← Math Factor

Version 1 · Effective May 2026

Math Factor – Privacy Policy

The short version

• We collect the minimum information needed to run Math Factor.
• You can use Math Factor without creating a signed-in account. We collect a display name and age to get started, and store your progress on our servers, but no login credentials are set.
• If you create an account, or one is created for you, we collect a username or email address, a display name, your age or grade, and your performance data. We only collect an email address if you choose to sign up with one.
• We never sell your data. We never advertise to students.
• You can delete your account and all associated data at any time.
• Student data collected through schools is used only for educational purposes and is controlled by the school.

1. Who we are

Math Factor is operated by State Machines Limited, a company registered in New Zealand (the "we", "us" or "our" in this policy).

If you have any questions about this policy or how we handle your data, please contact us at:

privacy@mathfactor.app

2. Who this policy covers

This policy applies to everyone who uses Math Factor, including:

• Students — whether using the app on their own or through a school
• Parents and guardians — who create and manage accounts on behalf of their children
• Teachers and school administrators — who create and manage accounts on behalf of their students

We refer to all of these people collectively as "users."

3. Using Math Factor without signing up

You can use Math Factor without creating a signed-in account. When you do, we ask for a display name (which does not need to be your real name) and your age or grade level, and we store your progress on our servers. A session key is stored in your browser's local storage so your session is remembered if you return to the app on the same device and browser.

If you want to access your progress across devices or after clearing your browser, you will need to create a full account.

4. What we collect when you create an account

4a. Students

When a student creates a full account (or has one created for them by a parent or teacher), we collect everything listed in Section 3, plus:

• A username — used to log in, does not need to be a real name
• Email address — required for individual account sign-ups. Student accounts that are created by a parent or teacher on the student's behalf do not require an email address for the student.
• Password — stored as a secure hash. We never store your actual password.

As with non-signed-up sessions, we also collect:

• Display name — does not need to be a real name
• Age or grade level — used to set appropriate difficulty levels
• Performance data — including which questions were attempted, answers given, accuracy, speed, and session history

We do not collect students' full legal names, physical addresses, phone numbers, or any information beyond what is listed above. We do not collect information that is not necessary to operate the service.

4b. Sign-in via third-party providers (Single Sign-On)

Math Factor plans to support sign-in via third-party providers such as Google. When you sign in this way, we collect an identifier from the provider that allows us to authenticate your sign-in. We do not collect the email address associated with your SSO account. Students signing in via SSO are therefore not required to provide an email address, even through that route.

4c. Password resets

Accounts registered with an email address can reset their own password via a link sent to that email address. Student accounts provisioned by a teacher (username-only, no email address) can have their password reset by the teacher who manages their class.

4d. Parents and guardians

When a parent or guardian creates an account or links their account to a child's:

• Name and email address (required for account creation)
• Password (stored as a secure hash — we never store your actual password)
• Account preferences and settings

4e. Teachers and school administrators

When a teacher or school administrator creates or manages accounts:

• Name and email address
• School name and class information
• Student account details (names and performance data) for the students in their classes

4f. If you contact us

If you email us or submit a support request, we collect the information you provide (such as your name, email address, and the content of your message) in order to respond to you.

5. How we use your data

We use the data we collect to:

• Provide and run the Math Factor service
• Track student progress and personalise the learning experience
• Generate progress reports for students, parents, and teachers
• Improve Math Factor — we use de-identified, aggregated data to understand how the app is being used and to make it better
• Communicate with parents and teachers about their accounts (for example, progress reports or important service updates)
• Comply with legal obligations
• Provide customer support — staff may access account data when investigating a reported issue or responding to a support request

We do not use student data for advertising, marketing, or any purpose unrelated to education.

We may from time to time send parents and teachers updates about Math Factor, new features, or other information about the service. You can opt out of these communications at any time by clicking the unsubscribe link in any email we send, or by contacting us at privacy@mathfactor.app.

Anonymous and aggregated data

In addition to personal data, we collect anonymous information about how Math Factor is used — for example, which exercises are most commonly attempted, and how session lengths vary by age group. This information is not linked to any individual's name or identity and cannot be used to identify any user. We use it to improve the app and understand how it is being used at a population level. We may also use aggregate, non-identifying statistics (such as the total number of questions answered across all users) for promotional purposes.

6. What we don't do with your data

• We do not sell user data to anyone, ever.
• We do not advertise to students.
• We do not build profiles of students for any purpose other than tracking their own learning progress.
• We do not share personal data with third parties for their own marketing or commercial purposes.
• We do not use behavioural tracking or third-party advertising cookies on student-facing parts of the app.

7. Sharing data with third parties

We only share personal data with third parties in the following limited circumstances:

• Service providers who help us operate Math Factor (for example, cloud hosting and email delivery). These providers are contractually required to protect your data and may only use it to provide services to us — not for their own purposes.
• Schools — teachers and administrators at a school can see the performance data of students in their classes.
• Parents and guardians — can see the performance data of their linked child accounts.
• Legal requirements — if we are required to disclose data by law, court order, or to protect the safety of a person.
• Business transfers — if State Machines Limited is acquired or merges with another company, user data may transfer as part of that transaction. We would notify users before this happens and the new owner would be required to honour this policy.

We will never share student data with government education departments or research institutions without first removing all personally identifying information.

8. Data stored by schools

When a teacher creates accounts for their students, the school is responsible for ensuring that appropriate consents from parents or guardians are in place under the laws that apply to them. State Machines Limited processes that student data only as described in this policy.

