Effective date: 2026.10.04 Google Analytics for Firebase will be used for app analytics starting with the Android 1.0.1 update that enables this feature. Existing Google Analytics measurement on the website will continue, with aggregated display and response times and layout shifts on public web pages added.
Contents
1. Information we collect and why2. Retention and deletion3. Information stored on your device4. External services and overseas processing5. Notification services6. Website and app analytics7. Error information8. Your rights9. Protecting personal information10. Contact and policy changes1. Information we collect and why
MathTap processes the information below to provide its math learning service. Answers and working entered in the signed-out preview are neither saved as learning records nor sent to the account server. Sign in to save records to an account.
| Category | Information collected | Purpose |
|---|---|---|
| Account | Social account identifier, email and display name provided to us, and sign-in information | Verifying your account and keeping you signed in |
| Learning | Answers and working entered after sign-in; assessment, practice and review records; and learning times. Whether and when certain problems, examples, hints and solutions were viewed | Saving and displaying records, recommending practice, reviews and learning statistics, and checks with new problems |
| Notifications | An app-generated device identifier, push token, reminder time, delivery history and read status | Checking notification status by device, sending notifications and managing their history |
| Access | Access time, IP address, request path and response status | Operating the service, investigating errors and managing security |
| Apple connection processing | Apple account identifiers and encrypted sign-in credentials used to revoke the connection | Managing the Apple sign-in connection and revoking connection permissions after account deletion |
| Google sign-in replay prevention | A one-way hash of a verified ID token and its expiry time | Preventing reuse of the same authentication proof. The original ID token is not retained |
Account information is collected during social sign-in, and learning information while you use the service. After sign-in, the installed app may send its device identifier to the server even if notifications are off. Push tokens and reminder times are saved when you enable notifications. Access information is recorded whether or not you are signed in.
Sections 5–7 describe the information processed for notifications, website and app analytics, and error reporting.
2. Retention and deletion
| Information | Retention and deletion |
|---|---|
| Account and learning records, notification settings and history, and sign-in information | Retained while you use the account and deleted from the service when you delete your account |
| Account-deletion confirmation records (server) | Transformed account and authentication values, sign-in provider and processing time, used to identify duplicate deletion requests. Valid for 7 days after account deletion and cleaned up after expiry |
| Account-deletion confirmation records (device) | Account identifiers, sign-in provider, request/completion times and status, and a transformed credential for checking the Apple connection status, used to verify deletion and prevent deleted records from being recreated. Retained until app/browser data is cleared; server status lookup is available only for seven days after deletion |
| Backup copies | Regularly deleted within 14 days of creation; not deleted immediately when an account is deleted |
| Access logs | Regularly deleted within 30 days |
| Data from completed incident recovery | Deleted within 14 days of recovery completion |
| Data from ongoing or failed incident recovery | Data needed for recovery is not deleted automatically; it is reviewed individually before cleanup |
| Aggregated problem-solving and assessment statistics without personal identifiers | Retained to improve the service |
| Encrypted Apple revocation credentials | Retained while the account is in use. Newly registered credentials have a processing deadline of at most 24 hours after deletion; credentials whose sign-in storage did not complete are also processed for at most 24 hours. Previously stored credentials retain their recorded processing deadlines. Encrypted credentials are discarded immediately after successful revocation. No new revocation starts after the deadline, and pending encrypted credentials become due for disposal. Actual disposal may be delayed by maintenance intervals, backlogs or storage outages |
| Google sign-in replay-prevention records | Hashes are retained until the ID token expires; deleting the account does not permit reuse. Expired records are removed at server startup and by periodic maintenance. Actual deletion may be delayed by maintenance intervals, backlogs or outages |
When retention periods end, the data and files are deleted. Data for the relevant account is also cleaned up on the device that requested account deletion. Sections 4–7 describe processing by external providers.
MathTap account deletion and Apple connection revocation are separate operations. Disposal of expired revocation credentials is not reported as successful Apple revocation. You can check the connection in your Apple account settings or contact the support email in section 10.
