1. Introduction and scope
Mathzle is a browser-based math game for primary school children aged 6 to 11. This Privacy Policy (the “Policy”) explains how Mathzle (“we”, “us”) collects, uses, shares, stores and protects personal data when you and your child use:
- the Mathzle website at mathzle.com (the “Website”); and
- the Mathzle app that runs in the browser, where parents sign in and children learn math (the “App”).
The Website and the App together are the “Service”.
Beta phase. Mathzle is currently in a free beta. Some features described in this Policy may not yet be enabled for every account, or may change. When we change how we process data, we will update this Policy as described in section 14.
This Policy is based on the 2025 Law on Personal Data Protection and its implementing regulations, the 2023 Law on Protection of Consumer Rights, cybersecurity law and e-commerce law. Terms such as “personal data”, “processing of personal data” and “data subject” have the meanings given in those instruments.
This Policy forms an integral part of our Terms of Use.
2. Data controller and how to contact us
Mathzle is the controller and processor of the personal data described in this Policy: we decide the purposes and means of processing, and we are accountable to you for it.
Details of who operates Mathzle and our official contact channel are shown under Operator details at the end of this page. Please send any question or request about personal data, including requests to exercise the rights in section 10, through our Contact page or the channel shown in that section.
3. Data we collect
We only collect data we need to run the Service. It falls into the four groups below.
3.1. Parent data
- Google account information. You sign in to the App with your Google account (Google Sign-In via Firebase Authentication). We receive your email address, name, Google profile photo (if any) and an account identifier issued by Firebase. We never receive or store your Google password.
- Family information. Your role in the family account (owner or co-parent), the links between family members, and the email addresses of people you invite to join your family.
- What you send us. Feedback, questions, support requests and information you provide when contacting us.
During the beta Mathzle is free, so we do not collect any payment information.
3.2. Child data
Children do not create their own accounts and do not need an email address. A parent creates the child’s profile; as the child learns, the App records learning results. Specifically:
- Child profile: a nickname (it doesn’t have to be a real name), age, avatar, and interests and content preferences chosen by the parent.
- Avatar: your child can use one of the built-in avatars, or a parent can upload a photo. During the beta, uploaded photos are stored as files that can be opened through a direct link, which means anyone who has that link can see the photo. For that reason, we recommend using a built-in avatar rather than a photo of your child’s face.
- PIN: a 4-digit PIN lets your child open the right profile. The PIN is stored as a one-way hash (bcrypt); we cannot read the original PIN.
- Learning data: lesson progress, mastery of each skill, level results, learning goals, experience points (XP), daily streak, last active date and the length of learning sessions.
We do not collect a child’s date of birth, gender, school, address, phone number or location. Mathzle has no chat or messaging between users, so children cannot send personal information to strangers through the Service.
Voice reading practice. The reading practice feature, in which the App records your child reading aloud in order to score it and give feedback, is not enabled during the beta; Mathzle does not record your child’s voice. Before enabling it, we update this Policy — stating the data collected, how long it is kept and any external speech-to-text provider we use — and only turn it on after a parent gives separate, explicit consent for this feature.
3.3. Technical data collected automatically
- Access data: IP address, browser and operating system type, time of access, the page or resource requested, and error codes. Our servers and Cloudflare record this data to operate, secure and protect the Service against abuse.
- Push token: if you allow the App to send notifications, your browser or device issues a token so that Firebase Cloud Messaging can deliver notifications to the right device.
- Data stored in your browser: the sign-in session stored by Firebase and the App’s settings (see section 11).
- Website visit statistics: we use Cloudflare Web Analytics to count page views in aggregate. It uses no cookies and does not build a tracking profile of individuals.
3.4. Sign-ups and the contact form on the Website
When you leave your email on the Website (for news, the beta program or a waitlist), we store: your email address, the language of the page you were on, the form you used (sign-up source), the time of sign-up, your browser identification string (user-agent) and the address of the page that referred you (referer). When you send a message through the form on our Contact page, we also store your name (if you give it) and the content of your message so that we can reply. These forms are meant for adults; children should not sign up or send messages themselves.
