Privacy Policy

The short version

RodriMath teaches mathematics to children under 13, so this policy is written to the Children's Online Privacy Protection Act. Everything below is the detail. This is the substance.

• A child’s record holds a display name, a username, a PIN, a year group, their own settings, and the things they have chosen or earned — a character and colour, a companion and the name they picked for it from a list, and their own world. No email address, no date of birth, no address, no phone number, no photograph, no voice, no location. There is nowhere in the product to put any of them.
• We keep the answers a child gives and what those answers say about what they understand. That is what the product is for, and it is the minimum that purpose requires.
• No advertising, ever. No analytics. No tracking. No third-party script of any kind can even load — the browser is prevented from fetching one.
• We do not sell student information, and we never will.
• Five service providers see data because the product cannot run without them, and each sees only its own kind. A child’s learning record: Supabase stores it, in the database that also holds every adult account; Vercel runs the software and keeps nothing beyond short-lived logs. Adults’ email addresses: Resend delivers the email we send to adults; a message about a child carries their first name, and a progress email says what they have mastered or where they are stuck. Payments: Stripe takes the paying adult’s card, which RodriMath never sees, and receives no child’s name or anything else about a child. Read-aloud: Your own device’s speech engine speaks the words on the screen when read-aloud is used, and never a child’s name. Nobody else.
• Inside RodriMath a child’s work is seen by their parent, their teachers and, where a school has authorised it, the school. Where a teacher turns visiting on, classmates can visit a child’s world and see their first name. Nothing a child does is ever made public.
• A parent can read what we hold, stop us collecting anything more, and have it all deleted — from their own account page, without asking anyone.

Who we are, and how to reach us

RodriMath is a mathematics learning service for children in Kindergarten through Grade 5.

The Children's Online Privacy Protection Rule requires this notice to carry our name, postal address, telephone number and email address. At the time of this version we have not yet published the legal entity name, a postal address, a telephone number, and this notice says so rather than leaving the requirement quietly unmet. Everything below is complete, and the missing details will appear here before RodriMath is offered beyond its current pilot. In the meantime, email reaches a person and is answered.

Write to us about anything on this page and a person will answer. You never need to use a button in the product first: if you would rather ask us to delete your child's record than press "delete" yourself, ask.

• Operator: RodriMath.
• Email: hello@rodrimath.com
• Website: rodrimath.com

Who this policy is for

It covers everyone who uses RodriMath: the children who learn on it, the parents and guardians who set them up, and the teachers, tutors and administrators who use it with children.

Where a school or district has authorised RodriMath for its students, the information about those students is also the school's education record, and the School and District Terms describe the additional commitments we make to the school. Where the two documents differ about student information, those govern.

What we collect from a child

A child's account record holds these things and nothing else about them. The list is built from the one the code enforces, and a field whose name looks like personal information is rejected outright. Alongside them the system keeps the child's PIN, only as a scrambled hash, and the dates it needs to run the retention policy below: when the record last changed, whether their school has archived them, and when it is due to be deleted.

• An internal identifier. Not derived from anything about the child, and meaningless outside RodriMath.
• The name shown on screen. A first name is what we ask for.
• What they type to sign in. Chosen by the adult who set the account up.
• The year group they are in — not their age, and not their date of birth.
• Their character and colour, their companion and the name they picked for it from a list, and their own world: the house and place they chose, what they have planted, baked, built, worn and arranged there, the drawn card classmates see when they visit, and their best runs in its games.
• Their own settings for how RodriMath looks and sounds, such as larger text, reading aloud, the language they read in and how loud the sounds are.
• When the account was created.
• When they finished the starting assessment, if they have.
• Which of the one-time introductions they have already been shown, so the app does not greet them as new twice. Four dates and nothing else — it does not record how long anything took, how often they sign in, or how long they have been away.

What a child’s record never holds

No email address. No date of birth or age — only the year group they are enrolled in. No home address, no telephone number, no contact details of any kind. No photograph, no voice recording, no biometric identifier of any sort. No location, no IP address in any record about them, and no device identifier used to recognise or track them. The "home country" in a child's world is a place in the game, and the card classmates see is a drawing.

