Privacy Policy

Last updated: August 24, 2026

Effective date: August 24, 2026

1. Introduction

MathCracks ("we", "our" or "the application") is an adaptive math learning educational platform developed by Trawen Traiding S.L. This privacy policy describes how we collect, use, store, share and protect your personal information when you use our mobile applications (iOS and Android), the teacher web portal, the parent portal, and all related services.

MathCracks is designed for students from Preschool through 12th grade (approximate ages 4 to 17). We apply the safeguards required by child-privacy and data-protection laws that apply to our services, including COPPA, the GDPR, the CCPA/CPRA, and applicable App Store and Google Play requirements.

By using MathCracks, you accept the practices described in this policy. If you disagree with any part, do not use the application. For a family account, the parent or legal guardian must review the Terms and this policy and explicitly confirm their authorization before providing the student's information. School accounts are created under the educational institution's authorization process.

2. Data We Collect

2.1 Account Information

Email: To create the account and communicate (provided by the school, parent, or guardian)
Student name: To personalize the experience and display in the teacher dashboard
Student age: To adapt the starting point, interface, and practice
Language and time zone: To localize the experience, sessions, and communications
Password: Securely managed by Firebase Authentication (we never store plaintext passwords)

2.2 Academic Progress Data

Completed exercises and answers provided
Scores and accuracy percentage
Time spent on each exercise and session
Student's current level and chapter
Error history, corrections, and learning patterns
Optional learning supports selected by the family (reading, numbers, or attention), used only to adapt practice

2.3 Gamification Data

Virtual coins earned and virtual-coin spending within gameplay (no real-money purchase)
Unlocked badges
Consecutive practice day streaks
League positions and rankings (by level, not by age)
Selected avatar

2.4 Handwriting and Scratch-Pad Data

Handwriting strokes (stylus/finger coordinates) sent for math answer recognition
Scratch-pad drawings created inside the app and converted to an image associated with the exercise attempt so the work can be reviewed
Scans or photographs of exams and other schoolwork uploaded by teachers for grading, review, and audit; these images may contain handwriting and information visible on the page
MathCracks does not use the device camera or photo library for this flow

2.5 Technical Data

Device type
Application and operating system versions
Session and installation identifiers (not advertising identifiers)
Push notification token linked to the user account for notification delivery
Crash reports and technical diagnostic logs

2.6 Data We Do NOT Collect

We do not collect precise or coarse device location; the time zone is used only to schedule and localize service features
We do not access contacts, the photo library, or unrelated files
We do not collect advertising identifiers (IDFA/GAID)
We do not collect data from other apps on the device
The current version does not collect financial information or offer in-app purchases

3. How We Use Your Data

Essential functionality: Authentication, saving progress, generating and personalizing exercises
OLA™ adaptive algorithm: Automatically adjusting difficulty based on student performance
Gamification: Calculating coins, unlocking badges, managing leagues and rankings
Handwriting recognition: Converting handwriting to text to validate math answers
AI-assisted features: Generating reports, tutoring and support responses, learning content, and grading documents or images
Service communications: Sending periodic digests to teachers, weekly progress digests to parents, and service notifications
Technical support: Resolving issues and answering inquiries
Service improvement: Analyzing usage patterns in aggregate to improve the platform

4. Legal Basis for Processing

We process personal data under the following legal bases (GDPR Art. 6):

Consent: For minors, parental consent granted when creating the student's account
Contract performance: To provide the educational service contracted by the school or family
Legitimate interest: To improve the platform and prevent fraud or misuse
Legal obligation: To comply with applicable data protection and child privacy laws

5. Third-Party Services

We use the following service providers for platform operation. Each provider is contractually obligated to protect data and use it only for specified purposes:

Firebase (Google)

Firebase Authentication verifies users and securely manages credentials. Firebase Analytics collection is disabled in the iOS application.

Firebase Cloud Messaging

Firebase Cloud Messaging processes an installation identifier and push token. MathCracks links the token and device metadata to the account to deliver service notifications, manage token validity, understand app/version adoption, and contact users about required updates; not for advertising or cross-app tracking.

Firebase Crashlytics

Firebase Crashlytics processes crash reports and technical diagnostics, including application and operating system versions and installation or session identifiers, to diagnose failures and improve stability. This data is not used for advertising or cross-app tracking.

