Data Retention Policy

Effective September 16, 2026

This page states, in one place, how long MathPath keeps each kind of data it stores and how deletion works. It is the detailed companion to the "Data retention and deletion" section of our Privacy Policy, which links here.

What triggers deletion

Account and account-linked data is kept for as long as the account is active, and deleted when the account is deleted. There is no automatic inactivity timer that deletes an account on its own. Deletion happens when:

the account holder deletes their own account from Account → Delete my account while signed in (this cancels any active subscription immediately and removes the data below in the same operation), or
the account holder emails support@mathpathrehab.com asking us to do it for them instead, or
a parent, guardian, or therapist who set up an account for a child exercises the same right on that child's behalf, per the Children's Privacy section of the Privacy Policy.

What gets deleted, and what it depends on

MathPath's database gives every table that stores per-account data a foreign key back to the account, set to delete automatically when the account row is deleted. Removing an account removes all of the following in the same operation:

Data	What it is
Profile	Email, password hash, display name, role (patient/therapist), start date.
Progress	Per-unit best score, completion state, and difficulty tier for every unit attempted.
Exercise attempts	The individual answer log behind that progress (per-question correctness, timing) — this is what the adaptive-difficulty feature reads to decide when to raise or lower a unit's tier.
Placement Check history	Past Placement Check results and the level they recommended.
Subscription record	Stripe customer/subscription IDs and status — not billing history itself, which Stripe holds; see below.
Care Team links	Any invite a patient sent or accepted, in either direction.
Password reset tokens	Only a one-way hash of a token is ever stored, and it already expires in 60 minutes whether or not the account is deleted.

Data that does not follow account deletion

Two kinds of data are deliberately not tied to a specific account, and deleting an account does not remove them by itself:

Mail delivery failures. When our email provider reports a bounce, spam complaint, or blocked send, we record the recipient address and the reason so a repeated failure doesn't go unnoticed. This is indexed by email address, not by account — a caregiver invited by email may not have an account at all yet when their invite bounces — so it survives the inviting account's deletion. If you'd like a specific address removed from this log, say so in your deletion request and we will do it by hand.
Backups. The server this runs on is backed up as a whole, on a schedule shared across everything hosted here, not per account. An account deleted today can still exist inside an older backup snapshot until that snapshot ages out of the rotation (roughly a year, at the outside — see below). Backups exist to recover from a server failure, not to be browsed, and are encrypted at rest off-site.

Backup retention, specifically

Backups run automatically and are not specific to MathPath — they cover every service on the server. Snapshots are kept on a tiered schedule (recent ones kept densely, older ones thinned out), so something deleted today is fully gone from active service immediately, but a copy of it can persist in a backup for up to roughly a year before that snapshot itself is pruned. This is a recovery mechanism for catastrophic failure, not a second copy of the app's data serving any other purpose.

Payment data

MathPath never receives or stores your card number. Checkout happens on Stripe's own hosted page, and what MathPath's database keeps is only a Stripe customer ID and subscription ID — pointers, not payment details. Stripe's own retention of your payment and billing history is governed by Stripe's privacy policy, not this one.

This is a plain-language description of current practice, not a legally binding schedule with fixed day-counts for every table (aside from the two token expiries stated above, which are exact: password reset links expire in 60 minutes, Care Team invite links in 7 days). It is written to satisfy the FTC's amended COPPA Rule requirement for a written data retention policy, disclosed alongside the Privacy Policy. It is reviewed whenever the underlying data model changes, not on a fixed calendar.

Contact

Questions about this policy, or a request to delete your data: support@mathpathrehab.com.