Privacy Policy

Ready Steady Math is operated by BladeMind ("we", "us"), a sole trader based in New Zealand. The Sprint is currently sold to families in New Zealand. This policy explains what we collect, why, and the choices you have. We've written it in plain English on purpose — if anything is unclear, ask us through the Tell us form.

The short version

• Children never create accounts, never enter an email, and are never shown ads. Kids play using a play code — a credential that contains no personal information.
• Grown-ups (parents, guardians, teachers) hold the accounts, make the purchases, and choose family backup, AI Coach and sharing, and can request deletion of a child's data (subject to the limits in section 8).
• We use analytics to improve the product, with this rule for analytics: For analytics, nothing is sent from children's screens except the anonymous counts described below. No session recordings or advertising. What we do measure about children's play is listed — completely — on our What We Record About Your Child page.
• We never sell personal information. We never use children's data for advertising or to build advertising profiles.

1. Information grown-ups give us

• Account details: your email and sign-in credentials (managed by our authentication provider, Clerk).
• Child profiles you create: a display name (a first name or nickname chosen by you or your child), an age band or school year with the country whose school years you chose (so we can label years correctly; we don't track location), an avatar, and the practice settings you pick for them, such as sound and timers. We don't ask for a child's surname, birthdate, photo, school, or contact details.
• Purchase details: handled by Stripe. We receive confirmation of what was purchased, a payment reference, and the name and email given at checkout — we never see or store card numbers. If you allowed analytics (section 5), we also keep with the purchase how you first reached us: the campaign link, if there was one, and the first page you landed on.
• Messages you send us: support requests through the Tell us form, feedback you give on a help-chat answer, and survey answers you choose to give. We don't save help-chat conversations themselves (section 4).
• Parent contact details a teacher adds (optional classroom feature): a teacher may store a parent's email for class updates and can remove it at any time. Sending teacher emails to parents is currently switched off. We use that address for nothing else.
• Private confidence ratings (optional): if you submit the Day 7 or Day 21 reflection, we keep your before-and-now ratings with the learner's result even if you choose not to share a card. They are not published.
• Sharing a result (optional): after the Day 21 check-in you can choose to share one anonymous result card: how much your child's accuracy went up, their year level. We ask separately and publish it only with your explicit consent. We never publish names, photos or quotes. You can stop sharing at any time in the Grown-ups area (Shared results) or through the Tell us form; we then take the card down and delete the year level we kept for it.

A first name or nickname for each player, chosen by you or your child, is saved on the device first. Family backup also saves it on our servers. If a learner joins a class, their teacher sees the display name held for that profile alongside their classroom rounds.

2. Information about children's practice

Practice data is saved on your device first. Family backup is your choice: with it on, practice is also saved to our backend (Convex) under your grown-up account, so you can see progress on any device where you sign in. With family backup off, practice stays on the device, except classroom rounds your child joins with a teacher's code (their teacher sees those). Turning family backup off stops new uploads; it doesn't delete what was already backed up. To remove that, delete the child or your account (section 8).

Voice answers. If your child answers out loud, their speech is recognised on the device itself. Audio is never recorded, stored or sent to us or anyone else. Only their answer is kept, along with the fact that it was spoken and how sure the speech recogniser was of it, just as a typed answer is kept.

For each child profile we record practice data: which questions were answered, whether they were correct, how long answers took, sessions and rounds played, streaks, badges earned, starting check and Day 7 and Day 21 check-in results, a "start over" marker if a grown-up starts a child over, and which facts the practice engine should serve next. Answer records also describe the input mode and whether an answer was independent, a retry, or supported by a choice or help, with event and round references and the learning-rule version. This is the product working as described — it's how progress reports, coaching, and the adaptive engine function. With family backup on, our server works out each child's learning picture from their backed-up answers whenever the Coach, a progress view or an email needs it; that picture isn't stored separately.

Dashy Helper. If a child is struggling in a practice round, Dashy may show a tip from our own reviewed list. The app decides this on the device from the round's answers; nothing about it leaves the device and no AI is involved. A grown-up can turn Dashy Helper off for each child.

We don't record analytics events about children's play: no improvement signals, no practice milestones, nothing sent to an analytics company. (Until 9 October 2026 we recorded a few pseudonymous improvement signals and practice milestones; we've stopped. See section 8 for what happens to those already recorded.)

Anonymous totals. Our own server receives anonymous daily counts when a starting check begins after its warm-up and when it finishes. Each request carries only the event type, its New Zealand calendar day and a random delivery key reused only for retries of that event. It carries no cookie, referrer, visitor or device ID, name, profile or answers. These are event totals, not counts of unique children or families, and they are not linked to an account or a learner's practice record.

