Privacy Policy

1. What personal information we collect and why

1.1 Buyer enquiries and school rollout planner (/api/school-onboarding)

When you use the school rollout planner, submit school onboarding details, or send a buyer enquiry, we collect the following information:

The legal basis for processing this information is your consent, given at the point of form submission. We do not pre-tick consent boxes. You may withdraw consent at any time by emailing liam@math.foundation.

Do not enter student personal information in the school rollout planner or buyer enquiry form. Those forms are for educators, parents, guardians, school leaders, and account holders only.

1.2 Learner accounts on app.math.foundation

The Math Foundation application at app.math.foundation uses server-side learner accounts. This is a separate system from the demo and lesson pages on this marketing site, which remain browser-local (see section 2). Data held on our servers for an application account may include:

Records are stored in a managed PostgreSQL database (Neon) used only by Math Foundation. Schools, districts and families are separated by tenant boundaries enforced on the server.

Children do not create their own accounts. A learner profile for a minor is created by a supervising adult — a parent, guardian, or a teacher acting under the school's own privacy obligations — who provides consent at the point of creation. Schools using roster import or automated provisioning are responsible for obtaining the parental consents their jurisdiction requires before adding students.

Where a school connects its own identity provider (Microsoft Entra ID or Google Workspace) for staff sign-in, or enables automated user provisioning, we receive the account identifiers and group memberships that the school chooses to send. Where a school connects a learning management system for grade passback, we send mastery results back to that system at the school's direction.

This section describes the application as built. It has not yet been reviewed by privacy counsel, and no independent privacy impact assessment has been completed. Riverun should complete both before the application is opened to learners outside a supervised pilot.

1.3 Information we do not collect

We do not collect payment card details directly. Paid checkout is handled by Stripe, a PCI-DSS compliant payment processor. We receive limited billing metadata such as plan, checkout session ID, payment status, receipt/invoice link, and the email address needed for onboarding and support. We do not purchase third-party marketing lists or profile users from external sources.

2. Local browser storage — what stays on your device

This section applies to the demo, lesson and diagnostic pages on this marketing site (math.foundation) — not to application accounts on app.math.foundation, which are covered by section 1.2.

The demo and lesson pages on this site store learner progress entirely in your browser using the browser's built-in localStorage API. Progress created on these pages does not leave your device unless you explicitly export a pilot packet (see section 4) or separately create an application account.

Data that may be stored locally includes:

• Learner name (or initials, at the user's discretion)
• Demo and exercise progress — questions attempted, answers given, misconception tags
• Family profiles — up to 6 named learner profiles per browser instance
• XP (experience points), streaks, and badges earned during practice sessions
• Mastery gate attempts and placement score
• Skill progress markers and spaced-review queue state
• Consent status and version recorded at profile creation

You can clear this data at any time by clearing your browser's local storage (browser Settings → Privacy → Clear browsing data → Cached/stored data). Clearing your browser data is permanent and cannot be undone by us because we have no copy of it.

Because this data is stored only in your browser, we are not a "controller" of it in the GDPR sense until it is transmitted to our servers. We recommend that shared-device users (e.g. school computer labs) clear local storage after each session.

3. Voice processing

Math Foundation offers a voice-input feature so learners can speak their answers rather than type them. We take a privacy-first approach to voice:

3.1 Browser speech recognition

Where supported, the learner's browser speech recognition API (e.g. Web Speech API) is used. Audio is processed by the browser itself or by the browser vendor's servers under the browser vendor's own privacy policy. We receive only the transcribed text string — not the raw audio.

3.2 On-device Whisper (whisper-tiny.en)

As an alternative to browser speech, Math Foundation may offer local inference via whisper-tiny.en, a small automatic speech recognition model that runs entirely within your browser using WebAssembly. When this mode is active:

• Audio is captured from the microphone and processed entirely on your device.
• No audio data is transmitted to our servers or any third-party server.
• Only the resulting text transcription is used to evaluate your answer.
• The Whisper model weights are downloaded once from a content delivery network and then cached locally. No user data is sent during inference.

3.3 What we receive

Regardless of the voice mode in use, the only information that may be sent to our servers is the text transcription of the learner's answer (e.g. "forty-two"), treated the same as a typed answer. We do not store, analyse, or share audio recordings.

3.4 Microphone permission

Your browser will ask for microphone permission before voice input is activated. You can revoke this permission at any time in your browser or device settings. Voice features are entirely optional — the product works fully without a microphone.

4. Pilot packet exports and consent versioning

4.1 Pilot packet contents

Educators and testers may export a "pilot packet" — a downloadable file containing a snapshot of a learner's local session. The packet includes:

• Learner profile data stored in local storage (name or initials, role, goal)
• Skill progress, mastery gate results, and misconception tags
• Spaced-review queue and telemetry counters (number of attempts, time-on-task estimates)
• Teacher intervention signals generated during the session
• Consent version field recording which privacy policy was acknowledged

This privacy policy was published under consent version privacy-2026-08-14. Records created before 14 August 2026 carry the version that applied at the time. Pilot packets exported from the alpha lab additionally carry their own pilot-consent version — currently alpha-pilot-2026-06-12 — stamped into each export so that schools can maintain compliant records of when consent was given and which policy applied.

