Privacy Policy

Effective September 13, 2026

This policy explains what information MathPath collects, why, and who it is shared with. It covers mathpathrehab.com and the MathPath account you use there.

Information we collect

Category	What it includes
Account	Email address, a securely hashed password (we never store your password in plain text), the display name you choose, and whether you signed up as someone practising math or as a therapist/caregiver.
Practice progress	Which units you've attempted, your scores, your current difficulty tier per unit, and your Placement Check results. This is what makes adaptive difficulty and progress tracking work.
Care Team sharing	If you invite someone, or accept someone else's invite, we record that relationship so the right person can see the right progress data, read-only, until it's revoked.
Subscription	A reference to your Stripe customer and subscription record, and its status (active, trialing, etc.). Your card details are handled entirely by Stripe — MathPath's servers never receive or store your full card number.
Session	A single cookie that keeps you signed in. It is required for the Service to work and is not used for advertising or cross-site tracking.

How we use it

To operate your account and the subscription tied to it.
To adapt exercise difficulty to your recent performance.
To let you share progress with an invited caregiver or therapist, or view progress shared with you.
To email you when necessary for your account — currently, this is limited to password-reset emails. MathPath does not send marketing email.
To process payment for your subscription.

Who we share it with

We do not sell your personal information. We share it only with:

Stripe — processes your subscription payment.
Twilio SendGrid — delivers the password-reset email when you request one.
A caregiver or therapist you explicitly invite — sees your progress data read-only, only after you invite them, and only until you revoke access. The reverse applies if you accept someone else's invite.

Data retention and deletion

We keep your account and progress data for as long as your account is active. To request deletion of your account and associated data, email support@mathpathrehab.com. We currently handle deletion requests manually rather than through a self-service button in the app. For exactly what is kept, for how long, and what deletion does and does not remove, see our full Data Retention Policy.

Children's privacy

MathPath's practice levels span Pre-K through college, so some accounts are used by children under 13. An account is created and controlled by a parent, guardian, or therapist, using their own email address and password — a child does not sign up directly or submit personal information to create an account. The practice activity recorded against that account (exercise attempts, scores, Placement Check results) reflects the child's use of the Service under the adult account holder's supervision.

This matters under the U.S. Children's Online Privacy Protection Act (COPPA), which applies to operators with actual knowledge of collecting personal information from children under 13. The FTC's amended COPPA Rule took effect June 23, 2025, with an April 22, 2026 compliance deadline that has now passed; it added stricter requirements around data retention, security documentation, and (for services that use it) separate consent before disclosing a child's data to third parties for advertising. MathPath does not serve advertising and does not disclose account data to third parties for advertising or marketing purposes. The written data-retention policy and information-security program the amended Rule requires are published at Data Retention Policy and Information Security Program.

If you are the parent or guardian who set up an account, you can:

review the information associated with that account,
ask us to delete it, or
refuse to let us collect any further information from it,

by contacting support@mathpathrehab.com.

Georgia-specific note. Georgia's Student Data Privacy, Accessibility, and Transparency Act (O.C.G.A. §20-2-661 through 20-2-667) places additional obligations on education-technology operators, but only when their tools are used in Georgia public schools under a contract with a school or district. Whether that applies to MathPath depends on how the operator sells and distributes the Service — a business fact this policy cannot determine on its own — and should be confirmed if MathPath is ever offered to a Georgia school or district. Georgia has not enacted a general consumer privacy law, and its separate social-media-specific law for minors (SB 351) is both currently blocked by a federal court and aimed at social media platforms, which MathPath is not.

Security

Passwords are stored using a one-way salted hash, never in plain text. The site is served over HTTPS. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security. For the full set of technical and organizational safeguards in place, see our Information Security Program.

Your choices

You can revoke a Care Team invite at any time from within the app. For anything else — access, correction, export, or deletion of your data — contact us using the details below.

Changes to this policy

We may update this policy from time to time. We'll update the effective date above when we do.

Contact

Questions about this policy or your data: support@mathpathrehab.com.