To avoid counting a retried delivery twice, we temporarily keep a hash of its random delivery key with the event type and an expiry time. The receipt expires after eight days and is removed by scheduled cleanup. It is not a visitor identifier and is not linked to an account, profile or practice record. The network address is used in memory for rate limiting only and is not stored with the count.

We also keep daily totals of how many checkouts are opened, and how often practice voice heard an answer or asked to say it again, as daily totals, with nothing that identifies anyone. Voice requests carry only totals of answers heard, requests to say it again, and answers accepted using the expected-answer confidence check, with no cookies, referrer, identifiers, audio or answers. Failed voice deliveries are dropped. We also count, as weekly totals only, how families move through the Sprint (purchases, set-up, practice days, check-ins and refunds), from the records described in this policy. Those totals name no family, child, email or payment.

Crash reports. Reports contain only the type of error, where in our code it happened and which kind of page, never names, answers or anything you typed. We also include an allowlisted technical error code if available, the app version and time. Code locations are file-and-line references, without query strings. Page types use templates such as /play/[mode], never a concrete account or learner ID. We keep these in our own database, never with an analytics company, and remove them by a scheduled clean-up after 90 days.

What we deliberately do NOT do on children's screens: nothing sent to analytics companies, no session recording or screen capture, no audio recording, no advertising or tracking pixels, practice has no chat or free-text answers, no location collection, no behavioural profiles beyond learning progress.

Play Code security. We keep hashes of Play Codes and trusted-device tokens, creation and last-seen times, revocation state, and a hash of the browser information used at sign-in. To resist code guessing, sign-in rate-limit records also use hashes derived from the network address and browser information, with failure counts and lock times. We do not store raw network addresses or browser information in those records. Anti-guessing hashes are removed by a scheduled clean-up after 30 days without activity. These security records are separate from the anonymous counts above.

3. The AI Coach (adult-controlled)

If you use the AI Coach, your child's practice data (the facts asked, whether each answer was right, how long it took, and which days they practised) is processed by our AI service server-side only to produce reports and plans for you. Your child's name, school year and country are not sent. This happens only after you, the account-holding adult, give explicit consent in the app. AI Coach is a separate choice from family backup, and needs both, because it reads the backed-up practice. Turning AI Coach off stops it using your child's results for new reports. AI outputs are checked against child-safety rules before display. We have turned off sharing of API data with OpenAI for training. The OpenAI API retention limits described in section 4 also apply to these practice summaries. OpenAI is our default provider; configured alternatives are described in section 6.

4. The help chat

Our help chat (Ask Ready Steady Math, on the website and in the grown-ups area) sends the question you type to our configured AI provider, from our servers, to write an answer from our help articles. Please don't type personal details into it. We don't save the conversation: our server holds it in memory while you use the chat so it can follow what you've asked. After 2 hours without activity, it expires and is removed when the server next checks its chat threads. Our OpenAI project uses Standard retention, not zero data retention. OpenAI keeps API data for up to 30 days for abuse monitoring, or longer where law requires; this is separate from our chat memory (official page checked 14 October 2026). We have turned off sharing of API data with OpenAI for training. Our Coach and help-chat Responses API requests set store: false to turn off response storage; this does not turn off OpenAI's abuse-monitoring logs or temporary prompt caching. If you rate an answer, we keep your rating, any reason you give, and an email address only if you add one. If you have both family backup and AI Coach consent on and ask the grown-ups' chat about your child's maths, it also sends the same kind of practice summary the Coach uses, without your child's name, school year or country. OpenAI is the default provider; configured alternatives are described in section 6. Children's screens have no chat.

Our own server also receives anonymous daily visit counts from the home and Sprint marketing pages, whether or not you allow analytics. They use the same event type, New Zealand day and one-delivery retry key described above, with no cookies, referrer or visitor ID, and never go to PostHog.

5. Analytics on grown-up and marketing pages

On our marketing site and grown-up areas (never children's screens), and only if you allow it in the cookie notice, we use PostHog Inc., which processes this analytics data in the United States, to understand usage and where our pages fail people: page views, clicks, and the steps people take, such as going from the pricing page to checkout. A few events we send from our own server, such as a purchase or a Coach report being made, also carry your account's ID, so we can see which steps one account has reached; these too are sent only if you allowed analytics. Browser analytics includes a random visitor ID, browser and device information, and page addresses without query strings. Page text and element attributes are masked. Purchase events can include the plan, currency, amount and discount, but never card details or payment identifiers. Analytics never carries your name, email or anything about your child, and PostHog's Discard client IP data setting is on. We don't use session replay. You can decline non-essential analytics and everything still works. Choosing Essential only stops new browser analytics immediately. Purchase events use the choice saved when checkout opened: a delayed payment confirmation can still send an event if you allowed analytics then, even after you change your browser choice.

