This Privacy Policy applies to Beside Math, a service provided by Beside Math ("we," "us," or "our"). We are committed to protecting the privacy of families who use our platform. This Privacy Policy explains what data we collect, how we use it, and your rights. If you have questions, contact us at [email protected].
1. Information We Collect
1.1 Account Information (Parent / Account Holder)
- Full name and email address (provided at signup)
- Password (stored as a bcrypt hash — we never store the plain-text password)
- Subscription plan and billing status
- Account creation date and last active date
1.2 Student Learning Data
- Student first name, provided by the parent at signup. We ask for a first name or nickname only, and we do not ask for a surname, date of birth, address, or photo
- Grade level and subject selections
- Problem attempts: question answered, whether correct, hints used, timestamp
- Skill mastery percentages per topic
- Daily activity streaks and star totals
- Island customization: the layout, and a name for the island that the student can type (up to 30 characters). It is decorative and visible only within your family's account — please ask your student not to put their full name, school, or anything else identifying in it
1.3 Usage Data
- Browser type and operating system
- Pages visited and features used
- Live Sync session duration (see 1.5 for what a session carries)
- IP address (used for rate limiting and fraud prevention; not stored long-term)
1.4 Live Sync Sessions
Live Sync lets an adult on the account watch a student's session as it happens. While a session is connected, the student's device sends to the connected adult: the question on screen, the answer choices and which one the student has selected, whether it has been submitted, their score and progress, the hints and the coaching guide for that question, and the handwriting drawn on the scratchpad.
None of this is recorded. Session content is held in the server's memory only for as long as the session is connected, so that an adult joining midway sees the work already on the page, and is discarded when the session ends. Handwriting is not written to our database, and there is no audio, video, or screen recording at any point.
Only an adult linked to that student's profile can connect. When an adult asks to join from their Live Sync page, the student is asked to accept before anything is shared, and the student is told whenever an adult is connected.
1.5 Payment Information
Payment card details are processed exclusively by Stripe, our third-party payment processor. We do not receive, store, or transmit full card numbers. We store only payment metadata (amount, plan, date, status).
2. How We Use Your Information
| Purpose | Data Used |
|---|---|
| Provide and operate the learning platform | Account info, learning data |
| Personalize learning experience and progress tracking | Student answers, mastery, streak |
| Enable Live Sync parent-student coaching | Real-time question state (in-memory, not persisted) |
| Send transactional emails (receipts, password reset) | Email address |
| Prevent fraud and enforce rate limits | IP address, login attempts |
| Improve our curriculum and platform | Aggregate, anonymized usage data |
| Comply with legal obligations | As required by applicable law |
We do not sell your personal data to third parties. We do not use student data for advertising.
3. Children's Privacy (COPPA Compliance)
Beside Math is a family platform. Student profiles are created by parents (account holders aged 18+). We comply with the Children's Online Privacy Protection Act (COPPA).
- We do not knowingly collect personal information directly from children under 13 without verifiable parental consent
- Permission is asked for each child by name, before anything about that child is collected, and after the adult has been shown what we keep and what we never ask for
- We record each permission with its date and the version of this policy it was given under, and email the account holder a receipt of what was agreed
- Student data is linked to the parent's account; the parent has full visibility and control
- Parents may request deletion of all student data at any time by contacting [email protected]
- We do not display targeted advertising to students
- We do not share children's personal information with third parties for commercial purposes
You may withdraw permission at any time by writing to [email protected]. We then stop collecting and delete what we hold about that child. Our record that permission was once given is kept, without the child's data, because it is what shows the collection was permitted while it lasted.
If you believe we have inadvertently collected data from a child without parental consent, please contact us immediately. We will delete the data promptly.
4. Data Sharing & Third Parties
We do not sell your data and we do not share it for advertising. It reaches the following providers because running the service requires it. Everything below is stored in the United States.
- Render — Hosts the application and the database.
- Cloudflare — Sits in front of the site, so requests to Beside Math pass through it, and routes mail sent to our published addresses. It also stores our backups (below).
- Cloudflare R2 — Holds a nightly copy of the whole database, kept offsite so the service can be restored after a failure. Section 5 says how long those copies live.
- Resend — Delivers the email we send you, such as a password reset link.
- Google — Mail you send to our support, privacy, legal or security addresses is forwarded to a Google mailbox we read.
- Stripe — Payment processing, governed by Stripe's Privacy Policy. During early access nothing is charged and no payment method is collected, so no data reaches Stripe yet.
- Anthropic (Claude AI) — Used by our content team to write curriculum questions, hints and coaching guides. Only staff with content permissions can reach these tools, and nothing about you or your student is sent. If that changes — we are building a feature that would send a student's scratchpad work for feedback — we will say so here and describe it before it is switched on.
Separately, your browser loads styling, fonts and maths typesetting from public content delivery networks — cdn.tailwindcss.com, cdn.jsdelivr.net, cdnjs.cloudflare.com and fonts.googleapis.com. Those requests come from your browser, so those networks can see your IP address and which page asked for the file. We send them nothing about you.
We may disclose information if required by law, court order, or to protect our rights and safety, or those of our users.
5. Data Retention
- Active accounts: Data retained while the account is active
- Cancelled accounts: Data retained for 90 days after cancellation, then deleted
- Deletion requests: Processed within 30 days of a verified request
- Payment records: Retained for 7 years as required by financial regulations
- Backups: Deleting data removes it from the live service, but a copy stays in our offsite backups until those age out — up to 7 days for the daily copies and up to 6 months for the monthly ones. Backups are used only to restore the service after a failure.
6. Security
We implement industry-standard security measures to protect your data:
- Passwords hashed with bcrypt (cost factor 12) — never stored in plain text
- JWT sessions stored in httpOnly cookies (not accessible to JavaScript)
- HTTPS/TLS encryption for all data in transit
- HTTP security headers via Helmet.js (X-Content-Type-Options, Referrer-Policy, etc.)
- Rate limiting on authentication endpoints to prevent brute-force attacks
- Automated daily database backups
No system is 100% secure. If you suspect a security breach, please contact [email protected] immediately.
7. Your Rights
As a parent or account holder, you have the right to:
- Access — request a copy of your personal data
- Correction — update inaccurate information via Account Settings
- Deletion — request deletion of your account and all associated data
- Portability — request your data in a machine-readable format
- Opt-out — unsubscribe from marketing emails at any time (transactional emails are required for account security)
To exercise these rights, email us at [email protected]. We will respond within 30 days.
8. Cookies
Beside Math uses a single httpOnly session cookie to keep you logged in. This cookie:
- Is essential for platform operation (no banner needed under most frameworks)
- Expires after 7 days of inactivity
- Is never accessible to third-party scripts
We do not use advertising cookies, tracking pixels, or third-party analytics cookies.
9. International Users
Beside Math is operated from the United States. If you access the platform from outside the US, your data will be transferred to and processed in the US. By using Beside Math, you consent to this transfer.
10. Changes to This Policy
We may update this Privacy Policy as our practices evolve. When we make material changes, we will notify you by email and/or a notice in your account at least 14 days before the changes take effect. We encourage you to review this page periodically.
11. Contact Us
For any privacy-related questions or requests:
- Email: [email protected]
For security vulnerabilities: [email protected]
The person responsible for the information described here is Henry Kang, operating Beside Math from California as a sole proprietor. A limited liability company is being formed; when it is, it becomes the party responsible and we will say so here.