4.2 Handling exported packets

A pilot packet is a file on your device. Once exported, it is your responsibility to handle it in line with your school's or organisation's data governance obligations. We recommend:

• Only exporting packets after parent, guardian, or school consent has been obtained.
• Using first names or initials rather than full names in roster fields during the alpha.
• Storing exported packets securely and deleting them when no longer needed.

We do not receive, store, or process pilot packets unless you email them to us as part of a support request, in which case they will be used only to diagnose the reported issue and deleted within 30 days.

5. Children's data and parental consent

Math Foundation is intended for learners of all ages, including children. We apply additional protections when learners are under 18 years of age.

5.1 Age gating

The checkout, onboarding, and school rollout planner forms require the submitting adult to identify their role where relevant (parent, tutor, teacher, or school administrator).

On app.math.foundation, a learner profile is created without an age and no learning data is stored against it until an age is declared. Where the declared age is under 13, a parent or guardian email must be supplied before any progress, diagnostic result or answer is recorded.

Learners provisioned by a school reach the same point differently. The school is the consent authority under its own privacy obligations and has already obtained parental consent, so a school administrator records an attestation to that effect and we store who made it, when, and the school's own consent reference if they supply one. We do not ask schools for pupils' birth years. Holding a second copy of every child's date of birth would serve no purpose we could point to, and the attestation is the consent record. Until a school makes that attestation, learners imported from its roster accumulate no learning data.

We collect birth year only, never a full date of birth. The year is sufficient to determine which consent rules apply, and a child's exact birthday is more personal information than that purpose requires.

The declared age is not verified. No self-declared age can be. We record what was declared, who consented, and when — and refuse to store learning data where that record is absent. Age assurance beyond self-declaration is a separate question, and one the Children's Online Privacy Code may address (see section 5.3).

5.2 What parental consent covers

When a parent or guardian sets up a profile for a child, they consent on behalf of that child to:

• Storage of learner progress data in the Math Foundation service.
• Processing of voice input (text transcription only, audio not stored).
• Disclosure of that child's individual progress to their teacher and school where the child is enrolled in a Classroom, School or District plan. This is not anonymised or aggregated: a teacher sees the named learner alongside their classmates in a skill heatmap, including which skills are mastered, in progress or flagged for review, and which misconceptions were recorded. That is the purpose of the teacher dashboard, and a guardian consenting to an institutional plan is consenting to it.
• Processing of the learner's answers by an artificial-intelligence provider outside Australia, where a wrong answer cannot be diagnosed from our own misconception maps. See section 6.1.

We will not use a child's data for advertising, behavioural profiling, or any purpose beyond delivering the Math Foundation education service. We will not sell a child's personal information under any circumstances.

5.3 Alpha period

Learner progress created on this marketing site's demo and lesson pages stays on the device (see section 2), and is transmitted to us only when a supervising adult exports a pilot packet. Learner data created in an application account on app.math.foundation is stored on our servers as described in section 1.2.

Schools and families using either surface with students should obtain the parental consents their jurisdiction requires before doing so, consistent with their own privacy obligations. The Office of the Australian Information Commissioner's Children's Online Privacy Code is due to be registered by 10 December 2026 and is expected to apply to educational services likely to be accessed by children; Riverun should obtain specialist advice on its application to Math Foundation rather than relying on this policy alone.

5.4 Australian law

The handling of children's personal information is subject to the Australian Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs), in particular APP 3 (collection of solicited personal information) and APP 6 (use or disclosure). We treat all student data with the same care as sensitive information under APP 6.

6. How we share information

We do not sell, rent, or trade personal information with third parties for their own marketing or commercial purposes.

We may share personal information with:

• Service providers acting as our processors — named individually in section 6.1. These providers are bound by contractual obligations to process data only on our instructions and to maintain appropriate security.
• Schools and educators — where a learner is enrolled in a Classroom or School plan, the educator managing that account can see that learner's progress within Math Foundation. We do not share learner data with other schools or third parties outside the account.
• Legal obligations — if we are required by law, regulation, court order, or government authority to disclose personal information, we will do so and, where legally permitted, notify the affected individual.
• Business transfers — if Riverun Pty Ltd is acquired, merged, or its assets transferred, personal information may be transferred as part of that transaction. We will notify users via email or a prominent notice on this site before personal information is transferred and becomes subject to a different privacy policy.

6.1 Our subprocessors, and where data is processed

Math Foundation is operated by Riverun Pty Ltd in Australia. Several of the services we depend on process data outside Australia. Under Australian Privacy Principle 8 (cross-border disclosure) we set out below who they are and what they receive.

What this means in practice. When a learner's wrong answer cannot be explained by our own misconception maps, the answer text and the skill identifier are sent to Anthropic to generate an explanation. We do not send the learner's name, email address, or account identifier with it. The response is cached so the same wrong answer is not sent again.

We do not use children's data for advertising, we do not sell it, and we do not permit any provider above to use it to train their own models on our instruction.

