Privacy Policy

Mathalon is committed to protecting the privacy of all users, especially children. This policy explains how we collect, use, and protect personal information in compliance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

1. Who we are

Mathalon is an online maths learning platform for Australian school students in Years 3–11. Parent accounts are required to create and manage child accounts. We are based in Australia and subject to Australian privacy law.

For privacy enquiries, contact us at: privacy@mathalon.com.au

2. What information we collect

Parent accounts:

• Email address (collected via Google Sign-In)
• Full name (optional, from your Google account)

Child accounts (created by parents):

• Display name (e.g. “Jake”)
• Username (used to log in)
• Year level (e.g. Year 5)
• Avatar selection (emoji)
• A hashed 4-digit PIN (we never store the PIN in plain text)

Usage and learning data:

• Game sessions: questions answered, accuracy, time taken, XP earned
• Topic mastery: accuracy per maths topic over time
• Streaks, rank progression, and season leaderboard position

We do not collect children's real names, photos, addresses, phone numbers, or any government identifiers.

3. Why we collect this information

• To operate the platform and provide personalised maths practice
• To allow parents to monitor their child's progress
• To send PIN reset codes to parents when requested
• To weight questions toward topics where a child needs more practice

We do not use your information for marketing or sell it to third parties.

4. Children's privacy

Child accounts are created and managed exclusively by parents or legal guardians. By creating a child account, the parent confirms they have the authority to provide the child's information and consent to its collection. Children cannot create their own accounts.

We collect only the minimum information needed to operate the service. If you believe a child account has been created without appropriate consent, please contact us immediately at privacy@mathalon.com.au.

5. Overseas disclosure (APP 8)

We use the following third-party services that may store or process data outside Australia:

• Supabase — database and authentication, hosted in Ireland (EU)
• Upstash — rate limiting service, hosted in the United States
• Resend — transactional email (PIN reset codes), hosted in the United States

We take reasonable steps to ensure these providers maintain appropriate security standards. By using Mathalon, you consent to your information being processed in these countries.

6. How we protect your information

• All PINs are hashed using bcryptjs — we cannot recover your child's PIN
• Sessions are stored in secure, HTTP-only cookies
• All database access is protected by row-level security policies
• Communication between the app and our servers is encrypted (HTTPS)

7. How long we keep your data

We retain your data for as long as your account is active. If you delete a child account or your parent account, all associated data (sessions, stats, topic mastery) is permanently deleted. We do not retain anonymised copies of individual user data after deletion.

8. Your rights (APP 12 & 13)

As a parent or legal guardian, you have the right to:

• Access all data held about you and your children — use the “Export my data” button in Account Settings
• Correct inaccurate information — contact us at privacy@mathalon.com.au
• Delete your account and all associated data — use the “Delete account” button in Account Settings
• Complain — if you are unhappy with how we handle your data, contact us first, then escalate to the Office of the Australian Information Commissioner (OAIC)

9. Cookies

We use secure, HTTP-only session cookies to keep you logged in. We do not use tracking cookies, advertising cookies, or third-party analytics cookies.

10. Changes to this policy

We may update this policy from time to time. We will notify you of significant changes via email. The date at the top of this page reflects when it was last updated.

11. Contact & complaints

For privacy questions or concerns, contact us at privacy@mathalon.com.au or visit our contact page. We will respond within 30 days.

If your complaint is not resolved, you may contact the OAIC at oaic.gov.au.