This is not a setting that could be changed. The database has no column for any of it, a check in the code fails the build if one is added, and a child signs in with a username rather than an email address precisely so that there is no route to them from outside the product.

We also do not collect the political or religious affiliation, voting history or biometric information of a child or of their parents or siblings. Florida law (s.1002.222) forbids Florida's public schools, and those acting for them, to collect it, and we have no capacity to gather it in any case.

What else we collect, and why

Beyond the account record, RodriMath holds what a child does while they are learning, and what the engine works out from it. This is the whole purpose of the product: it cannot teach a child what comes next without knowing what they already understand.

Concretely, for each answer we record: which question was asked and which skill it practises, whether the answer was right, which misunderstanding a wrong answer points at, how long it took, whether a hint was used, how sure the child said they were when we asked, and when. We also keep where they are in each lesson, their starting assessment, the lessons a teacher has opened early for them, their daily missions, and when each session started and ended.

From those we derive estimates: how well a skill is known, which particular misunderstanding keeps recurring, when a skill should come back for review, and which year group's material fits the child now. These are inferences about a child's understanding, and we treat them as personal information about that child even though a child never typed them.

We keep the classes a child is in and has been in, the work their teachers set them, the small groups a teacher puts them in for extra help, and the join requests and requests to open work early that were made about them. We keep their best runs in the games — the Gauntlet's score and streak among them — and the stickers they have left and been given.

They are used to choose what to teach next, to show the child's own parent and teachers how they are getting on, and to keep the child's world and games as they left them. They are used for nothing else. They are not used to build a profile for any commercial purpose, they are not sold, and no artificial-intelligence model is trained on them or sees them.

One comparison uses other children's records: a parent can see roughly where their child stands among children in the same year group. It is worked out from all those children together, never shown for fewer than five, and never names or singles out anybody.

What we collect from adults

Your name, your email address, your role and, if you give one, your job title, the organisation you belong to, when you last signed in, and your own display and notification preferences. When you create an account we also record which version of these documents you accepted and the statement you confirmed about who you are.

If you pay, your household or account, the plan, how many seats it covers and what happened to each payment — the card itself is held by our payment processor, never by us. If you invite someone, their email address, so the invitation can reach them.

If you write to us — a support question, or a school's enquiry with a name, role, email address and telephone number — we keep what you sent until it is settled and then for the time given below. When a school buys RodriMath we keep the name and role of the person who authorised it and of whoever countersigned its purchase order, in the audit log, because a school's authorisation has to name the person who gave it.

A teacher's email address is held as a work address. Parents never see it, and teachers never see a parent's — publishing staff contact details to every linked family is a school's decision to make, not ours.

A closed support request is deleted after 120 days, and a settled enquiry from a school after 365. An adult's account is kept while it is open; when it is closed, the record of what that person did stays in the audit log.

Cookies, and what we keep in your browser

RodriMath sets a small number of cookies it needs to work and nothing else. There is no advertising cookie, no analytics cookie and no third-party cookie anywhere in the product, because there is no advertising, no analytics and no third-party code.

A child signing in receives one cookie holding an internal identifier and an expiry time, signed so it cannot be altered and marked so that no script can read it. It lasts a school day, and a child still at the screen when it runs out is asked if they are still there and can carry on — which is why a shared classroom tablet should be signed out at the end of a lesson. An adult signing in receives a session cookie from our sign-in provider, marked the same way, which expires if it is not used. An invitation link sets a cookie so the invitation survives signing in, which expires within a month, and RodriMath's own staff pages keep one preference of their own.

The browser also keeps a few small notes for the page itself. On a child's device it remembers where they were standing in their world, so they start there next time: two numbers, filed under an internal identifier and no name. On a teacher's screen it remembers the lessons they opened recently, and — for the length of a tab — a half-finished piece of work being set, which holds its title, its instructions and the internal identifiers of the children ticked, and no names. On any page, for the length of a tab, it notes the time an error page last reloaded, so that it cannot reload itself in a loop.

