Privacy
A child here is a first name, their work and their world. Nothing else.
No contact details, and nowhere to put one. No ads, no analytics, no tracking, nothing sold, no model trained.
Reviewing for a school? The Trust Center has it all on one page. Questions: hello@rodrimath.com — a person answers.
A child’s record
We hold
- A first name
- A username and a PIN
- A year group
- Their settings, and what they choose: a character, a companion, their world
- Their work, and what it shows they understand
We never hold
- An email address or phone number
- A date of birth
- An address or a location
- A photograph, a voice, a device identifier
- Free text. No screen a child uses accepts any.
A first name, a username, a PIN, a year group, and their work.
- Plus their settings, what they choose — a character, a companion, their own world — and what the engine works out from their answers.
- The list is enforced in code. A feature that wanted an email address would first have to remove the rule that forbids it.
- Children are not in the sign-in system at all; their PIN is hashed inside the database.
- Nothing held could be used to reach a child outside the product.
What we never do
- No targeted advertising to children. The product carries no advertising of any kind and loads no advertising or analytics SDKs.
- No unnecessary third-party data sharing. Student data is not sold, and is not disclosed to third parties except processors strictly necessary to run the service.
- Collect the minimum data necessary. Child accounts hold a display name, a username and a PIN. No email address, no date of birth, no contact details, no device identifiers used for tracking.
- Parent and student data is controllable and deletable. A linked parent can export everything held about their child, and can request erasure.
- Every administrative action is auditable. Overrides, exports, deletions, consent changes and permission changes all write an append-only audit event.
- Student-to-student communication is controlled. There is no child-to-child chat (§47), and a child cannot type anything another child will read. Where a teacher turns visiting on, classmates can visit a child’s world and leave one of six drawn stickers.
Six commitments, the same ones the privacy policy is written from. Advertise, track, sell, or train a model.
- No advertising anywhere, and no analytics or tracking script.
- The browser refuses every third-party script, so a tracker pulled in by a dependency has nowhere to load from.
- Student data is never sold or rented, shared only with the few processors that run the service, and never used to train a model.
- No child’s answer is sent to an AI service. The weekly parent email carries no tracking pixel.
The one email a parent gets each week is theirs to switch, and to read before it goes. See it, download it, delete it, stop it.
- Download everything held about your child, as a file.
- Delete it outright, or withdraw consent, which stops all collection the moment it is saved.
- All three are buttons, not requests. A school directs the same for its students.
- Everything an adult does to a record lands in a log nobody can edit, us included. No adult can write what a child knows.
A parent’s controls. Buttons, not requests.
Also true
Small facts that matter.
No child-to-child chat
Not disabled: absent. No screen a child uses accepts free text.
Kept for a bounded time
A record idle for 2 years is deleted. A deletion request is honoured within 30 days.
A short list of processors, named
Supabase, Resend and Stripe under data-processing agreements, Vercel under its standard terms, each listed with what it holds at service providers.
Consent is a record
Verifiable parental consent, or a school’s written authorisation, recorded with who gave it. A parent’s withdrawal outranks the school’s.
A person answers
Write to us; no button needed first. Rather ask than press delete? Ask.
The documents