MathKidoo — Privacy Policy
BrainBoot Innovations Pvt Ltd · Last updated 6 August 2026
MathKidoo is used by children. We have written this in plain English so a parent can read it in a few minutes and know exactly what happens to their family's data.
The short version: we collect the minimum needed to save your child's progress and let you sign in. We do not show ads. We do not sell or share your data with data brokers, advertisers or analytics networks. There is one thing that does leave your device that parents should know about — voice input — and it has its own section below.
1. Who we are
BrainBoot Innovations Pvt Ltd, 2nd Floor, Core-1, Pacifica Tech Park, Rajiv Gandhi Salai, Navalur, Chennai, Tamil Nadu 600130, India.
Questions, or want your data deleted: contact@brainboot.co.in.
2. What we collect, and why
This is the complete list. Nothing else is stored.
The parent's account
| What | Why |
|---|---|
| Email address and password | So you can sign in. Passwords are hashed by our authentication provider — we never see or store the password itself. |
| Display name, avatar emoji, age, preferred language | To personalise the app. All optional except the name. |
Each child you add
| What | Why |
|---|---|
| The child's first name or nickname, avatar emoji, age | So the right child sees their own progress. A nickname is fine — we never ask for a surname. |
| An optional 4-digit PIN | So siblings cannot open each other's profile. Stored only as a one-way hash computed on your device; the PIN itself never reaches us and cannot be recovered from what we hold. |
Learning progress
| What | Why |
|---|---|
| Which tables and operations are done, and mastery level per table | To show progress and unlock the next stage. |
| Per-question scores: attempts, correct answers, streaks, and when a fact is next due for review | This is what makes the app adapt — it decides which questions your child is asked next. |
| Session records: which module and stage, how many questions were answered and how many were right, and when the session started and ended | To show progress over time and to apply the free-tier limit. |
Security and account safety
| What | Why |
|---|---|
| A sign-in history: sign in, sign out, and when an account was signed in somewhere else | So you can see if someone else used your account. |
| A short device description (your browser's user-agent string, first 120 characters) | To show you which device an event came from. It is not a device fingerprint and is not used for tracking or advertising. |
| A random session token for the device currently signed in | MathKidoo allows one device at a time per account. This is how the app knows. |
If you subscribe
| What | Why |
|---|---|
| Subscription status, plan, renewal date, and the payment reference IDs from our payment provider | To know what you have access to. We never see or store your card number, CVV or UPI PIN — those go directly to the payment provider and never touch our systems. |
If you send feedback
| What | Why |
|---|---|
| Your rating and message | To improve the app. Please do not include personal details in the message. |
3. Voice input — please read this one
When your child taps the microphone button to speak an answer, the recording is sent to your device's speech-recognition service to be turned into text. On most Android phones and on the Chrome browser, that service is operated by Google, and the audio leaves the device.
This is the same mechanism any website uses for voice input. We do not receive the audio, we do not store it, and we never keep a recording. All MathKidoo ever receives back is the number that was recognised.
Voice input is entirely optional and is never on by default. It only runs when the microphone button is tapped, it stops as soon as a number is recognised, and the app works exactly the same if it is never used — your child can simply type the answer. The first time it is used, the browser or phone asks your permission, and you can refuse or later revoke it in your device settings.
If you would rather no audio ever left the device, do not use the microphone button, or deny the microphone permission. Nothing in the app becomes unavailable.
4. What we do NOT do
- No advertising. There are no ads in MathKidoo, and no advertising or ad-attribution SDKs of any kind.
- No selling or sharing your data. We do not sell personal information, and we do not share it with data brokers or advertisers.
- No third-party analytics or trackers. No Google Analytics, no Facebook pixel, no session-recording tools.
- No location. We never request or collect location data.
- No contacts, photos, camera or files. Never requested.
- No behavioural profiling. The only profile we build is which maths facts your child finds hard, and it is used solely to choose their next question.
What we do keep, ourselves. To fix mistakes and to see where families get stuck, our own pages send two kinds of short report to our own database. Nothing is sent to a third party. An error report holds the page it happened on, the error message (any e-mail address in it is blanked out before it is sent) and a short description of the browser. A step report holds the name of one step from a short fixed list, such as consent being given or a child being added, the page it happened on, and, for some steps, which button or level it was. Neither one carries a name, an e-mail address, an account, a child or an answer. We keep both for 90 days, then delete them.
5. Who else is involved
We use a small number of service providers to run MathKidoo. Each only receives what it needs to do its job.
| Provider | What it does | What it receives |
|---|---|---|
| Supabase | Sign-in and database hosting | Everything listed in section 2 |
| Cloudflare | Serves the website and app files | Standard web request information, including IP address, as any website receives |
| Razorpay | Payments | Only what is needed to take a payment, and only if you subscribe. They receive your payment details directly; we do not. |
| Your device's speech service (Google on most Android phones) | Turns spoken numbers into text | Audio, only while the microphone button is held — see section 3 |
Fonts and code libraries are served from our own domain, not from a third-party CDN, so loading MathKidoo does not disclose your visit to any other company.
6. Where data is stored
MathKidoo's database is hosted in India (Mumbai region). Some providers above may process data in other countries as part of running their global services.
7. How long we keep it
We keep your account and progress data for as long as your account exists, so your child does not lose their progress. Sign-in history is kept for security review. When you ask us to delete your account, everything associated with it — profiles, children, progress, scores, session history and feedback — is deleted.
8. Your rights, and how to delete your data
You can ask us to show you, correct, or delete any data we hold about your family. Email contact@brainboot.co.in from the address you signed up with and we will action it within 30 days. There is no charge, and you do not have to give a reason.