The scratch pad a child draws their working on is never saved, never sent anywhere, and never seen by the engine — it is a piece of paper, and it is thrown away like one.

Who else receives information, and why

We do not sell student information. We do not share it for advertising. We do not disclose it to anyone for any purpose of their own.

Inside RodriMath, a child's information is seen only by the people who need it to teach them or to look after them:

Their parent or guardian, and any other adult that parent invites into their household on RodriMath.

The teacher of each class they are in. A class a school or district has authorised is covered by that authorisation; any other class — a tutor’s, or a teacher’s outside a school — takes a child only when their parent approves it, and the parent is told which adult will see their work.

Where a school has authorised RodriMath, that school’s administrators.

Their classmates, only where the class’s teacher has turned visiting on and the child’s door is open: a classmate who visits sees their first name, their companion’s name and the drawings of their world. Never their answers, their progress or anything they have mastered.

A few people at RodriMath, only to run the service, answer a request or keep it safe.

Five service providers process information for us, because the product cannot run without them. Supabase, Resend and Stripe each process information only on our instructions, under a data-processing agreement that forbids any use of their own. Vercel runs the software under its standard terms of service. These are all of them, and the current list is always published at rodrimath.com/legal/subprocessors.

• Supabase (Supabase Pte. Ltd.) — the database, and adult sign-in with its own emails that confirm an address or reset a password. It holds everything described in the Privacy Policy. The data is stored in the United States, in Ohio.
• Vercel, Inc. — application hosting, and the scheduled jobs that delete expired records and send the progress emails. Requests pass through it; nothing is stored beyond short-lived operational logs. United States: the software runs in Cleveland, Ohio.
• Resend (Plus Five Five, Inc.) — delivery of the email RodriMath itself sends, all of it to adults: decisions about an account, invitations, notices that somebody is waiting for an answer, consent and erasure receipts, replies to support questions and enquiries, a school's authorisation request, purchase orders and invoices for a school's office, the notices about a plan — its confirmation, the notices before it renews, the yearly reminder on a monthly plan, a change of price, the receipt when a child comes back from a break, and the end of the free days — and the progress emails: the weekly summary, and alerts when a child masters something or is stuck on the same thing. Progress emails are on unless the adult turns them off in their settings. Resend receives the recipient's address and the message. A message about a child carries that child's first name, and a progress email says what they mastered or where they are stuck. It receives no answer a child gave and no identifier beyond the first name in the text. Open and click tracking are switched off, and the product will not send if it can see that they are on. United States.
• Stripe, Inc. — payments. A parent or a tutor who chooses a plan is sent to Stripe’s own page, and RodriMath never sees the card: Stripe receives the paying adult’s email address, the amount, a household or account reference and, for a household, the number of children the plan covers. A school that pays an invoice by card or bank debit does so on Stripe’s page too, and Stripe receives the school’s name, its billing email address and the purchase-order references. It receives no child’s name and nothing else about a child. Stripe tells RodriMath what happened — paid, failed, stopped — and RodriMath keeps one sentence per event, never the payload. United States.
• The viewer’s own browser speech engine — the words on the screen, when read-aloud is used: questions, lesson steps, stories and the world’s moments. Provided by the device or its browser maker. We ask for a voice that runs on the device wherever one exists; on some devices the only voice is one the browser maker provides over the network. A child’s name is never read out, and nothing identifying the child accompanies the words.

How long we keep it — our written retention policy

The Children's Online Privacy Protection Rule requires an operator to have a written retention policy, to publish it, and to follow it. This is it. The same figures are the ones the nightly deletion job runs on, so what you read here is what actually happens rather than an account of it.

We collect what is described above in order to teach a child mathematics and to report their progress to their own parent and teacher. We keep it while it is needed for that purpose, and the periods below are what that comes to.