4. Purposes and legal bases
We only process data for the purposes below. If we need to process data for a new purpose, we will tell you and ask for your consent where the law requires it.
| Purpose | Data used | Legal basis |
|---|---|---|
| Create and manage the family account, authenticate sign-in | Google account information, family information | Parent’s consent; performance of the agreement under the Terms of Use |
| Create a child profile, let the child learn, save progress, XP and streaks | Child profile, learning data | Parent’s consent (and the child’s, from age 7 — see section 5) |
| Adapt difficulty and suggest suitable lessons | Learning data | Parent’s consent |
| Report learning progress to parents | Learning data | Parent’s consent |
| Score and give feedback on reading practice (once the feature is enabled) | Voice recordings and scoring results | Separate, explicit parental consent for this feature (see section 3.2) |
| Send push notifications (learning reminders, service notices) | Push token | Consent when you allow notifications on your device |
| Send transactional emails (family invitations, account notices) | Email address | Performance of the agreement under the Terms of Use |
| Send news and beta invitations | Website sign-up data | Consent when you sign up |
| Operate and secure the Service, detect and prevent abuse, fix problems | Technical data | Legal obligations under cybersecurity law; your consent |
| Website visit statistics | Aggregated, non-identifying figures | Not applicable — aggregated figures, not personal data |
| Answer questions, handle requests and complaints | Contact details, content of the request | Exercising data subject rights; legal obligations |
| Comply with lawful requests from competent authorities | Data required by the request | Legal obligation |
Difficulty adaptation is based on your child’s learning results and runs inside Mathzle’s own systems; it is not sent to any external artificial intelligence provider. We do not make any automated decision that produces legal or similarly significant effects on you or your child.
5. Children’s data and parental consent
Mathzle is designed for children, so we apply the following principles:
- Parents register. Only a person aged 18 or over who is the child’s parent or legal guardian may create an account and child profiles. Children do not register themselves.
- Consent under applicable personal data protection law. Processing a child’s personal data requires the consent of a parent or guardian; for a child aged 7 or older, the child’s own consent is also required. For a child aged 7 or older, the consent step in the App (where it applies, see below) asks you to confirm that you have explained to your child, in age-appropriate words, what information Mathzle keeps, and that your child agrees to use Mathzle.
- How consent is recorded. When the consent step is in place in the App, consent is recorded there — for the parent, and for a child aged 7 or older as the law requires — with the time and the version of this Policy agreed to. Until then, Mathzle processes data only as far as needed to provide the Service to the parent who created the account, does not use it for any other purpose, does not enable any feature that needs separate consent (such as voice reading practice), and parents can ask us at any time to delete data under section 10.
- Data minimisation. We only require a nickname and an age to create a profile. You do not need to give your child’s real name or photo.
- No ads, no marketing to children. We do not show ads to children, do not use children’s data to build marketing profiles, and do not send marketing emails to children.
- Parents are in control. You can withdraw consent whenever you choose by sending a request as described in section 10. We will then stop processing and delete your child’s profile within the periods in section 8. Withdrawing consent does not affect the lawfulness of processing carried out before.
If we learn that an account was created by a child without a parent or guardian, we will lock that account and delete the related data.
6. Sharing and processors
We do not sell your or your child’s personal data. We do not show ads to children. We do not share children’s data with advertising or marketing companies or data brokers. For the Google advertising library in the App, see “Google Mobile Ads library” below.
To run the Service we use a small number of service providers (processors). They may only process data on our instructions and for the purposes below.
| Provider | Purpose | Data involved | Where processed |
|---|---|---|---|
| Google (Firebase Authentication, Google Sign-In) | Parent sign-in and authentication | Email, name, Google profile photo, account identifier, technical sign-in data | United States and other countries where Google operates infrastructure |
| Google (Firebase Cloud Messaging) | Push notifications | Push token, notification content | United States and other countries where Google operates infrastructure |
| MailerSend | Transactional email (family invitations, account notices) | Recipient email address, email content | Outside Vietnam, per the provider’s infrastructure |
| Cloudflare | Hosting and delivering the Website and App, attack protection, storing Website sign-ups and Contact page messages, cookieless statistics | IP address, access data, sign-up data, contact messages | Cloudflare’s global network |
| Server infrastructure and cloud storage provider | Storing the App’s database and files such as avatars | Account data, child profiles, learning data, uploaded avatars | See section 8 |
| YouTube (Google) | Playing lesson videos embedded in the App | IP address, browser information; YouTube may set cookies (see section 11) | United States and other countries where Google operates infrastructure |
Google Mobile Ads library. The App initialises the Google Mobile Ads library when it runs, although it shows no ads and Mathzle does not use the library for ad targeting. Once the library is initialised, Google may collect data about the device under Google’s own policies; on mobile devices this may include the device’s advertising ID. When this library is removed from the App, we update this Policy.