On marketing and grown-up pages, if you allow adult-page analytics, we also save pending anonymous count deliveries in this browser so they can be retried after a connection problem or a later visit. Pending counts expire after seven days and are removed the next time a marketing or grown-up page checks the queue. Each saved delivery contains only its event type, a random key for that delivery and the time it was created. The delivery key is not a visitor or device ID. If you choose "Essential only", pending counts are retried in memory and are not saved to browser storage. Withdrawing analytics consent clears the saved pending counts when the choice is handled on a marketing or grown-up page. Children's pages do not read, write or restore this outbox. Anonymous count requests carry no cookies or referrer and do not go to an analytics company.

We use PostHog's free plan. Its pricing page, checked on 14 October 2026, lists one year of event and metadata retention for free plans. That is not a promise that every event is deleted exactly after one year. Changing your cookie choice stops new browser analytics but does not remove events already sent. Ask us to delete them and we will request deletion from PostHog.

We have signed PostHog's data-processing agreement, dated 14 October 2026, and turned off its AI training on anonymized data and third-party AI features. The training opt-out applies to future use; it does not undo earlier training.

The queue restriction applies to routine child counting. If a grown-up explicitly opens Cookie settings on a learner page, choosing Essential only can clear pending adult counts saved by an earlier grown-up visit.

6. Who processes data for us

Vercel (hosting), Convex (database/sync), Clerk (authentication), Stripe (payments), OpenAI (AI Coach and help chat, server-side), Thesys (AI services), PostHog Inc. (consented adult-page analytics), and Resend (email delivery) help run the service.

Our Vercel Pro functions run in Washington D.C., US East (iad1); its delivery network is distributed. Our Convex production database is in US East, N. Virginia. Clerk's production instance is on its Hobby plan and hosted in the United States. Clerk's standard terms incorporate its DPA; we rely on that agreement, with no separate DPA signature found. Our Stripe account is BladeMind, a New Zealand sole trader. Stripe handles some payment data as an independent controller under its privacy policy, with US transfers and international processing described in its DPA.

PostHog is US Cloud, on the free plan with one project. Its Discard client IP data setting is on. Its AI training on anonymized data and third-party AI features are off. Resend is on the free plan. Our sending domain sends email from Tokyo, Japan (ap-northeast-1); Resend stores customer data in the United States, including message content and delivery logs. That page lists 30-day email/log retention on the free plan; inbox copies have separate retention. These account facts come from the owner dashboard check, 14 October 2026.

OpenAI's training-sharing controls are off and our project uses Standard retention (section 4). Its exact processing region has not been verified. Thesys is a processor for AI services: configured endpoints can receive adult text and, with both family backup and AI Coach consent, learner practice summaries without the learner's name, school year or country. Adult text is not automatically anonymised; please leave personal details out. Its DPA, retrieved 14 October 2026, identifies the data importer as a processor in the USA and links its subprocessor register. This identifies a US recipient, not our account's exact processing region. The DPA provides EEA Standard Contractual Clauses (controller-to-processor or processor-to-subprocessor as applicable) and the UK Addendum for covered transfers, with safeguards for other non-adequate destinations. We have not verified our signed or electronically accepted Thesys DPA or New Zealand transfer safeguards. Its terms of service, retrieved 14 October 2026, permit use of disaggregated and depersonalised inputs and outputs for benchmarking, quality control and improving the service; they do not state a general no-training promise. Its enterprise page, retrieved 14 October 2026, advertises no training and zero retention, but those protections are not verified for our account. We have not verified which hosts all production AI overrides select or any additional processors they use. OpenAI's settings do not establish Thesys's or another provider's protections.

Supabase can still process old account and practice records for a legacy weekly-email service. That service is not in our current schedule. Its production use, region and legacy-data deletion are being checked. Supabase's DPA describes its processing terms.

The providers' public processing terms are here: Vercel, Convex, OpenAI, PostHog and Resend. Public terms are not proof of a separately signed agreement. BladeMind and PostHog have signed a data-processing agreement dated 14 October 2026. For overseas processing, we rely on applicable contractual data-protection terms and their international-transfer provisions; unresolved arrangements are described above. We do not claim these establish safeguards equivalent to New Zealand's Privacy Act. Ask about overseas processing through the Tell us form. Official pages were checked on 14 October 2026.

