Privacy Policy

1. Who we are

2. What this policy covers

This policy explains how we collect, use, store and share personal data when you use www.maths.monster, including data that relates to children who complete homework and assessments through the service. Subscribers (account holders) are adults, but the homework images, self-assessment ratings and AI-generated feedback may belong to children — potentially under 13.

3. Data we collect

3.1 Account data (adult subscriber)

• Email address
• Name (optional)
• Password (hashed — we never store plaintext passwords)
• Subscription tier and payment status (via Stripe — we do not store card numbers)
• Reviewer/tutor email and name (if you choose to add one)
• Plan limit records — a short record of each time we tell you your plan has no room to start another topic right now (which limit applied, your plan, and when), so we can check whether our plan limits are set fairly

3.2 Child homework data

• Uploaded homework images — photos of handwritten work (max 3 files, max 5 MB each)
• Self-assessment ratings — per-question confidence ratings (1–4 scale) used for spaced-practice scheduling
• AI marking feedback — automated feedback on mathematical communication, generated by our AI marking system
• Practice delivery records — a short record of each practice email or notification we send (which unit and variation, and whether it was delivered), so we can tell when practice has failed to reach you

3.3 Technical data

• IP address, browser type, device type (standard server logs)
• Pages visited and timestamps

3.4 Support correspondence (anyone who emails us)

• Support correspondence — the sender's email address, what they write or attach, and our replies, when anyone emails support@, hello@ or privacy@maths.monster or replies to an email from us. Please do not put a child's name or a photo of their work in an email: use the app to submit work, and a nickname if you need to mention a child

4. How we use your data

Where the basis is legitimate interests, the interest is ours and yours together: delivering the learning service you asked us to provide for your child, with their work marked and their next practice scheduled. We rely on it rather than on the contract because the contract is with you, not with your child. We have assessed and recorded that this does not override your child's interests or rights, and you can object at any time (section 9).

We do not sell or rent your child's homework, self-assessments or progress data, and we never hand any of it to advertisers or ad networks. We do assess your child's work automatically as part of marking — see section 5 — and we keep a record of how they are getting on, because that is what schedules their next practice and what you see on their Progress page. Apart from the providers in section 7 who host and deliver the service for us, it leaves Maths Monster only where you have asked it to: to a teacher or tuition centre you have connected (section 14), or to someone you have nominated to review your child's work. We may also use it to write to you, the account holder, about your own subscription — for example to tell you a trial is ending, or that a unit is finished and what the plans are. Those emails go to you, never to your child. You can ask us to delete it at any time — see section 9.

5. Children's data — special protections

We recognise that homework data belongs to children who may be under 18, and potentially under 13. We apply the following safeguards in line with the UK Age Appropriate Design Code (Children's Code), UK GDPR, and COPPA (for any US-based users):

• Parental account model: Only adults create accounts and manage subscriptions. Children do not create their own accounts.
• Children's names: We never ask for or store your child's name — accounts use your email and a nickname you choose. A photo of handwritten work may incidentally show a name if it is written on the page; we never read, extract, or use it, and the photo itself is protected by the retention and access rules on this page. If you prefer, fold the name out of view before photographing.
• Data minimisation: We collect only what is needed for the learning service — homework images, self-assessment scores, and generated feedback.
• Checking a photo and keeping a photo are two different things: AI marking is not sent to you until a person has checked it. To make that check against your child's actual page, our own staff may briefly open the photo of the work — whatever your "Keep work photos" setting says. Viewing a photo to check the marking is not the same as keeping a photo for your child's Progress history. Checking keeps nothing: with "Keep work photos" off, the photo is still deleted on the schedule in section 6, it is never added to Progress, and no copy is made. It is opened through a link that expires in two minutes, and we record every time a member of staff opens one — who asked for it, which photo, and when — so we can answer that question if you ask it. If you have nominated someone else to review your child's work, they see photos only when "Keep work photos" is on.
• Automatic deletion: Unless you have turned on "Keep work photos" for a child, uploaded homework images are automatically deleted within 7 days of marking — usually within 24 hours. With "Keep work photos" on, images are archived so you can review them in Progress, and are kept for up to 24 months, or until you delete the child profile or your account, or ask us to erase them — whichever comes first.
• Turning automatic marking off: You can turn automatic marking off for any child, at any time, from your account. When it is off we do not check that child's uploaded work and we send you nothing about it, and the rest of Maths Monster carries on unchanged. Turning it off applies to work uploaded from that point on: it does not recall emails we have already sent you, and it does not delete work already marked (you can delete that separately).
• No tracking beyond education: Your child's own confidence ratings are what schedule their practice, and we may also show them to you beside our own marking of the same work, so you can see where the two agree. Marking results are used to produce the feedback we send you about their work. We do not build behavioural profiles, and we do not track your child across other sites or apps.
• Privacy by default: The highest privacy settings apply automatically. No sharing of homework, self-assessment or progress data; no third-party analytics tracking; no social features. Lesson pages do embed curated YouTube videos, which do send Google some technical data (IP address, browser data) — see section 7 for exactly what, and how it is minimised.

