Privacy Policy

1. Who we are

2. What this policy covers

This policy explains how we collect, use, store and share personal data when you use www.maths.monster, including data that relates to children who complete homework and assessments through the service. Subscribers (account holders) are adults, but the homework images, self-assessment ratings and AI-generated feedback may belong to children — potentially under 13.

3. Data we collect

3.1 Account data (adult subscriber)

• Email address
• Name (optional)
• Password (hashed — we never store plaintext passwords)
• Subscription tier and payment status (via Stripe — we do not store card numbers)
• Reviewer/tutor email and name (if you choose to add one)
• Plan limit records — a short record of each time we tell you your plan has no room to start another topic right now (which limit applied, your plan, and when), so we can check whether our plan limits are set fairly
• Notification settings for your own devices, if you turn notifications on (the same details as for a child's device, stored against your email address)

3.2 Child homework data

• Uploaded homework images — photos of handwritten work (max 3 files, max 5 MB each)
• Self-assessment ratings — per-question confidence ratings (1–4 scale) used for spaced-practice scheduling
• AI marking feedback — automated feedback on mathematical communication, generated by our AI marking system
• Practice delivery records — a short record of each practice email or notification we send (which unit and variation, and whether it was delivered), so we can tell when practice has failed to reach you
• Notification settings — if notifications are turned on on your child's device, the address that device's browser gives us for sending notifications and two security keys that go with it, stored against your child's profile ID (not their name). We also keep whether the last notification to that device arrived, so we can show you whether notifications are working.

3.3 Technical data

• IP address, browser type, device type (standard server logs)
• Pages visited and timestamps

3.4 Support correspondence (anyone who emails us)

• Support correspondence — the sender's email address, what they write or attach, and our replies, when anyone emails support@, hello@ or privacy@maths.monster or replies to an email from us. Please do not put a child's name or a photo of their work in an email: use the app to submit work, and a nickname if you need to mention a child

4. How we use your data

Where the basis is legitimate interests, the interest is ours and yours together: delivering the learning service you asked us to provide for your child, with their work marked and their next practice scheduled. We rely on it rather than on the contract because the contract is with you, not with your child. We have assessed and recorded that this does not override your child's interests or rights, and you can object at any time (section 9).

We do not sell or rent your child's homework, self-assessments or progress data, and we never hand any of it to advertisers or ad networks. We do assess your child's work automatically as part of marking — see section 5 — and we keep a record of how they are getting on, because that is what schedules their next practice and what you see on their Progress page. Apart from the providers in section 7 who host and deliver the service for us, it leaves Maths Monster only where you have asked it to: to a teacher or tuition centre you have connected (section 14), or to someone you have nominated to review your child's work. We may also use it to write to you, the account holder, about your own subscription — for example to tell you a trial is ending, or that a unit is finished and what the plans are. Those emails go to you, never to your child. You can ask us to delete it at any time — see section 9.

5. Children's data — special protections

We recognise that homework data belongs to children in school Years 3 to 13, about 7 to 18 years old, many of them under 13. We apply the following safeguards in line with the UK Age Appropriate Design Code (Children's Code), UK GDPR, and COPPA (for any US-based users):

• Parental account model: Only adults create accounts and manage subscriptions. Children do not create their own accounts.
• Children's names: We never ask for or store your child's name — accounts use your email and a nickname you choose. A photo of handwritten work may incidentally show a name if it is written on the page; we never read, extract, or use it, and the photo itself is protected by the retention and access rules on this page. If you prefer, fold the name out of view before photographing.
• Data minimisation: We collect only what is needed for the learning service — homework images, self-assessment scores, and generated feedback.
• Checking a photo and keeping a photo are two different things: AI marking is not sent to you until a person has checked it. To make that check against your child's actual page, our own staff may briefly open the photo of the work — whatever your "Keep work photos" setting says. Viewing a photo to check the marking is not the same as keeping a photo for your child's Progress history. Checking keeps nothing: with "Keep work photos" off, the photo is still deleted on the schedule in section 6, it is never added to Progress, and no copy is made. It is opened through a link that expires in two minutes, and we record every time a member of staff opens one — who asked for it, which photo, and when — so we can answer that question if you ask it. If you have nominated someone else to review your child's work, they see photos only when "Keep work photos" is on.
• Automatic deletion: Unless you have turned on "Keep work photos" for a child, uploaded homework images are automatically deleted within 7 days of marking — usually within 24 hours. With "Keep work photos" on, images are archived so you can review them in Progress, and are kept for up to 24 months, or until you delete the child profile or your account, or ask us to erase them — whichever comes first.
• Turning automatic marking off: You can turn automatic marking off for any child, at any time, from your account. When it is off we do not check that child's uploaded work and we send you nothing about it, and the rest of Maths Monster carries on unchanged. Turning it off applies to work uploaded from that point on: it does not recall emails we have already sent you, and it does not delete work already marked (you can delete that separately).
• No tracking beyond education: Your child's own confidence ratings are what schedule their practice, and we may also show them to you beside our own marking of the same work, so you can see where the two agree. Marking results are used to produce the feedback we send you about their work. We do not build behavioural profiles, and we do not track your child across other sites or apps.
• Privacy by default: The highest privacy settings apply automatically. Your child's homework, self-assessments and progress go only to the providers listed in section 7, who run the service for us, and to a teacher or tuition centre you have connected (section 14) or someone you have nominated to review your child's work. There is no third-party analytics tracking and there are no social features. Lesson pages do embed curated YouTube videos, which do send Google some technical data (IP address, browser data) — see section 7 for exactly what, and how it is minimised.