Beyond these providers, data may only be shared:
- Within the family: co-parents in the family account can see the profiles and learning progress of the children in that family.
- When the law requires it: when a competent authority requests it through due legal process, or when necessary to protect someone’s life or health.
- In a business restructuring: in a merger, demerger or transfer, data may pass to the successor on condition that it continues to follow this Policy. We will notify you before the transfer.
7. Cross-border data transfers
Some providers listed in section 6 (Google, MailerSend, Cloudflare) are based abroad and may process data on servers outside Vietnam. This means part of your personal data is transferred abroad.
When we transfer data abroad, we commit to:
- prepare, keep and submit a cross-border personal data transfer impact assessment to the Department of Cybersecurity and High-Tech Crime Prevention (Ministry of Public Security) under applicable personal data protection law and the regulations in force;
- transfer only the data needed for the relevant purpose;
- choose providers with written data protection commitments and appropriate security measures.
The cross-border transfers described here are covered by the transfer impact assessment above, and are set out in the consent step in the App where that step applies (see section 5). We do not treat merely continuing to use the Service as consent to these transfers.
8. Storage location and retention
Account data, child profiles and learning data are stored on infrastructure operated by Mathzle and/or a cloud storage provider (for example, object storage for avatars and media files). Information about our current infrastructure providers and the country where the servers are located is provided on request through our Contact page; if the servers are outside Vietnam, that transfer follows section 7. Data handled by other providers is stored where section 6 indicates.
We keep data only as long as needed for the stated purposes:
| Data | Retention period |
|---|---|
| Parent account, child profiles, learning data | While the account is active. When you ask for deletion, data is removed from our systems within 30 days of our confirming the request |
| Inactive accounts | Once automatic deletion of inactive accounts is enabled: if an account has not signed in for 24 consecutive months, we email you first, then delete the account if you do not respond within 30 days. You can always ask for deletion at any time under section 10 |
| Photos uploaded by parents | Until you change the photo, delete your child’s profile or delete the account; then deleted within 30 days |
| Reading voice recordings | Only arise once reading practice is enabled (see section 3.2): deleted automatically 30 days after recording; scoring results (score, words read incorrectly) are kept as learning data |
| Push tokens | Until you sign out, turn off notifications or the token expires |
| Website sign-up data | Until you unsubscribe; then deleted within 30 days |
| Messages sent through the Contact page | As for requests and correspondence in the last row of this table |
| Technical and security logs | Up to 12 months, unless the law requires longer |
| Records of requests, complaints and correspondence | 24 months after the request is resolved |
Backups may still contain deleted data for a short period until they are overwritten on their regular cycle; during that time the data is not used for any other purpose. We may keep data longer than stated above where the law requires it or to resolve an ongoing dispute.
9. Security
We apply appropriate organisational and technical measures to protect data, including:
- transmitting data over encrypted HTTPS connections;
- signing in through Google, so Mathzle does not store your password;
- storing your child’s PIN as a one-way hash;
- limiting data access to staff who need it for their work, and logging administrative actions;
- reviewing our security measures when the Service changes.
No system is completely secure. You can help by keeping your Google account safe, not sharing your child’s PIN outside the family, signing out on shared devices, and using a built-in avatar for your child (see section 3.2).
9.1. Possible unwanted consequences
Despite the measures above, processing data can still lead to some unwanted consequences. We set them out plainly so you can weigh them:
- An uploaded avatar photo can be seen by others. During the beta, anyone who has the direct link to the photo can view it without signing in (see section 3.2). Mitigation: use a built-in avatar instead of a real photo of your child; you can remove a photo by switching to a built-in avatar or by sending a request under section 10; when uploaded photos move to access-controlled storage, we update section 3.2.
- Cookies and data collected by third parties. When your child watches a lesson video embedded from YouTube, or when the Google Mobile Ads library is initialised (see section 6), Google may set cookies or collect device data under Google’s own policies, outside Mathzle’s direct control. Mitigation: we do not send your child’s profile or learning data to Google through these components; you can clear cookies in your browser settings (see section 11).