Under review. The characterisation of these transfers under APP 8, and whether additional contractual measures or consents are required for each, is being reviewed with privacy counsel. This table describes what the system does today; it is not a legal conclusion that the arrangement is compliant.

7. Data retention

Where applicable law requires a shorter retention period, we will comply with that requirement. You may request earlier deletion at any time under section 9 or section 10 below.

8. Security

We implement reasonable technical and organisational measures to protect personal information against unauthorised access, loss, or disclosure. These include encrypted connections (HTTPS/TLS) for all data in transit, access controls limiting who within Riverun Pty Ltd can access personal information, and regular review of our security practices.

No transmission over the internet or electronic storage system is completely secure. If you have reason to believe your interaction with us is no longer secure, please contact us immediately at liam@math.foundation.

In the event of a data breach affecting your personal information, we will notify you and, where required, the Office of the Australian Information Commissioner (OAIC) in accordance with the Notifiable Data Breaches scheme under the Privacy Act 1988.

9. Your rights — Australian Privacy Act 1988

Under the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs), you have the following rights:

• Access (APP 12): You may request access to the personal information we hold about you. We will respond within 30 days and, where reasonable and practicable, provide access in the format you request.
• Correction (APP 13): If personal information we hold is inaccurate, out of date, incomplete, irrelevant, or misleading, you may ask us to correct it.
• Anonymity (APP 2): Where lawful and practicable, you may interact with us without identifying yourself. The alpha demo is fully available without any account or name.
• Complaint to OAIC: If you are not satisfied with our handling of your personal information or our response to a complaint, you may contact the Office of the Australian Information Commissioner at oaic.gov.au or call 1300 363 992.

To exercise any of these rights, email liam@math.foundation with the subject line "Privacy Request". We may ask you to verify your identity before acting on your request.

10. Your rights — EU and UK (GDPR / UK GDPR)

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, the General Data Protection Regulation (GDPR) or UK GDPR may apply to the processing of your personal data. In addition to the rights described in section 9, you have:

• Right to erasure ("right to be forgotten"): You may ask us to delete your personal data where it is no longer necessary for the purposes for which it was collected, or where you withdraw consent and no other legal basis applies.
• Right to restriction of processing: You may ask us to pause processing of your data in certain circumstances.
• Right to data portability: You may ask for a copy of personal data you provided to us in a structured, machine-readable format.
• Right to object: You may object to processing based on our legitimate interests.
• Right to withdraw consent: Where we rely on your consent as the legal basis for processing, you may withdraw it at any time without affecting the lawfulness of processing before withdrawal.

Legal basis for processing under GDPR: For buyer enquiry and school onboarding data, the legal basis is consent (Article 6(1)(a) GDPR) and, where you buy a plan, contract performance (Article 6(1)(b)). For production learner accounts, the legal bases will be contract performance (Article 6(1)(b)) and, for children's data, explicit parental consent (Article 6(1)(a) and Article 8).

Cross-border transfers: Riverun Pty Ltd is based in Australia. Australia is not currently the subject of an EU adequacy decision. If you are located in the EEA or UK, your personal data is transferred to Australia. We rely on Standard Contractual Clauses (SCCs) or equivalent safeguards where applicable. You may request a copy of applicable transfer mechanisms by contacting us.

To exercise GDPR rights, email liam@math.foundation. You also have the right to lodge a complaint with your local data protection authority (e.g. the ICO in the UK at ico.org.uk, or your national supervisory authority in the EEA).

11. Cookies and tracking

Math Foundation uses minimal tracking. Specifically:

• We do not use third-party advertising cookies or cross-site tracking pixels.
• We may use a lightweight, privacy-respecting analytics tool to count page visits and measure which features are used, without identifying individual users. Any such tool is configured with IP anonymisation and without persistent cross-site identifiers.
• Buyer enquiry, checkout onboarding, and school rollout planner forms record the source page URL and user agent string for fraud prevention and duplicate detection. These are not used for advertising.

If and when we introduce additional cookies, we will update this section and, where required by law, obtain your consent before setting them.

12. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes — for example, introducing server-side learner accounts, adding new data processors, or changing how voice data is handled — we will:

• Update the "Effective date" at the top of this page.
• Post a notice on math.foundation for at least 30 days.
• Where we have your email address, send you a notification.
• Increment the consent version identifier so that any data collected after the change carries the new version.

Your continued use of Math Foundation after the effective date of a revised policy constitutes your acceptance of the revised terms. If you do not agree, you may request deletion of your data as described in sections 9 and 10.

13. Contact and complaints

For any privacy question, access request, correction request, or erasure request, contact:

Riverun Pty Ltd
ABN 65 663 364 154
Ocean Grove, Victoria, Australia
Email: liam@math.foundation

We aim to respond to all privacy requests within 10 business days and to resolve them within 30 days. If we cannot respond within that time we will let you know and give you an expected resolution date.

If you are not satisfied with our response, you may escalate to:

• Australia: Office of the Australian Information Commissioner — oaic.gov.au, 1300 363 992
• UK: Information Commissioner's Office — ico.org.uk
• EEA: Your national data protection supervisory authority