What we keep, where, and for how long.

In short

• Without an account, your child’s name, answers and record stay in your browser, on your device. The app does not send them to us. The trial needs no account.
• A family account is optional, and only for a parent. If you create one and confirm your email, each child’s first name, age and learning record are copied to our server so they follow your child between devices. Children have no logins.
• Stripe takes payments. It receives your email and card details, never anything about your child. We never see your card number.
• From inside the app we receive only anonymous counts: no name, no age, and no identifier that lasts beyond the visit.
• On the public pages we count visits in our own log, against a random identifier for the browser. No names, no email addresses, nothing anyone types.
• Google Analytics is switched off inside the app. On the public pages it is used only when switched on, with Google’s advertising features off.
• If you reserve a plan or answer our parent survey, we keep what you chose to send, outside the public website, for the periods below.
• We do not sell or rent personal information, and we do not use it for advertising.

What stays on your device

The app keeps everything about a learner in this browser’s local storage on your own device. That includes each learner’s first name, age in years and colour; their placement, answers (up to the last 5,000), sessions, and the status of each idea; which fields they follow; and your settings, including the Family PIN if you set one. It also keeps the date this browser’s trial began.

Without a family account we cannot see any of it. Clearing this site’s data in your browser, or removing a learner in the Family room, deletes it. You can download a copy of your progress at any time and import it on another device.

When you are signed in to a family account, the browser also keeps a small record of what still needs to be copied to the server, and a short-lived note that stops two open tabs from copying at once. Signing out keeps the copy in this browser.

A few short-lived items keep the app tidy while you use it: a half-finished welcome form, a field chosen before a learner exists, and Library filters. They live in session storage and disappear when the tab is closed. The Atlas remembers its view settings.

Family accounts (optional)

A family account lets a child’s progress follow them from one device to another, and is needed to become a member. The account belongs to a parent; children are learners inside the family and have no email, password or login of their own. Without an account, nothing in this section applies.

What we keep

• About you: your email address (in lower case), your password stored only as a one-way hash (Argon2id or bcrypt), whether you have confirmed the email, when the account was created, and which version of this policy and of the terms you agreed to, with the time you agreed, together with your statement that you are the child’s parent or guardian.
• About each child you add: the first name and age in years you entered, and the learning record the app keeps on your device: placement, answers (up to the last 5,000), sessions, the status of each idea, goals, the fields they follow and their app settings. The Family PIN is not copied; it stays on the device. Each child’s record is limited to 2 MB.
• Sign-in sessions: one row for each signed-in device, holding a one-way hash of the session key (never the key itself), the browser family and kind of device (for example “Chrome on a phone”, never the browser’s full identification) and when the session started and was last used.
• Membership: the plan, its status (trial, active, payment overdue, ended), the dates of the trial and of the paid period, whether you are a founding family, and the identifiers Stripe gives your customer record and subscription.

How it is used

Only to run the service for your family: to sign you in, to copy each child’s record between your devices, to work out what your membership allows, and to write to you about the account (confirming your email, resetting a password, and changes to this policy or the terms). We do not use a child’s record for advertising, we do not sell it, we do not use it to train artificial intelligence, and we do not share it with anyone except the service providers below, who hold it for us.

Your children’s records are copied to our server only after you, the parent, create an account and confirm your email address. If two devices change the same record, the app merges them; it never asks a child to choose.

Where it is kept

In a database file on our hosting provider’s server, outside the public website, readable only by the site’s own programs. Emails to you are sent through the hosting provider’s mail server. A copy of the database is made each night and kept for seven days, so that a fault cannot lose your records.

Payments

Payments are taken by Stripe, on Stripe’s own checkout and billing pages. When you choose a plan, we tell Stripe the plan, your email address and our own number for your account, so that the payment can be matched to it. You then give Stripe your card details (and anything else its checkout page asks for) directly. We never receive or store your card number.

Stripe tells us when a payment succeeds or fails and when a subscription starts, changes or ends; we keep the result in your account, as described above. Stripe receives nothing about your children. Stripe processes payment information for us, and for some purposes, such as preventing fraud and meeting its legal duties, under its own privacy policy; it keeps payment records for as long as the law requires it to, even after you delete your account with us.

Usage counts, in our own log

To learn which parts of the site and app help families, the pages send small records of what happens to our own server, where they are written to files outside the public website. Each record has the event (for example “a page was viewed”, “a session was finished” or “an idea became Secure”), the time and the page’s section.

