to third parties (no Sentry, Crashlytics, etc.)

3. How We Use Your Data

• Providing app functionality: problem solving, progress tracking, and feedback
• Internal analytics on our own backend (no third-party sharing for analytics)
• Email notifications: password resets, invitations, and enrollment communications

4. AI-Assisted Grading

Student-submitted solutions, including photos of handwritten work, are processed by automated AI systems for grading and feedback. Solution images and problem descriptions are sent to OpenAI's API for processing.

• Images are not used to train AI models (per OpenAI's API data usage policy — API inputs are not used for training)
• Data is retained on our servers for academic progress tracking
• OpenAI does not retain submitted data beyond processing

5. Photo Data

Photos of handwritten work are captured via the device camera solely for AI-assisted grading.

• Images are transmitted over TLS to our backend, then forwarded to OpenAI for grading
• Images are stored on our servers for session history and academic progress review
• Images are not used for advertising, marketing, or AI model training
• Images are deleted when the student's account is deleted or upon request

6. Third-Party Services

• Mailgun — transactional email delivery (receives student email addresses)
• OpenAI — AI-powered solution checking (receives problem descriptions and solution images)

All client-server communication is encrypted in transit via gRPC over TLS.

7. Leaderboard and Visible Data

• Students' display names are visible to other students enrolled in the same course
• Performance data (XP, streak, level) is displayed on course leaderboards visible to classmates
• No personal information beyond the display name is shown to other students

8. Data Retention

• Account data is retained while the student is enrolled
• Session and problem data is retained for academic progress tracking
• Authentication tokens expire (access: 1 hour, refresh: 30 days)
• Data is deleted upon account deletion request

9. Account Deletion

Users (or parents/guardians of minors) may request account deletion by emailing hello@mathxp.app.

• Account data is removed
• Session and problem data is anonymized or purged
• Solution images are deleted
• Deletion requests are processed within 30 days

10. Your Rights

GDPR (EU Users)

You have the right to access, rectification, erasure, and portability of your personal data.

CCPA (California Users)

You have the right to know what data we collect, to request deletion, and to opt out of the sale of personal information. We do not sell personal information.

To exercise any of these rights, contact us at hello@mathxp.app.

11. Children's Privacy

MathXP is used in educational settings where students may be under 13 (US) or under 16 (EU).

• Student accounts are created by schools and teachers, not by students directly
• Schools act as the consenting party under COPPA's school consent exception
• No data is collected directly from children without school or teacher authority
• No direct marketing to students
• Parents or guardians may contact hello@mathxp.app to review, correct, or delete their child's data

12. Contact

For questions about this Privacy Policy, contact us at hello@mathxp.app.