Deleting a child's profile in the app removes that child's data. Deleting the whole account removes everything.
9. Children's privacy
MathKidoo is designed for children roughly aged 6–11, and an adult creates and controls the account. We ask for the least we can: a child's profile needs only a first name or nickname — never a surname, never an email address, never a photograph, and never a date of birth (age alone is optional).
Children are never shown ads, never asked to make a purchase, and cannot message anyone. There are no social features and no way for one user to contact another.
If you believe a child has given us information without a parent's involvement, email us and we will delete it.
10. Changes to this policy
If we change how we handle data, we will update this page and change the date at the top. For anything significant, we will also tell account holders by email.
11. Contact
BrainBoot Innovations Pvt Ltd
2nd Floor, Core-1, Pacifica Tech Park, Rajiv Gandhi Salai, Navalur, Chennai, TN 600130, India
contact@brainboot.co.in
12. Our Grievance Officer
Data Protection & Grievance Officer
If you have a question about how your data is handled, or if you believe your rights under data protection law have been violated, you may contact our Data Protection Officer:
Grievance Officer: The Founder, BrainBoot Innovations Pvt Ltd
Email: contact@brainboot.co.in (write "Grievance" in the subject)
Post: 2nd Floor, Core-1, Pacifica Tech Park, Rajiv Gandhi Salai, Navalur, Chennai, TN 600130, India
We will respond to your complaint within 7 working days. If you are not satisfied with our response, you have the right to lodge a complaint with the Data Protection Board of India.
13. Who else handles data for us (sub-processors)
Our Sub-processors
MathKidoo works with third-party vendors ("sub-processors") to deliver the app. Each receives only the data it needs:
Supabase (Database & Sign-in): Stores your account, password, and all learning progress. Based in the US; data stored in India (Mumbai region).
Cloudflare (Website & Security): Serves the MathKidoo website quickly and protects us from attacks. Receives only standard web request information, not personal details.
Google (Sign-in & Voice): If you sign in with Google, we receive your email only. If your child uses voice input, audio goes to Google's speech service on your device; we never store the recording.
Razorpay (Payments, when live): Handles subscription payments. Card numbers, CVV and UPI PINs never touch MathKidoo servers — they go directly to Razorpay's secure system.
WhatsApp (Reports, planned): Future feature to deliver weekly progress summaries. Not yet active.
Each vendor has its own privacy policy and data protection agreement with us. You can ask to see these — email contact@brainboot.co.in.
14. How long we keep each kind of data
Complete Data Retention Schedule
Every piece of data we hold has a set retention period — we do not keep data forever. See BB-DOC-MATHKIDOO-DATA-RETENTION-SCHEDULE-V1.html for the complete schedule (linked from this website). In summary:
Your account & progress: Kept as long as your account is active, plus 30 days after deletion. Then permanently removed.
Legal records: Consent records, payment history and audit logs are kept longer (1–7 years) because the law requires it. These are encrypted and your child is never named in them.
Research data (anonymous): Learning trends are kept for 24 months in anonymized form (no child name or ID) to improve the app. After 24 months, further anonymized.
School & event data: Class rosters and event records are deleted when your child leaves the school or the event ends, plus 30 days.
You can request the complete schedule at any time: contact@brainboot.co.in.
15. If something goes wrong (breach notification)
If We Discover a Data Breach
A "breach" is an incident where personal data may have been accessed, lost or modified without permission. If we discover one affecting your family's data, we will:
1. Notify you without delay, and no later than 72 hours after we confirm it happened. You will receive a plain-English email explaining what happened, what data, and what you should do.
2. Tell you the facts: We will not hide the incident or minimize it. You will know exactly what was exposed and what wasn't.
3. Tell you what we did: We will explain how we stopped it, what we fixed, and how we are preventing it from happening again.
We do not charge for breach notifications — they are your right, not a business option.
Our full incident response plan is documented in BB-DOC-MATHKIDOO-BREACH-PLAYBOOK-V1.html (available on request).
16. Your rights, and how to use them
Your Data Rights
Under Indian data protection law, you have the right to:
1. Access: See all data we hold about your family. Request by email (contact@brainboot.co.in). You will receive a CSV export within 30 days.
2. Correction: If any information is wrong, ask us to fix it. You can also edit your own profile (name, age, language) and your child's profile (name, age) directly in the app, anytime.
3. Erasure ("Right to be Forgotten"): Request that we delete your account and all your child's data. Email contact@brainboot.co.in with the subject "Delete my account". We will delete within 30 days. Some records (consent, payment history) are kept longer by law, but your child will not be named in them.
4. Portability: Get a copy of all your data in a portable format (CSV). Request via email.
5. Withdrawal of Consent: You consented to data processing when you created the account. You can withdraw that consent anytime via your account settings (under "Consent") or by email. Withdrawing does not delete anything: your children and their progress stay, no new child can be added, and you are asked to consent again before you carry on. Deleting the account is a separate choice on the same page. Your consent history is kept as legal proof (a record that you agreed, and when you stopped).
How to Exercise These Rights
Via the app: On your Account page (Home → Settings → Open account) you can read and withdraw your consent, change your e-mail, download a copy of your data, and delete your account — with seven days to change your mind. You can delete a single child from the Parent view.
Via email: Contact contact@brainboot.co.in. You do not need to give a reason. Response time: 30 days (or 7 working days for urgent requests).
17. How to reach us
Support
For any questions about MathKidoo or your data:
Email: contact@brainboot.co.in (any time; response within 2 working days)
We are here to help.