Inside the app: anonymous counts

Records from the app carry a random identifier that is kept only for the current browser tab and forgotten when it closes, so two visits cannot be linked to each other. They never carry a learner’s name, age, a learner key, the fields a learner follows or an email fingerprint; they keep only the campaign label of this browser’s first visit (for example “newsletter”), which is not an identifier. They say what happened: a screen opened, placement or a session finished, a lesson completed, an idea’s status changed (by the idea’s identifier), and which controls were used, by identifier (never a button’s text, because a button can carry a child’s name). Records of each answered question are off. Account events are counted the same way (an account created, an email confirmed, a sign-in, a checkout started or completed, with the plan), with no account number and no email.

On the public pages

• A random identifier for this browser and the current visit, so that we can count returning visitors.
• The address of the page, keeping only campaign tags (such as utm_source); anything else in the address, such as an email a mail program adds, is removed before anything is recorded.
• Where the visit came from (the referring website’s name, or a campaign tag), screen width and browser language.
• Which buttons, links, questions and sections were used, by their identifiers.
• If you reserve a plan: a one-way fingerprint (SHA-256) of the email address, so we can connect the request to the visits that led to it. The email itself is not in this log. The fingerprint is pseudonymous, not anonymous: anyone who already knows your email could recompute it.
• Script errors, with a short message.

On every page, the device type, browser family and operating system are worked out from the browser’s user agent on arrival. The user agent and the IP address are not stored in the log. To limit abuse, the server keeps a shortened one-way fingerprint of the connection’s IP address in a temporary file for at most a day. Like every fingerprint here, it is pseudonymous: it does not show the address, but it is not anonymous.

Google services

Google Analytics (public pages only)

Google Analytics is switched off inside the app at /app/, and our build refuses to switch it on there. When it is switched on for the public pages, Google Analytics 4 receives the same usage events, minus anything sensitive: no exact ages, no email fingerprint and no per-answer records. Google signals and ad personalization are switched off. It does not load at all when your browser sends a Global Privacy Control signal, or after you switch analytics off in this browser. Google receives your IP address when it loads, as with any website; it processes the data under Google’s privacy policy.

Typefaces

The site and the app use typefaces served from our own server (Source Serif 4, Golos Text and STIX Two Text, under the SIL Open Font License), so opening a page or the app asks Google for nothing. The Russian Math Atlas at /atlas/ still loads its typefaces from Google Fonts, which receives your IP address and browser details there.

Spoken prompts

For young children the app can read prompts aloud with your browser’s built-in voice. Some browsers send the text being read to their maker’s speech service. That text is our lesson wording, never your child’s answers. Speech can be switched off in the Family room.

Plan requests and email

When you reserve a plan or ask about a founding place, we store: the date and time, your email address, the plan and billing you chose, how many children (if you say) and the eldest child’s age band (if you say), and the fact that you are a parent. No network address or fingerprint of it is kept with your request; to stop automated sign-ups, the server keeps a salted one-way fingerprint of the connection for one hour only. This is kept in a file outside the public website that only we can open. A person reads it to write back to you.

If you write to us at hello@0to100math.com, we keep the correspondence so that we can reply and remember what was agreed.

A plan request is separate from a family account: reserving a plan does not create an account, and creating an account does not look up your request.

The parent survey

The short survey at /survey/ is for parents (it asks you to confirm you are an adult) and asks for your consent before anything is sent. When you send it, we store one record outside the public website with:

• How many children you have and their age bands; what you use for mathematics now; your rough monthly spend band; what matters to you; whether you have seen or tried 0 to 100.
• Your answers to the price questions (four prices for the Family plan, your interest in Guided and the prices you accepted or declined), and how you rated our stated price.
• The optional note you write, up to 600 characters. Please do not put a child’s name or school in it.
• How long the survey took, where the link came from (for example an interview invitation), the date and time, a random answer identifier, and a shortened one-way fingerprint of your network address, made with a secret key kept outside the website, so that repeated answers from one connection can be spotted. The fingerprint is pseudonymous, not anonymous. Your IP address itself is not stored.
• Only if you tick that you would talk to us: your email, kept in a separate private file together with the answer identifier, how many children and the spend band, so that we can invite you to an interview. The answers file holds the email only as a one-way fingerprint. If you do not tick it, an email you typed is discarded and not stored in any form.

We use the answers to set and check our prices, and look at them in aggregate. Answer files are deleted automatically after 36 months. Interview emails are deleted automatically 12 months after you volunteer, and sooner when the interview is done or you ask.

Cookies and browser storage

Our own pages set one cookie, and only when you sign in to a family account: o2h_s, a random session key that keeps you signed in on that device. It cannot be read by the page’s scripts, is sent only over a secure connection and only to our own site, and expires after 30 days without use, 90 days after you signed in, or when you sign out. Otherwise our pages use your browser’s local storage instead, for the items described above and, on the public pages, for a few small analytics items: the random browser identifier, the current visit, the first source of your visit, the last button that led into the app, and your analytics choice. When Google Analytics is switched on, Google sets its own first-party cookies on the public pages (named _ga and _ga_ followed by an identifier), never inside the app.