- Data breach or loss. Despite our safeguards, data could still be accessed without authorisation, disclosed or lost through an attack, a system fault or a provider incident. Mitigation: we collect as little as possible (a nickname instead of a real name, no date of birth, no location), store the PIN as a hash, and handle incidents and notify you under section 13.
- Data processed abroad may be subject to the laws of the country where the servers are, with a different level of protection from Vietnam. Mitigation: we only transfer the data needed and apply the commitments in section 7.
10. Your and your child’s rights
Under applicable personal data protection law, you (and your child, through you) have the following rights over personal data:
- The right to be informed about the processing of personal data.
- The right to give or refuse consent to processing.
- The right of access to view, correct or request correction of data.
- The right to withdraw consent.
- The right to delete data or request its deletion.
- The right to restrict processing.
- The right to request a copy of your personal data.
- The right to object to processing, including to prevent data being used for advertising or marketing.
- The right to complain, denounce and sue.
- The right to claim compensation for damage caused by a breach of personal data protection rules.
- The right to self-protection as provided by law.
How to exercise your rights. During the beta, deleting your account, deleting your child’s data and receiving a copy of your data are handled on request: please send your request through the contact channel in section 15, stating what you would like (for example: delete my child’s profile, delete the whole account, send me a copy of my data) and the Google email address you sign in with. To protect your account, we may verify that the request comes from the account holder before acting on it.
Response times. We acknowledge your request within 72 hours. We complete it within the time limit the law sets for that type of request; where the law sets no specific limit, within 30 days of receiving all the information we need. If we cannot fulfil part of a request for legal reasons, we will explain why.
Exercising your rights is free of charge. We listen to children too: if your child no longer wants to use Mathzle, you can ask us to delete their profile as described above.
11. Cookies and similar technologies
- Website: Mathzle does not set cookies on the Website. Visit statistics use Cloudflare Web Analytics, which uses no cookies. In some situations Cloudflare may set strictly necessary security cookies (for example, to tell real visitors apart from automated traffic).
- App: Firebase stores your sign-in session in browser storage (IndexedDB or localStorage) so you don’t have to sign in every time. The App also stores some settings locally in your browser. This is needed for the App to work and is not used for advertising.
- YouTube videos: when an embedded YouTube lesson video plays, Google may set cookies and use similar technologies under the Google Privacy Policy.
You can clear cookies and site data in your browser settings. If you clear the App’s data you will be signed out; your child’s progress remains saved on our servers.
12. Email marketing and unsubscribing
We only send news or beta invitations to people who signed up to receive them. We do not send marketing emails to children, and we comply with the law on combating spam messages and emails.
Every marketing email from Mathzle includes an unsubscribe link. You can unsubscribe whenever you like — even before the first email — by sending a request through the contact channel in section 15. We process unsubscribe requests within 72 hours of receiving them.
Transactional emails needed for your account (such as family invitations or notices of important changes to the Service) are not marketing and may still be sent while the account is active.
13. Incidents and breach notification
If we discover a breach of personal data protection rules (for example, data accessed without authorisation, disclosed or lost), we will:
- immediately take steps to contain it and limit the harm;
- notify the Department of Cybersecurity and High-Tech Crime Prevention (Ministry of Public Security) no later than 72 hours after the breach occurs, under applicable personal data protection law, and explain the reason for any delay beyond 72 hours;
- notify affected parents without undue delay by account email when the incident may affect you or your child, describing the incident, the types of data involved, the steps we have taken and what you should do;
- record and keep documentation of the incident.
14. Changes to this Policy
We may update this Policy when the Service, our providers or the law change. The new version is posted on this page with its update date.
For material changes (for example, collecting a new type of data, using data for a new purpose, or adding a provider abroad), we will notify you by email or in the App at least 15 days before the change takes effect, and ask for your consent again where the law requires it. If you do not agree with a change, you can stop using the Service and ask us to delete your data under section 10.
15. Contact
If you have questions about this Policy, want to exercise your or your child’s rights, or want to complain about how we handle data, please contact us through our Contact page or the channel under Operator details.
If you believe your rights have not been properly addressed, you may complain to the Department of Cybersecurity and High-Tech Crime Prevention (Ministry of Public Security) or another competent authority under the law.
This Policy is made in Vietnamese and English. If the two versions differ, the Vietnamese version prevails.