Mathpix

Mathpix recognizes handwritten math. For student practice we send stroke coordinates; for some STEM grading workflows we also send teacher-uploaded page images. We do not add a MathCracks account ID to the API request, but uploaded images may contain information written on the page.

OpenAI

OpenAI supports progress reports, tutoring and support conversations, content generation, and document/image grading. Depending on the feature, we may send user messages, student or school names and emails, educational records (questions, answers, scores, timing, and error patterns), and uploaded schoolwork images. We do not send passwords or authentication credentials.

Resend

Transactional email delivery through Resend and/or Brevo. They process recipient addresses and message content; non-transactional emails include an unsubscribe link.

Brevo

Transactional email delivery through Resend and/or Brevo. They process recipient addresses and message content; non-transactional emails include an unsubscribe link.

Railway

Server infrastructure where the application backend runs and data is stored securely and encrypted.

Cloudflare

Content delivery, security, and R2 object storage. Scratch-pad drawings linked to an exercise attempt can be stored in R2 until they are no longer needed or the account is deleted.

We do not use these providers for advertising or cross-app tracking. They may process only the data needed to provide their contracted service, subject to their data-protection terms.

6. Data Sharing and Disclosure

We NEVER sell, rent, or trade personal data of our users, including children.

We only share data in the following limited circumstances:

With the service providers listed in Section 5, exclusively for platform operation
With the student's school and teachers: academic progress data for educational tracking
With the student's parents/guardians: progress and performance reports
Legal obligation: if the law requires us to disclose information (court order, subpoena, or other legal requirement)
Rights protection: to protect the safety of our users or the public when reasonably necessary

7. Advertising

MathCracks does NOT contain advertising of any kind. Ever. No exceptions.

We do not display ads, use advertising SDKs, collect advertising identifiers (IDFA/GAID), or track for advertising purposes. The current version does not offer in-app purchases. The service is supported through institutional agreements and any access plans MathCracks may offer under the rules of each platform.

8. Data Retention

Consumer account data: While the account is active; directly linked active-account data is removed when deletion completes
Academic progress: While the consumer account is active, or under the educational institution's applicable retention schedule for independent school records
Gamification data: While the account is active and removed with the directly linked account records
Scratch-pad drawings: Stored with the related attempt while needed for review and removed when the account is deleted
Recognition strokes: Processed for the recognition request and not intentionally retained by MathCracks after the result is returned
Push tokens: Retained while the device is registered to an active account and removed on logout or account deletion
Security, technical and email-delivery records: Retained only as needed for security, service operation, dispute handling or legal obligations, with restricted access
AI analysis data: Reports are stored while the account is active

Account deletion removes the login credential, account record and data directly owned by that account from active account systems. Independent school records, limited security and email-delivery records, provider logs and backups may remain when required by the school, security, dispute-resolution or legal retention obligations; they are not used to recreate the deleted account. Contact [email protected] for a specific retention or erasure request.

9. Account and Data Deletion

For personal and family accounts, we provide multiple ways to delete the account and data directly owned by it. Institutional accounts are managed by the school or educational institution; contact your institution or [email protected] to request deletion:

9.1 In-App Deletion

Users of personal and family accounts can delete their account directly from the application:

Profile (or Cubi in the new experience) → Delete my account → Confirm

9.2 Email Deletion

For a personal or family account, you can also request deletion by sending an email to [email protected]. For an institutional account, contact your school or educational institution, or [email protected]. After verifying the request, we will process it in accordance with applicable law.