6. Data retention

7. Third parties who process your data

We share personal data only with processors who need it to deliver the service:

We do not sell, rent or share personal data with any other third parties.

8. International transfers

Some processors (Anthropic, Stripe, Resend, Google) are based in the United States. These transfers are protected by the UK-US Data Bridge (UK Extension to the EU-US Data Privacy Framework) where applicable, or by Standard Contractual Clauses (SCCs). Google Workspace may process support correspondence, including attachments and email details, in the United States; we are still verifying the UK transfer mechanism that applies to that Workspace processing. Homework images sent to the Anthropic API for marking are never used to train Anthropic's models. Under Anthropic's commercial API terms, the images and the marking they produce are deleted within 30 days by default, and kept for up to 2 years only if a submission is flagged for a usage-policy violation. Our own copy of the image is deleted on the schedule in section 6.

9. Your rights

Under UK GDPR, you (and, where applicable, the parent/guardian on behalf of a child) have the right to:

• Access — request a copy of personal data we hold about you or your child
• Rectification — ask us to correct inaccurate data
• Erasure ("right to be forgotten") — ask us to delete all personal data, including child homework data, self-assessments and AI feedback
• Restriction — ask us to limit processing
• Portability — receive your data in a machine-readable format
• Object — object to any processing we do on the basis of legitimate interests, which includes marking your child's homework and scheduling their spaced practice (section 4). Email privacy@maths.monster with "objection" in the subject. MATHS MONSTER LTD, the data controller, reads every objection and replies within 30 days. We stop that processing for your child unless we can show compelling legitimate grounds that override your objection, and we tell you which it is. Stopping it means the marking and the practice sequence stop; your account and everything already stored stay as they are until you ask for erasure.
• Withdraw consent — where consent is the lawful basis

To exercise any right, email privacy@maths.monster. We will respond within 30 days. For erasure requests, we will delete data from all systems including our database, email service, image storage and automation logs.

10. Cookies

We use only essential cookies required to keep you logged in and to protect against cross-site request forgery. We do not use analytics cookies, advertising cookies, or any third-party tracking cookies. Lesson pages that include a YouTube video connect to Google as the page loads (see section 7); if you or your child then plays the video, Google's embedded player may also set its own cookies — Maths Monster does not control what Google sets. See our Cookie Policy for details.

11. Security

We protect your data with:

• HTTPS encryption on all connections
• Hashed passwords (never stored in plaintext)
• Server-side authentication on all API endpoints
• Cloudflare Turnstile CAPTCHA on login and registration
• No public API access to subscriber or child data
• EU-based hosting (Railway Amsterdam region)
• Presigned URLs for image access (time-limited, not publicly accessible)
• An audit record of every staff request to open a child's homework photo — who, which photo, when

12. Data breaches

In the event of a personal data breach that poses a risk to your rights, we will notify the Information Commissioner's Office (ICO) within 72 hours and affected individuals without undue delay. See our internal Data Breach Notification Procedure for full details.

13. Complaints

If you are unhappy with how we handle your data, you have the right to complain to the Information Commissioner's Office (ICO):

• Website: ico.org.uk/make-a-complaint
• Helpline: 0303 123 1113

14. Sharing progress with a teacher or tuition centre

If your child has a tutor or attends a tuition centre that uses Maths Monster, you can choose to share your child's progress summary with them. This never happens automatically — here is exactly how it works and what they see.

Sharing only happens if you accept an invite. The teacher sends an invite addressed to your email. You accept it while signed in to your own account, choose which child it applies to, and confirm. Nobody else can accept an invite meant for you, and your child cannot grant access themselves.

What the teacher sees: a short label the teacher chose (like "JS" — we require initials or a nickname, never your child's full name), which topics your child has practised, how many practice rounds they've completed, when they last practised, and your child's own 1–4 confidence ratings shown as colours. These are your child's self-ratings, not marks or grades.

What the teacher never sees: your child's name or nickname, your name or email, photos of homework, the written feedback we send your child, or anything about your account or subscription.

You can stop sharing at any time. Your account lists every teacher who can see each child's progress, with a remove button. Removal takes effect immediately — the teacher loses all access to that child from that moment. We keep a record that access existed (not the progress data itself) for 12 months so we can answer questions about who had access, then delete it. If you delete your child's profile, sharing records are deleted immediately.

Questions or concerns: contact us at privacy@maths.monster and we'll help — including deleting anything you'd like removed.

15. Changes to this policy

We may update this policy from time to time. Material changes will be communicated by email to registered subscribers. The "Last updated" date at the top of this page shows when it was last revised.