Teachers and school administrators can see the performance data of students in their classes. Schools can request deletion of all their students' data at any time by contacting us at privacy@mathfactor.app.

If you are a parent with questions about how your child's school uses Math Factor, please contact your school directly.

---

9. Children's privacy

Math Factor is designed for children and takes their privacy seriously.

For school accounts: When a teacher creates student accounts, the school takes responsibility for ensuring that appropriate parental consents are in place under the applicable laws in their jurisdiction.

For home accounts: If you are under 13 and want to use Math Factor, please ask a parent or guardian for their consent first.

What we do to protect children:

• We do not allow students to communicate directly with each other through the app.
• We do not show advertisements to students.
• We do not collect more information from students than is necessary to operate the service.
• Display names (not real names) are used wherever a student's identity is visible to others, such as within a class group. Student data is never displayed publicly.

If we become aware that a child under 13 has created an account without appropriate parental consent, we will delete the account and associated data promptly. Please contact us at privacy@mathfactor.app if you have concerns.

10. How we keep your data secure

Our measures include:

• All data is encrypted in transit (HTTPS/TLS)
• Passwords are stored as secure hashes — we never store your actual password
• Access to personal data is restricted to staff who need it to do their jobs
• We use reputable, security-certified cloud infrastructure providers
• We conduct regular reviews of our security practices

Our servers log IP addresses in the normal course of operations for security purposes. These logs are retained for 90 days and then deleted.

No system is perfectly secure. If we ever discover a data breach that affects your personal information, we will notify affected users and, where required, the relevant authority (including the New Zealand Privacy Commissioner under the Privacy Act 2020) as soon as practicable.

11. Where your data is stored

Math Factor's primary database is hosted in Australia. Analytics data is stored in the EU under GDPR-compliant terms. If your data is stored outside your home country, it is protected by contractual safeguards that require the same standards of protection as apply in your country. See Appendix A for a full list of third-party providers.

12. How long we keep your data

We keep your personal data for as long as your account is active or as needed to provide the service.

• All accounts (whether created by a student, parent, or teacher): We will delete the account credentials and all associated personal data after 2 years of inactivity, or immediately upon request.
• Schools or teachers wishing to remove student data before that point can do so at any time by contacting us at privacy@mathfactor.app.
• De-identified, aggregated data (data that cannot be linked to any individual) may be retained indefinitely for product improvement purposes.

You can request deletion of your account and data at any time — see Section 14 for how.

13. Your rights

Depending on where you are located, you may have the following rights regarding your personal data:

• Access — you can request a copy of the personal data we hold about you.
• Correction — you can ask us to correct inaccurate or incomplete data.
• Deletion — you can ask us to delete your personal data (the "right to be forgotten").
• Portability — you can ask us to provide your data in a machine-readable format.
• Objection — you can object to certain types of processing.
• Withdrawal of consent — where we process your data on the basis of consent, you can withdraw that consent at any time. This does not affect the lawfulness of any processing carried out before the withdrawal.

To exercise any of these rights, contact us at privacy@mathfactor.app. We will respond within 20 working days. There is no charge for making a request.

If you are a student under 18, a parent or guardian may exercise these rights on your behalf.

14. Deleting your account

To delete your account and personal data, email us at privacy@mathfactor.app with the subject line "Delete my account". We will delete your personal data within 10 business days. De-identified performance data (with no connection to your identity) may be retained for product improvement purposes.

15. Cookies and analytics

Math Factor uses cookies only where essential for the app to function — for example, to keep you logged in between sessions. We do not use advertising cookies or any third-party tracking cookies.

We collect usage metrics through our own servers (not via browser-side scripts or cookies). This non-identifying data is then forwarded to our analytics host in the EU. Our analytics host does not set any cookies on your device.

16. Legal compliance

This policy is designed to comply with:

• New Zealand Privacy Act 2020 — as a New Zealand company, this is our primary legal framework.
• Australian Privacy Act 1988 — for our Australian users.
• EU/UK General Data Protection Regulation (GDPR/UK GDPR) — for users in the EU and UK.
• US Children's Online Privacy Protection Act (COPPA) — for users in the United States, particularly regarding children under 13.
• US Family Educational Rights and Privacy Act (FERPA) — where Math Factor is used by US schools, student education records are handled in accordance with FERPA requirements.
• California Student Online Personal Information Protection Act (SOPIPA) — we do not use student data for advertising, profiling, or any purpose unrelated to the educational service, consistent with SOPIPA requirements.

If you have a complaint about how we handle your personal information that we have not resolved to your satisfaction, you can contact the relevant authority in your country:

• New Zealand: Office of the Privacy Commissioner — privacy.org.nz
• Australia: Office of the Australian Information Commissioner — oaic.gov.au
• EU: Your local Data Protection Authority
• UK: Information Commissioner's Office — ico.org.uk

17. Changes to this policy

We may update this policy from time to time. When we make material changes, we will notify users by email (if we hold your email address) or by a prominent notice in the app before the changes take effect. The date at the top of this policy shows when it was last updated.

18. Contact us

For any questions, concerns, or requests relating to your privacy or this policy:

Email: privacy@mathfactor.app

We aim to respond to all privacy enquiries within 5 business days.

---

Appendix A: Third-Party Providers

The following third-party providers may receive or process user data in the course of operating Math Factor. All providers are contractually required to protect your data and may only use it for the purposes listed below.

This list will be updated as providers change. Material changes will be communicated to users as described in Section 17.

---

State Machines Limited, New Zealand