Privacy Policy

Ready Steady Math is operated by LEGAL_ENTITY_NAME ("we", "us"), based in New Zealand. This policy explains what we collect, why, and the choices you have. We've written it in plain English on purpose — if anything is unclear, ask us at SUPPORT_EMAIL.

The short version

• Children never create accounts, never enter an email, and are never shown ads. Kids play using a play code — a credential that contains no personal information.
• Grown-ups (parents, guardians, teachers) hold the accounts, make the purchases, and control everything about a child's data.
• We use analytics to improve the product, with a hard split: no third-party trackers, no session recordings, no advertising tools ever run on children's screens. What we do measure about children's play is listed — completely — on our What We Record About Your Child page.
• We never sell personal information. We never use children's data for advertising or profiling.

1. Information grown-ups give us

• Account details: your email and sign-in credentials (managed by our authentication provider, Clerk).
• Child profiles you create: a display name (a first name or nickname you choose), an age band or school year, and an avatar. We don't ask for a child's surname, birthdate, photo, school, or contact details.
• Purchase details: handled by Stripe. We receive confirmation of what was purchased and a payment reference — we never see or store card numbers.
• Messages you send us: support tickets, chat messages, and survey answers you choose to give.
• Parent contact details a teacher adds (optional classroom feature): a teacher may add a parent's email solely so we can send that teacher's class updates to the parent. The teacher can remove it at any time, and every such email includes an unsubscribe link. We use it for nothing else.
• Testimonials/proof: only with your separate, explicit consent, and you can withdraw it at any time by emailing us.

2. Information about children's practice

Ready Steady Math is local-first: practice data lives on your device first, and syncs to our backend (Convex) so progress follows the child across devices under your account.

For each child profile we record practice data: which questions were answered, whether they were correct, how long answers took, sessions and rounds played, streaks, badges earned, and which facts the practice engine should serve next. This is the product working as described — it's how progress reports, coaching, and the adaptive engine function.

We also record a small set of designed improvement signals on children's screens — for example taps on non-interactive areas (a sign a screen is confusing) or rounds abandoned partway (a sign something isn't working). These are described item-by-item on the What We Record About Your Child page. They are pseudonymous, we discard IP addresses on receipt, we analyse them only in aggregate, and we delete them after 12 months.

What we deliberately do NOT do on children's screens: no third-party analytics scripts, no session recording or screen capture, no advertising or tracking pixels, no free-text collection, no location collection, no behavioural profiles beyond learning progress.

3. The AI Coach (adult-controlled)

If you use the AI Coach, your child's practice data (as described above, plus profile display name and year level) is processed by our AI provider (OpenAI) server-side only to produce reports and plans for you. This happens only after you, the account-holding adult, give explicit consent in the app. AI outputs are checked against child-safety rules before display. We don't allow our AI providers to train on your data.

4. Analytics on grown-up and marketing pages

On our marketing site and grown-up areas (never children's screens) we use PostHog, hosted in the EU, to understand usage, errors, and where our pages fail people: page views, clicks, funnels, and (only if you consent via the cookie notice) session replays with all text inputs masked. You can decline non-essential analytics and everything still works.

5. Who processes data for us

Vercel (hosting), Convex (database/sync), Clerk (authentication), Stripe (payments), OpenAI (AI Coach, server-side), PostHog EU (analytics), Resend (email delivery). Each processes data only to provide their service to us, under their data-processing agreements. Some are located outside New Zealand; where they are, we rely on their standard contractual safeguards.

6. Emails

• Service emails (receipts, sprint progress you opted into at enrollment, checkpoint reports, weekly summaries you enabled, a teacher's class updates): sent because you use the product; each type can be switched off in settings or via its unsubscribe link.
• Marketing emails: only if you opted in, and every one has one-click unsubscribe that takes effect immediately.

7. Retention & deletion

• Account and practice data: kept while your account is active. Delete a child profile or your account in the app (or by emailing us) and associated personal data is deleted from our systems within 30 days, excepting records we must keep (e.g., tax/purchase records).
• Child improvement signals (section 2): 12 months, then deleted.
• Support messages: 24 months.
• Payment records: as required by law.

8. Your rights

You can access, correct, export, or delete your data and your children's profile data — in-app where possible, or by emailing SUPPORT_EMAIL. New Zealand users have rights under the Privacy Act 2020; UK/EU users have GDPR rights (access, rectification, erasure, portability, objection); US users under COPPA may review and delete a child's information and refuse further collection. We answer within 20 working days.

9. Security

Server-side authorization on every protected endpoint, encrypted transport everywhere, play codes protected against brute force, AI keys never in the browser, and staff access limited to what support requires.

10. Changes

If we change this policy in a way that matters, we'll email account holders and show a notice before it takes effect. We will never weaken the children's-data commitments in section 2 without explicit consent.

Contact: SUPPORT_EMAIL · LEGAL_ENTITY_NAME, New Zealand.