9.3 Data Deleted

When account deletion completes, the following directly linked data is erased from active account systems:

Personal information (name, email, credentials)
Consumer learning progress and answers directly linked to the account
Handwritten scratch-pad objects and push notification tokens
Gamification data (coins, badges, streaks, league position)
AI analysis reports
Account preferences and settings

9.4 Data Retained After Deletion

Aggregated and anonymized statistical data that cannot identify the user
Independent school records controlled by an educational institution under its applicable retention obligations
Limited security, fraud-prevention, email-delivery and dispute records, provider logs and backups for their applicable operational or legal retention period

10. Data Security

We implement technical and organizational security measures to protect our users' information:

SSL/TLS encryption in all communications between the app and our servers
Passwords are managed by Firebase Authentication; MathCracks does not store plaintext passwords in its database
JWT authentication tokens with time-based expiration
Restricted database access with rotating credentials
Servers in certified data centers with redundancy
Periodic code security reviews
Principle of least privilege for internal data access

11. International Data Transfers

Data may be processed and stored on servers located outside your country of residence. We currently use infrastructure in:

United States and other provider regions: Railway (backend), Firebase (authentication, messaging and diagnostics), OpenAI and Mathpix (AI and recognition), Resend and Brevo (emails)
Global network: Cloudflare (CDN, web protection and R2 object storage)

For transfers from the EU/EEA, we rely on Standard Contractual Clauses approved by the European Commission and on the privacy guarantees provided by each provider. All providers maintain industry security certifications.

12. Children's Privacy

MathCracks is designed for students ages 4 to 17 and applies additional safeguards to children's data.

12.1 COPPA Safeguards (U.S.)

For users under 13 years old, we apply the following safeguards:

School accounts are provisioned through the educational institution; for family accounts, the adult account holder must confirm that they are the parent or legal guardian and authorize collection before providing the child's information
We only collect the minimum information necessary to provide the educational service
Parents/guardians can review, modify, or request deletion of their children's data at any time
We do not condition the child's participation on collecting more data than necessary
We do not collect data for advertising or marketing purposes

12.2 Google Play Families Policy Compliance

As an app directed at children on Google Play, we comply with Google's Families Policy:

Contains no advertising of any kind
Does not use SDKs or APIs not approved for child-directed services
Does not collect device identifiers for advertising or commercial tracking purposes
Privacy policy is available on the Google Play listing and within the application
All content is appropriate for the target audience
Does not redirect users outside the app without adult supervision

12.3 Parents' and Guardians' Rights

Parents and legal guardians have the following rights:

Review the personal data we have collected from their child
Request correction of inaccurate data
Request deletion of their child's account and data directly owned by it, subject to applicable retention obligations
Withdraw consent and request that we stop collecting their child's data
Receive academic progress reports about their child
Contact us at [email protected] or [email protected] to exercise any of these rights

12.4 Contact for Children's Matters

If you are a parent/guardian and believe your child has provided data without your consent, or if you have any concerns about your child's privacy, contact us immediately at [email protected]. We will investigate promptly and take the action required by applicable law, including restricting or deleting data collected without proper authorization.

13. Your Rights (GDPR)

If you are in the European Union or European Economic Area, you have the following rights under the GDPR:

Access: Request a copy of the personal data we hold about you
Rectification: Correct inaccurate or incomplete personal data
Erasure: Request deletion of your personal data ("right to be forgotten")
Portability: Receive your data in a structured, machine-readable format
Objection: Object to the processing of your data in certain circumstances
Restriction: Request that we limit the processing of your data
Withdraw consent: Withdraw your consent at any time without affecting the lawfulness of prior processing

To exercise these rights, users of personal and family accounts can delete their account directly from the app (Profile or Cubi → Delete my account). For an institutional account, contact your school or educational institution. You can also contact us at [email protected]

14. U.S. State Privacy Rights (CCPA/CPRA)

If you are a resident of California or other U.S. states with privacy laws, you have additional rights:

Right to know what personal data we collect, use, share, or sell
Right to delete your personal data
Right to opt out of the sale of personal data (note: we do not sell data)
Right to non-discrimination for exercising your privacy rights
Right to correct inaccurate personal data

To exercise these rights, contact us at [email protected]. We will not discriminate against any user for exercising their privacy rights.

15. Changes to this Policy

We may update this policy periodically to reflect changes in our practices or applicable legislation. We will notify you of significant changes through a notice in the application, by email, or through updates on the Google Play / App Store listing. The "last updated" date at the beginning indicates when it was last modified. We recommend reviewing this policy periodically.

16. Contact

For questions about this policy, your personal data, or to exercise any of your rights:

Privacy email: [email protected]

Company: Trawen Traiding S.L.

Address: Calle Segovia 21, 35229 Las Palmas de Gran Canaria, España

Data Protection Officer: [email protected]