• A child's whole record — their account and everything they have done — is deleted after 730 days without learning activity. That is two school years: long enough that a child returning after a summer, or a year out, still has their progress; short enough that nothing accumulates indefinitely. It applies to every child, including one whose household's plan has lapsed.
• Where a state sets a shorter window, that window applies. In Florida, a child's record is deleted 90 days after their school tells us they have left, unless a parent expressly asks us to keep it. That is the limit Florida Statutes s.1006.1494 sets. A parent can ask from the child's card on their Family page, and change their mind at any time; a kept record still follows the 730-day rule above.
• The individual answers a child gave are deleted after 400 days, whether or not the child is still active, and so is the day-by-day record of their sessions and daily missions — except their latest session, which is what the two-year rule above is measured from. What survives is the summary of what they understand, which is what the teaching needs.
• A sticker one child leaves on a classmate's porch is deleted after 180 days.
• A deletion you ask for is completed within 30 days. In practice it happens immediately, and the 30 days is the outside limit rather than the intention.
• The audit log is kept for at least seven years, and nobody using RodriMath can edit or remove an entry in it, including us. It identifies a child only by an internal number, never by name or username, so once a child's record is deleted what remains says only that something happened to a record, when, and at whose request.

How a parent gives consent — and takes it back

A child's record is only active where there is a lawful basis for it, and RodriMath records which one applies to each child. Without one the child cannot sign in and nothing is collected. This is enforced at three separate points, not merely recorded.

Where a family signs up directly, the child's parent or guardian gives consent themselves, from an account whose email address they have confirmed. Before a child's account is created we show them our Notice to Parents — what we collect, why, who sees it, how long we keep it and what they can do — and ask them to tick a box saying they have read it, are the child's parent or guardian, and agree. We then email them a confirmation of what they agreed to, and how to withdraw it at any time. We do not use the child's own details for any part of this, because the child has none.

Where a school or district signs up, an administrator of the school or district authorises RodriMath for its students, and that authorisation covers the educational purpose the school approved and nothing else — never anything commercial, never anything unrelated to teaching. We record who gave it, in what role, on what date and against which version of the School and District Terms, so it is a record rather than an assumption.

A class that no school has authorised — a tutor's, or a teacher's own — takes a child only when their parent approves it. The parent is told which adult will see their child's work, and can agree to RodriMath without agreeing to any such class. A child's own request to join one goes to their parent first, and its teacher sees nothing about the child until the parent agrees. A parent can take their child out of such a class at any time, from the child's card, and their approval is recorded as the words they agreed to. Only a school or district can authorise RodriMath for its students, and its authorisation covers the children in its classes and those who left them in the last 90 days.

A parent may withdraw consent at any time from their own account page. Withdrawal stops collection immediately: the child can no longer sign in, and no further answers are recorded. What is already held stays until it is deleted, which is a separate button beside it, because stopping and erasing are different decisions and a parent may want one without the other.

What a parent can do, and how

A parent linked to a child can do all of this from their own account page, immediately, without asking us or anyone else:

• Review everything held about their child, as a file they can download, open and read: the account record and its dates, their world, their answers, the derived understanding, lessons, sessions and missions, every class they have been in and what was set for it, their household, the requests and invitations made about them, and the audit entries that name them. Where a child has more answers, sessions or audit entries than the file holds, it says so, and we send the rest on request.
• Stop any further collection, by withdrawing consent.
• Have everything deleted. This cannot be undone, so the product asks you to type the child’s name before it will do it.
• Turn off the progress emails, or any other email that is not about their account.
• Decide whether classmates may visit their world: their door stays closed until they or you open it.
• Ask a person instead, at hello@rodrimath.com. We would rather answer a question than have somebody press an irreversible button they were not sure about.

Your rights, wherever you live

Whichever state you live in, you can ask us what we hold about you or your child, ask us to correct it, ask us to delete it, and ask us to stop collecting it. We answer within 45 days, and usually the same day. We will not treat you differently for asking.

We do not sell personal information, we do not use it for targeted advertising, and we do not profile a child for anything but teaching them mathematics. If you are not satisfied with our answer, you can complain to your state's attorney general, and in the case of a child's information, to the Federal Trade Commission.

What a child can and cannot do with other children

There is no chat and no messaging, and a child cannot type anything that another child will read. That is not a feature we have switched off; it is one we have never built, and will not.

