Privacy Policy

What changed on 3 October 2026:

• This policy now describes the anonymous crash reports and app-usage statistics the App sends, with your consent, through Firebase Crashlytics and Google Analytics for Firebase. It also says how to switch them off: Parent Dashboard → Privacy & Data → "Crash reports & usage statistics". The App asks for your consent again when you next open it.
• Section 2 now lists all the learning data the App keeps, including screen time and the questions a child is asked to try again. It also lists the features that work only on the device: read-aloud, motion sensors, reminders and the printable report.
• Section 8 now describes how the Parent Dashboard and account deletion are protected.

MathBase ("the App", "we", "us") is a math learning app for learners aged 3 to 20, created and operated by Nagalakshman Chirukuri (the "Developer", "Data Controller"). This policy explains what personal data the App collects, why, how it is used, and the rights you (and, where applicable, your child) have over it — including the rights granted by the EU General Data Protection Regulation (GDPR) and the ePrivacy Directive.

Contact for all privacy matters: privacy@nagalakshmanchirukuri.fyi

1. Who this policy is for — every age from young children to college-age learners

MathBase serves a broad age range, from young children through college-age students, and the account model differs by age. The App can always be used locally on-device without any account, at any age — a profile (name/nickname, age, avatar) is set up directly in the App and nothing leaves the device unless cloud sync is turned on.

Cloud sync (an optional sign-in via Google or Apple, reachable from Parent Dashboard) is intended to be set up by whoever is old enough to give consent for the account under applicable law: for older teens and adults (for example, our college-tier learners), the user may sign in and manage their own account directly. For younger children below the age of digital consent, a parent or legal guardian must create and control the account instead — the child does not sign in independently, does not provide their own consent, and cannot create, modify, or delete an account. When a parent enters a child's name, age, and other profile details for cloud sync, the parent is providing that data and giving consent on the child's behalf, as required by Article 8 GDPR for children under the age of consent applicable in their country (16 by default in the EU, or as low as 13 in some member states).

By creating an account, you confirm that either you are old enough to consent for yourself under applicable law, or you are the parent or legal guardian of the child the profile belongs to and consent to the processing described below on their behalf.

2. What data we collect

Features that work only on the device

These features work entirely on the device. The data they handle is not sent to us or to anyone else:

• Read-aloud: questions are spoken by the device's own text-to-speech engine. The App never uses the microphone.
• Motion sensors: shaking the phone erases the sand-tracing board or rolls the dice in one Addition activity. The movement is read on the device and is not stored.
• Reminders and the weekly summary are notifications scheduled on the device. They appear only if you allow notifications.
• The printable progress report and "Export My Data" are created on the device. They leave it only if you choose to share them.
• Rating the App: after a streak milestone the App may ask Apple or Google to show their standard rating prompt. Any rating you give is handled by the store, not by us.

If the App is used without signing in, all the data in the table above stays on the device. Only the crash reports and usage statistics are sent, and only if a parent has consented.

We do not collect location data, contacts, photos/camera/microphone access, browsing history outside the App, or any data for behavioural advertising. The App contains no advertising SDKs, does not use the device's advertising ID, does not show ads, and does not track you across other companies' apps or websites.

3. Why we process this data (legal basis)

• Performance of a contract (Art. 6(1)(b) GDPR): to provide the learning features, track progress, and sync your account across devices.
• Consent (Art. 6(1)(a) and Art. 8 GDPR): to create and store your child's profile and learning data, obtained from you as the parent/guardian during account setup; and to send anonymous crash reports and usage statistics, which you agree to on the App's consent screen. You can withdraw this consent as easily as you gave it, by turning off "Crash reports & usage statistics" in Parent Dashboard → Privacy & Data (Art. 7(3) GDPR). Withdrawing does not affect anything sent before.
• Legitimate interest (Art. 6(1)(f) GDPR): to keep the App secure, prevent abuse, and maintain basic service reliability.

4. Where data is stored

Everything the App keeps is stored locally on the device. If a parent signs in, part of it is also stored in Google Firebase / Google Cloud Platform (Cloud Firestore and Firebase Authentication), acting as our data processor, so progress can sync across devices.