6. Data retention

7. Third parties who process your data

We share personal data with these processors, who need it to deliver the service:

Each notification is delivered through the push service built into the device's browser (for example Google, Apple or Mozilla). That service receives the encrypted notification only; it cannot read it.

We do not sell or rent personal data to anyone. Apart from these processors, it leaves Maths Monster only where you have asked it to: to a teacher or tuition centre you have connected (section 14), or to someone you have nominated to review your child's work.

8. International transfers

Some processors (Anthropic, Stripe, Resend, Google) are based in the United States. These transfers are protected by the UK-US Data Bridge (UK Extension to the EU-US Data Privacy Framework) where applicable, or by Standard Contractual Clauses (SCCs). Google Workspace may process support correspondence, including attachments and email details, in the United States; we are still verifying the UK transfer mechanism that applies to that Workspace processing. Homework images sent to the Anthropic API for marking are never used to train Anthropic's models. Under Anthropic's commercial API terms, the images and the marking they produce are deleted within 30 days by default, and kept for up to 2 years only if a submission is flagged for a usage-policy violation. Our own copy of the image is deleted on the schedule in section 6.

Notification settings are stored on Cloudflare's global network, which may include the United States; these transfers are covered by Cloudflare's Standard Contractual Clauses.

9. Your rights

Under UK GDPR, you (and, where applicable, the parent/guardian on behalf of a child) have the right to:

• Access — request a copy of personal data we hold about you or your child
• Rectification — ask us to correct inaccurate data
• Erasure ("right to be forgotten") — ask us to delete all personal data, including child homework data, self-assessments and AI feedback
• Restriction — ask us to limit processing
• Portability — receive your data in a machine-readable format
• Object — object to any processing we do on the basis of legitimate interests, which includes marking your child's homework and scheduling their spaced practice (section 4). Email privacy@maths.monster with "objection" in the subject. MATHS MONSTER LTD, the data controller, reads every objection and replies within 30 days. We stop that processing for your child unless we can show compelling legitimate grounds that override your objection, and we tell you which it is. Stopping it means the marking and the practice sequence stop; your account and everything already stored stay as they are until you ask for erasure.
• Withdraw consent — where consent is the lawful basis

To exercise any right, email privacy@maths.monster. We will respond within 30 days. When you ask for erasure, we delete your data, including your child's homework data, self-assessments and AI feedback, from our database and image storage. We keep only these, each listed in section 6: payment, credit and purchase records and their audit trail, which the law requires; evidence of consent to a published testimonial; records shared with another family that name you; a note of your address if you asked us to stop emailing it or were removed from the test, so that request keeps working; and automation run logs until they expire. We cannot recall emails we already sent: they stay in the recipient's inbox and in our email provider's own delivery log. Section 6 gives the retention period for each of these where one applies.

10. Cookies

We use only essential cookies required to keep you logged in, to protect against cross-site request forgery, and, once you have started a checkout, to stop the same browser paying for a second subscription by mistake. We do not use analytics cookies, advertising cookies, or any third-party tracking cookies. Lesson pages that include a YouTube video connect to Google as the page loads (see section 7); if you or your child then plays the video, Google's embedded player may also set its own cookies — Maths Monster does not control what Google sets. See our Cookie Policy for details.

11. Security

We protect your data with:

• HTTPS encryption on all connections
• Hashed passwords (never stored in plaintext)
• Server-side authentication on all API endpoints
• Cloudflare Turnstile CAPTCHA on login and registration
• No public API access to subscriber or child data
• EU-based hosting (Railway Amsterdam region)
• Presigned URLs for image access (time-limited, not publicly accessible)
• An audit record of every staff request to open a child's homework photo — who, which photo, when

12. Data breaches

In the event of a personal data breach that poses a risk to your rights, we will notify the Information Commissioner's Office (ICO) within 72 hours and affected individuals without undue delay. See our internal Data Breach Notification Procedure for full details.

13. Complaints

If you are unhappy with how we handle your data, you have the right to complain to the Information Commissioner's Office (ICO):

• Website: ico.org.uk/make-a-complaint
• Helpline: 0303 123 1113

14. Sharing progress with a teacher or tuition centre

If your child has a tutor or attends a tuition centre that uses Maths Monster, you can choose to share your child's progress summary with them. This never happens automatically — here is exactly how it works and what they see.

Sharing only happens if you accept an invite. The teacher sends an invite addressed to your email. You accept it while signed in to your own account, choose which child it applies to, and confirm. Nobody else can accept an invite meant for you, and your child cannot grant access themselves.

What the teacher sees: a short label the teacher chose (like "JS" — we require initials or a nickname, never your child's full name), which topics your child has practised, how many practice rounds they've completed, when they last practised, and your child's own 1–4 confidence ratings shown as colours. These are your child's self-ratings, not marks or grades.

What the teacher never sees: your child's name or nickname, your name or email, photos of homework, the written feedback we send you, or anything about your account or subscription.

You can stop sharing at any time. Your account lists every teacher who can see each child's progress, with a remove button. Removal takes effect immediately — the teacher loses all access to that child from that moment. We keep a record that access existed (not the progress data itself) for 12 months so we can answer questions about who had access, then delete it. If you delete your child's profile, sharing records are deleted immediately.

Questions or concerns: contact us at privacy@maths.monster and we'll help — including deleting anything you'd like removed.

15. Changes to this policy

We may update this policy from time to time. Material changes will be communicated by email to registered subscribers. The "Last updated" date at the top of this page shows when it was last revised.