The one thing a child can do with a classmate is visit their world, where the class's teacher has turned visiting on and the classmate's door is open — and leave one sticker, chosen from six we drew. A sticker shows the visitor's first name, and is deleted after 180 days. A door is closed until the child or their parent opens it, and when a teacher turns visiting on we email each parent in the class to say so.

A teacher can give a child work with a title and instructions the teacher wrote. That is the only text an adult can send a child in RodriMath, and a child cannot reply to it.

What nobody can do, including us

No role in RodriMath can write to a child's mastery record. Not a teacher, not a parent, not an administrator, not us. Only the engine records what a child knows, and only when the child has actually met the standard. An adult can open content ahead of the sequence, and that is recorded as an override against their name — but it does not touch the academic record, because a record an adult can adjust stops being evidence of what the child can do.

Nobody using RodriMath can edit or remove an entry from the audit log. The database refuses it.

How we keep it safe

Information is encrypted in transit and encrypted at rest. Adult passwords and children's PINs are stored only as scrambled hashes, never as written; a child's PIN is shown once, on the sign-in card printed when it is set. Repeated wrong sign-in attempts are rate-limited, and a failed attempt reveals nothing about whether the account exists.

Who may see what is decided by a permission matrix enforced in code. A teacher sees the children in their own classes and no others. A parent sees the children in their own household. New teacher accounts are checked by a person before they can see any child's work. Every administrative action — an unlock, an export, a deletion, a change of permission — writes a record that cannot afterwards be altered.

We maintain a written information security programme covering all of this. It is reviewed when the product changes materially, and at least once a year.

If something goes wrong

If personal information is exposed, we will tell the people affected without unreasonable delay and no later than 30 days after we determine, or have reason to believe, that it happened, as Florida law requires. Where 500 or more people in Florida are affected we will also notify the Florida Department of Legal Affairs.

Where the information belongs to a school's students, we will notify the school within 72 hours of confirming it — well inside the 10 days Florida law allows — and give it what it needs to meet its own obligations. The school decides who tells its families, and we will do it for them if they ask.

A notice from us will say what happened, what information was involved, what we have done about it, and what you should do — in plain words, without minimising it.

Schools, and student records

Where a school or district uses RodriMath, information about its students forms part of that school's education records. We act as a school official with a legitimate educational interest, under the school's direct control for the use and maintenance of those records, and we use them only to provide the service the school asked for. We do not disclose them onward.

Parents exercise their rights over school records through their school, and a school administrator can download a student's record from their own dashboard to answer them: everything held about the student in the school's own classes, and their learning, leaving out only what belongs to the child's household. The full arrangement, including deletion at the school's direction and at the end of an agreement, is in the School and District Terms.

Things we will never do

These are commitments rather than current practice that might quietly change. Each is also enforced in the software, which is the difference between a promise and a property.

• No advertising of any kind, ever — targeted, contextual or otherwise.
• No analytics, tracking or advertising software. The product loads no third-party script at all: the security policy it sends with every page permits no external source, so one cannot be added by accident.
• No sale, rental or trade of student information.
• No profile of a child built for any purpose other than teaching them mathematics.
• No streak that punishes a missed day, no score that can be lost, no leaderboard, and no notification designed to pull a child back to the screen. Time spent is not a measure of success here and is never treated as one. A few games have a clock for the fun of a run; a child’s “No rush” setting takes every clock away, and no lesson, check or test is ever timed.

Where this applies, and in what language

RodriMath is offered in the United States. It is not directed to anyone outside the United States, and we do not knowingly provide it to them.

A child can read RodriMath in English or Spanish. These documents are in English. We know that a notice a parent cannot read is not a notice, so if you would like any of this explained in Spanish, write to us and we will answer in Spanish.

Changes to this policy

This version is dated 2026-09-30. When we change how we use information in a way that matters, we do not rely on a quiet edit: every adult is asked to read and accept the new version before they can continue to use the product, and we record which version each account accepted and when.

Where a change would materially alter what we collect from children or what we do with it, we will obtain consent again rather than treating silence as agreement.