Like every web server, ours keeps standard access logs (IP address, browser, the address requested and the time) through our hosting provider, for security and to keep the site running. We do not use them for analytics.

How long we keep it

Children’s privacy (COPPA)

0 to 100 is made for children from four to eighteen, and for their parents. The app at /app/ is directed to children. We designed it so that, without a family account, a child’s personal information does not leave the family’s device:

• A learner is set up by a parent with a first name and an age. Without an account, both stay in the browser and are never sent to us.
• From the app our log receives anonymous counts only, with no lasting identifier (described above). They serve only to keep the app working and to improve it; they carry nothing that could be used to contact or profile a child. This is a site setting; a more detailed mode exists but stays off until the review by counsel is complete.
• The app has no chat, no messaging, no public profile, no uploads and no way for a child to send us anything.
• No advertising, and no Google Analytics, inside the app.
• The plan request and the survey are for parents. If we learn that a child has sent us personal information, we delete it.

With a family account: a parent’s consent first

Only a parent or legal guardian may create a family account. Before anything about a child is stored on our server:

1. The parent creates the account in the Family room, states that they are the child’s parent or guardian, and agrees to this policy and the terms (we record which versions, and when).
2. We send the parent an email that explains what we will keep about each child, why, who holds it for us, how long we keep it, and how to see it or delete it. Following the link in that email confirms the address and gives consent. Until then, the children’s records stay on the device.
3. About two days after the email is confirmed, if no payment has been made, we send the parent a second email confirming the consent, with a link (valid for 7 days) to withdraw it and delete everything.
4. When a parent pays for membership, a charge to the card through Stripe is further confirmation that an adult holds the account. Membership can be started only after the email is confirmed.

We collect from a child only what the app needs to teach: the record of their learning. We do not share children’s information with anyone for their own purposes, we never sell it or use it for advertising, and we do not use it to train artificial intelligence. Our hosting provider stores it, and sends our emails, on our behalf. If that ever changed, we would ask for your separate consent first.

A parent can at any time see everything we hold (download it from the Family room), delete a child or the whole account, or stop further copying by signing out or deleting the account; the app keeps working on the device without one. A parent can switch off even the anonymous counts on any device by opening this link in that browser.

Whether our way of obtaining consent is sufficient under the Children’s Online Privacy Protection Act is part of the review by counsel.

Your choices and rights

• See or delete a plan request, a survey answer or an interview email: write to hello@0to100math.com from the address you used. We reply within 30 days, usually much sooner.
• Delete the usage records for a browser: send us the browser identifier shown on this page (it appears above, under “In short”, when analytics are on in this browser). We delete every public-page record carrying it. Records from inside the app carry no lasting identifier, so they cannot be picked out.
• Stop usage counts: open this link in each browser you use; this one turns them back on. A Global Privacy Control signal stops Google Analytics automatically.
• Your child’s progress, without an account: it is on your device. Download it, move it, or delete it in the Family room or by clearing this site’s data.
• With a family account: in the Family room you can download everything we hold about your family (a file with the account, each child’s record and a summary of billing), remove a child, or delete the account. Deleting the account removes the account, every child’s record and every sign-in at once, cancels any subscription, and leaves the copy on your device untouched. Stripe keeps its payment records as the law requires.
• Cancel or change membership: from the Family room, which opens Stripe’s billing page. Cancelling deletes nothing.

We do not sell personal information or share it for cross-context behavioral advertising, as the California Consumer Privacy Act uses those terms. Wherever you live, you may ask what we hold about you and ask us to correct or delete it.

Security

Passwords are stored only as one-way hashes. Sign-in keys are random, kept on our side only as hashes, and sent only over secure connections. Every request that changes something must come from our own pages. After five failed sign-ins for one address in fifteen minutes, further attempts are refused for a while. The database and the payment settings are kept outside the public website, readable only by the site’s own programs, and are never part of the files we publish. Messages from Stripe are accepted only with Stripe’s signature. Our own logs never record email addresses or passwords. The links in our emails carry a one-time code in the web address; like every address requested, the confirmation and withdrawal links are recorded in the hosting provider’s standard access log, which is why each code works once and expires (password-reset codes travel in a part of the address that is not sent to the server). No system is perfectly secure; if something went wrong that affected your information, we would tell you.

Changes and contact

If what the site or app collects changes, this policy changes first, with a new date at the top. Earlier versions are available on request.

If a change would let us use or share a child’s information in a way a parent has not agreed to, we ask the parent first.

0 to 100 Mathematics · hello@0to100math.com. The full data inventory behind this page is kept with the source code (docs/PRIVACY_DATA_INVENTORY.md) and is available to anyone who asks.

Terms of useTrust