Synced to the cloud when signed in: child profiles, XP, the streak, progress in each subject, game results, first-try results, the Shop (what was bought and sold), the subjects chosen or hidden for each child, the home screen style, study reminder settings, and your consent record.

Kept on the device only, never uploaded: the daily time limit, play settings (game timers, reading aloud, times-table layout), the practice log, screen time, questions saved to try again, the rewards a child is wearing, the last activity played, the Daily Quest review and today's path. These are lost if the App is removed from the device.

• Each child's synced data is kept in a separate record under your account.
• Firestore access rules let only your own signed-in account read or write that data. No other user, and no member of the public, can read it.
• A child who plays as a guest without an account is never uploaded.

Google Cloud may process data on servers located outside the European Economic Area (including in the United States). Where this occurs, it is covered by Google's Standard Contractual Clauses and other GDPR‑compliant safeguards.

5. Data retention

Data is kept for as long as the account exists. Some records are capped:

• The practice log and daily screen time cover only the last 21 days.
• First-try results keep the last 20 answers for each activity.
• At most 30 questions are kept to try again. A question is removed once the child answers it right twice in a row.

In the Parent Dashboard you can:

• Reset a child's progress. This clears it from the device and from the cloud, and keeps the child's profile and settings.
• Delete a child. This erases everything the App holds about that child, on the device and in the cloud.
• Delete your whole account with "Delete All My Data", under Privacy & Data. You sign in again first, to confirm that it is you. The App then deletes your cloud data, deletes your sign-in account, and wipes the App's data from the device. If the cloud data cannot be deleted (for example, because the device is offline), nothing is deleted and you can try again. Deletion cannot be undone.

Crash reports and usage statistics are not tied to your account, so they are kept for the periods set by Google: crash reports for up to 90 days in Firebase Crashlytics, and usage events for the retention period configured in Google Analytics, after which they are deleted automatically. Turning off "Crash reports & usage statistics" stops any further collection from that device.

6. Your rights (GDPR Articles 15–21)

As the parent/guardian acting on behalf of your child's data, and for your own account data, you have the right to:

• Access the personal data we hold. Use "Export My Data" in the Parent Dashboard, or email us. The export is a JSON file covering every child on the device, with each child's profile, progress and settings (including the device-only data listed in section 4), plus your account email address and account ID.
• Rectify inaccurate data — edit your child's profile directly in the App.
• Erase your data ("right to be forgotten") — use "Delete All My Data" in Parent Dashboard.
• Restrict or object to processing, and data portability — contact us; exported data is provided in a structured JSON format.
• Withdraw consent at any time, with the same effect as erasure for child profile data. To stop crash reports and usage statistics, turn off "Crash reports & usage statistics" in Parent Dashboard → Privacy & Data.
• Lodge a complaint with your local data protection supervisory authority.

7. Third-party processors

We do not sell personal data to anyone, and we do not share it with third parties for their own marketing purposes.

8. Security

• Data in transit is encrypted with TLS.
• Firestore security rules let only the signed-in account owner read or write their own data. The rules also check the shape of what is written, and limit the number of child profiles.
• The Parent Dashboard, where your email, the children's reports and the delete options appear, sits behind a parent gate. None of it is loaded until the gate is passed. It locks again when the App goes into the background, and after two minutes without a touch.
• The parent gate also protects purchases. It asks for a task that does not involve maths, so a child practising arithmetic in the App cannot pass it by doing a sum.
• Deleting your account asks you to sign in again first.
• Your photo is never downloaded from your sign-in provider.

9. Children's privacy outside the EU

For children under 13, cloud sync accounts are created and controlled by a parent or guardian only, as described in Section 1 — the child does not sign in independently. For users in the United States, this satisfies the parental-control intent of COPPA in the same way described above. The App shows no ads, does not use the advertising ID, and does no behavioural advertising; crash reports and usage statistics are sent only with a parent's consent and can be switched off at any time. The App can also be used entirely offline, with no account at all, at any age.

10. Changes to this policy

We may update this policy as the App evolves. Material changes will be reflected by an updated effective date above, and significant changes affecting how child data is processed will be highlighted in the App.

11. Contact

Data Controller: Nagalakshman Chirukuri
Email: privacy@nagalakshmanchirukuri.fyi