7. Emails

• Sign-in codes: sent only when you ask for one.
• Welcome email: sent once when you buy the Sprint, because it has the set-up steps and how to ask for a refund.
• Sprint reminder emails (a note when the Day 7 and Day 21 check-ins are ready): switch them off with the one-click link at the foot of any Sprint email, or in Grown-ups → Settings → Emails. The same switch covers three more reminders: a nudge when no child has practised for two days while the Sprint runs, a note the day before each check-in opens, and a reminder while the Day 21 check-in is still open. You get at most one of these a day.
• Marketing emails: only if you opted in (the "Email me sprint tips and launch updates" box at checkout), and every one has one-click unsubscribe that takes effect immediately.

8. Retention & deletion

The owner checked the production dashboard on 14 October 2026. Daily retention enforcement is enabled for the next scheduled run. The latest run before release 25 was a dry run, so we do not yet claim completed scheduled deletions. There were no privacy deletion records or failures at that check. A later run may have a different result.

• Account and practice data: kept while your account is active. Delete a child in Grown-ups → Manage profiles, or your whole account in Grown-ups → Settings → Delete my account (you'll be asked to sign in again first), or ask through the Tell us form, and removal starts from this device and our active database. We aim to finish associated personal-data deletion within 30 days; unfinished database work is retried by scheduled cleanup and a failed sign-in deletion may need operator action. Exceptions are records we must keep (purchase, payment, refund and Coach credit records, for tax and refunds). Whole-account deletion also removes non-financial customer records, outreach, activities, household notes and linked contacts. Financial records retain only transaction amounts, currency, dates, status and references needed for tax, refunds and Coach credit reconciliation, including Stripe IDs and account/transaction links. Names, email addresses, typed messages, acquisition details and non-financial notes are removed from those linked records. Unlinked support messages and help-chat feedback follow their separate 24-month period below. A copy on another device stays there until you delete it on that device too; its Play Code can no longer sign in. We keep a deletion record containing account and profile IDs, but no names, until removed by a scheduled clean-up after 30 days from completion, except account records still awaiting sign-in deletion. Those stay until that deletion is resolved. A failed sign-in account deletion is retried automatically and flagged to the operator before 30 days if still unresolved. Deleting an account doesn't refund a purchase. An account that runs classes holds other families' children, so we delete it by hand when you ask through the Tell us form.
• Improvement signals and practice milestones recorded before 9 October 2026: collection has stopped. Earlier events were sent to PostHog; our database cleanup does not remove them. Changing Cookie settings does not delete events already sent. You can ask us to request deletion from PostHog through the Tell us form.
• Help-chat conversations: not saved to our database; held in server memory while in use, expire after 2 hours without activity, and are removed on the next thread check. OpenAI retention is described in section 4.
• Anonymous daily and weekly totals (section 2): kept, because they identify no one. Delivery receipts expire after eight days and are removed by scheduled cleanup. Pending adult browser deliveries expire after seven days and are removed on the next queue check.
• Unused guest starting checks: kept on the device for 14 days, then removed when the app next checks for kept checks. They enter a learner's practice record only when a grown-up attaches them, with consent before upload.
• Support messages and help-chat feedback: removed by a scheduled clean-up after 24 months.
• Crash reports (section 2): removed by a scheduled clean-up after 90 days.
• Scheduled daily cleanup applies the database retention periods above, in batches; a backlog can take later runs to finish. Expired delivery receipts have a separate scheduled cleanup every 15 minutes. Browser data is removed when the relevant device next checks it, rather than by a remote timer. An interrupted round's recovery copy expires after 12 hours and is cleared when checked; this does not delete saved practice history. Our database cleanup does not delete copies held in an email inbox or a provider's logs or backups.
• Payment, refund and Coach credit records: kept as required by law, with the limited fields described above after account deletion.

9. Your rights

You can access, correct, export, or delete your data and your children's profile data — in-app where possible, or through the Tell us form. New Zealand users have rights under the Privacy Act 2020; Where UK/EU GDPR applies, rights include access, rectification, erasure, portability and objection. Where US COPPA applies, parents may review and delete a child's information and refuse further collection. We answer access and correction requests within 20 working days, or sooner where the law that applies to you requires.

10. Security

Server-side authorization on every protected endpoint, encrypted transport everywhere, play codes protected against brute force, AI keys never in the browser, and staff access limited to what support requires.

11. Changes

If we change this policy in a way that matters, we'll email account holders and show a notice before it takes effect. We will never weaken the children's-data commitments in section 2 without explicit consent.

Contact: the Tell us form · BladeMind, New Zealand.