SprintMath Privacy Policy

Effective Date: [Insert Date Policy is Published]

This Privacy Policy describes how the SprintMath Development Team ("we," "us," or "our") collects, uses, and discloses information from users of the SprintMath mobile and web application (the "Service").

We are deeply committed to the privacy of our users, particularly children. Our practices are designed to comply with applicable data protection laws, including the Children’s Online Privacy Protection Act (COPPA) in the United States, and relevant provisions of GDPR and PDPA regarding children’s data.

1. Scope of Policy and Contact Information

The Service: SprintMath is a gamified, progressive math learning platform designed for children aged 8-14.

Contact Us:

If you have any questions or concerns about this Privacy Policy or our data practices, please contact us:

Developer/Company Name: Muhammad Bdeir
Designated Email Address: muhbader70@gmail.com

2. Information We Collect

We collect two main types of information: Personal Data (provided by the Parent) and Usage/Progress Data (generated during use).

A. Personal Data Provided by Parent Accounts

We require a Parent Account for all users. We collect the following Personal Data from the Parent:

Email Address: Used for account verification, password recovery, and communicating essential service updates.
Password: Stored securely as a salted hash and never in plain text.
Account Information (Optional): Parent's display name or other profile information.

B. Child Profile Data (Under Parental Control)

The parent creates individual child profiles. The following data associated with the child profile is collected and stored:

Child Display Name (or Alias): Used for in-app display and leaderboards.
Child User ID: A unique, non-identifiable internal identifier.
Age Range/Grade Level: Used to tailor the progressive curriculum.

C. Usage and Progress Data (Collected Automatically)

This data is collected to provide the core educational service and track performance:

Session Data: Start/end times, answers provided, time per problem, streak data, and scores (0-3 stars).
Progress Tracking: Comprehensive historical data on topics completed, Level A/Level B mastery status.
Leaderboard Data: Scores and times necessary to populate the real-time global and regional leaderboards.
Device Information: Device type, operating system version, and unique installation identifiers.
Network Information: IP address, collected by our self-hosted backend during session activity and real-time updates (Socket.IO).
Diagnostic Data: Crash logs and performance monitoring data.
User Interface Interactions: Pages visited (via GoRouter) and features used (e.g., activation of text-to-speech, theme selection).

3. How We Use the Information

We use the collected data for the following purposes:

**Service Delivery:** To manage Parent and Child accounts, authenticate users (using JWT tokens stored securely via Flutter Secure Storage), and deliver the specific math problems.
**Educational Function:** To track, record, and display the child’s progress and mastery status through the progressive learning path.
**Gamification and Engagement:** To calculate and display scores, stars, streaks, and populate the real-time global and regional leaderboards.
**Real-Time Features:** To enable instantaneous feedback and leaderboard updates using the Socket.IO real-time service.
**Security and Integrity:** To implement anti-cheat mechanisms (HMAC session signatures, server-authoritative timing) and enforce rate limits.
**Technical Support:** To monitor usage, detect and prevent technical issues (via diagnostic/crash logs), and ensure platform stability.
**Accessibility:** To facilitate the text-to-speech and multilingual features.

4. Children's Privacy and Parental Consent

SprintMath is explicitly intended for Children under the age of 13.

**Parental Consent:** We require a Parent Account to be created before any Child Profile can be created or accessed. The Parent Account creation process acts as our method of verifiable parental consent for the collection and use of the child's non-personal usage and progress data, as described in this policy.
**Data Minimization:** We only collect the minimal personal information necessary to operate the service (Parent email, child display name, progress data). We do not collect precise geolocation or share Personal Data with third-party advertisers.
**Parental Rights:** Parents have the right to review, update, or delete the Personal Data associated with their Parent Account and linked Child Profiles at any time by contacting us at the email provided above. Upon request for deletion, we will take steps to remove the data from our MongoDB and Redis systems.

5. Data Storage and Third-Party Services

Our Service utilizes a self-hosted technology stack for maximum control over your data. You must update this table if you add new services (e.g., Google Maps, AdMob, etc.).

Component / Third Party Service	Data Function	Data Collected	Link to Policy
Self-Hosted Backend (Node.js/Fastify/MongoDB/Redis)	Core business logic, user authentication, storage of all Personal Data, Child Data, Progress Data, and Leaderboards.	All data listed in Section 2.	N/A (Self-Managed)
Flutter Secure Storage	Securely stores JWT access and refresh tokens on the user's device.	Authentication Tokens (Encrypted)	N/A (Local Device Storage)
Hosting Provider (Render.com)	Provides the infrastructure to run our self-hosted backend. Receives raw network requests (IP addresses).	IP Addresses, Network Logs	[Insert Link to Your Hosting Provider's Privacy Policy]
[Add Analytics Provider] (If used, e.g., Crashlytics)	Diagnostic and crash reporting.	Device ID, Diagnostic Logs	[Insert Link to Third-Party Policy]

6. Security and Data Retention

**Security Measures:** We use industry-standard security measures, including HTTPS/TLS encryption for all data transmission, secure password hashing, and HMAC signatures for data integrity, to protect data against unauthorized access.
**Data Location:** All data is stored on servers managed by our Hosting Provider in **[Insert Location of Servers, e.g., US, EU]**.
**Retention:** We retain Personal Data and Child Profile Data for as long as your account remains active. If an account is deleted, we initiate a process to delete the data within a reasonable period, typically **[Insert Number]** days.

7. Changes to This Privacy Policy

We may update our Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Effective Date" at the top of this document. You are advised to review this Privacy Policy periodically for any changes.