Age and consent
- A learner profile is created without an age, and no learning data is stored against it until an age is declared.
- Where the declared age is under 13, a parent or guardian email must be supplied before any progress, diagnostic result, or answer is recorded.
- We collect birth year only, never a full date of birth. The year is enough to decide which consent rules apply; a child's exact birthday is more personal information than that purpose requires.
- The declared age is not verified. No self-declared age can be. We record what was declared, who consented, and when — and refuse to store learning data where that record is absent.
- Accounts are purchased and managed by adults. Buyers must be 18 or over.
Learners provisioned by a school
School-provisioned learners reach the same protection by a different route. The school is the consent authority under its own privacy obligations and has already obtained parental consent, so a school administrator records an attestation to that effect. We store who made it, when, and the school's own consent reference where one is supplied.
We do not ask schools for pupils' birth years. Holding a second copy of every child's date of birth would serve no purpose we could point to, and the attestation is the consent record. Until a school makes that attestation, learners imported from its roster accumulate no learning data.
What we deliberately do not collect
- No full dates of birth.
- No learner photographs, video, or biometric data.
- No location data beyond what is inherent in an IP-based web request.
- No behavioural advertising profiles. We do not sell or share learner data for advertising.
- No free-text social features. Learners cannot message each other, post publicly, or upload files.
AI safeguards
- AI is used to explain mathematics and diagnose misconceptions. It is scoped to the skill and item the learner is working on.
- The AI provider receives the learner's answer content and skill context. It does not receive learner names, email addresses, or school identifiers.
- AI-assisted output is labelled as such. See the AI safety statement.
- Voice transcription is disabled in production; no learner audio leaves the browser.
Reporting a concern
Report a child safety concern to childsafety@math.foundation. Concerns involving immediate risk to a child should go to local police or your state child protection service first — contact us afterwards so we can act on our side.
Parents and schools may request deletion of a learner's data at any time via privacy@math.foundation.
What is not yet in place
Stated plainly, because a school should not discover these during an audit.
- No formal child safety policy has been independently reviewed or endorsed. This statement describes product behaviour, not an audited governance framework.
- Riverun Pty Ltd is not currently registered or assessed under any state Child Safe Standards scheme, and no working-with-children check regime has been applied, as the product involves no adult-to-child contact.
- No age assurance beyond self-declaration. The Children's Online Privacy Code may raise this bar; we will update this page when it does.
- No privacy impact assessment has been completed for the production data model.
- No independent audit of the AI safeguards described above.
Contact
Child safety and privacy: privacy@math.foundation.