3. Information stored on your device
We store sign-in information, language settings and theme settings on your device. We retrieve your learning records from the server without keeping copies in device storage. Unsent answers and drafts are not restored after you close the app or browser. The device identifier used for notifications is stored separately from accounts and removed when app data is cleared.
Personal learning records, answers and drafts saved on the device by an older version may remain there. This version does not import them or upload them as learning records. You can remove them by clearing app or browser data on that device.
4. External services and overseas processing
The providers below process information when you use the service. Information is transmitted over encrypted connections when you sign in, save records or connect to the server. Sections 5–7 describe processing for notifications, website and app analytics, and errors.
| Service and role | Processing |
|---|---|
| Google and Apple — social authentication | We receive an account identifier, email, name and authentication result from your chosen sign-in provider to verify your identity. The provider’s own processing and retention are governed by its policy. |
| Amazon Web Services (AWS) — server operation and storage | Account, learning and notification data and access logs are processed and stored in Northern Virginia, United States. Retention and deletion follow Section 2. |
5. Notification services
Study reminders are set up after sign-in. No new reminders are scheduled while signed out. Information is sent to the providers below when notifications are registered, updated or sent. Your original answers and working are not included.
| Provider and purpose | Information and timing | Processing locations and retention |
|---|---|---|
| Google Firebase Cloud Messaging (FCM) · Android notification delivery | Installation identifiers and push tokens. These may be transmitted automatically regardless of sign-in or notification settings. | Processed in several countries, including the United States. Installation identifiers are retained until the app requests deletion from Google, then deleted, including backups, within 180 days of the request. Deleting your MathTap account alone does not make this request. |
| Expo (650 Industries, Inc.) · notification registration and delivery | At registration: push tokens and device and app identifiers. At delivery: recipient address, notification content and notification identifier | Processed outside Korea, including in the United States. Push tokens are retained to provide notifications; notification content is processed temporarily for as long as needed for delivery. |
Notifications are delivered through Google FCM or Apple APNs. External notification services may continue to update and retain device registration information after you turn off notifications, sign out or delete your account.
6. Website and app analytics
MathTap uses Google Analytics on its production website to understand service use and improve learning features, and uses Google Analytics for Firebase in official app releases that include app analytics. When analytics are enabled, information about measured screens, learning actions and basic usage is sent to Google’s global infrastructure. App analytics are not collected in development or preview apps.
| Category | Processing |
|---|---|
| Information collected on the website | Page views, referring sites and time spent; aggregated display and response times and layout shifts on public web pages; learning starts and resumptions, answer submissions, completion, help use and save failures; learning mode, stage and input method; cookie identifiers, browser and device information, and approximate location |
| Information collected in the app | A random identifier that distinguishes each app installation; device, operating system, app version and language; approximate location inferred from the IP address; basic usage information automatically collected by the SDK, including app launches, sessions and usage duration; names of measured screens and the learning actions, modes, stages and input methods listed for the website |
| Information excluded | Account identifiers, emails, problem identifiers, original answers or working, answer correctness, or URL query parameters and additional values are not included in analytics events. The names of authentication, guardian, account settings and detailed learning-record screens, and learning actions on those screens, are not sent as analytics events. We do not send advertising identifiers or signed-in account user IDs for app analytics, and we do not use ad personalization. |
| Retention settings | Event data: 2 months. User data: 14 months. New activity resets the retention period for user identifiers. Expired data is deleted during Google’s monthly cleanup. These periods do not apply to standard aggregated reports. |
| Cookie controls | You can block or delete cookies in your browser settings. |
| Accounts and app analytics | We do not link installation identifiers used in app analytics to signed-in account IDs. Deletion of account and learning records when you delete your MathTap account is separate from the processing of usage information retained by Google Analytics for each app installation. Deleting your account alone does not immediately delete that analytics information. For requests about the processing of personal information, contact the email address in Section 10. |
7. Error information
We use Sentry (Functional Software, Inc.) to identify and fix website and server errors. When an error occurs, its type, its location in the program, screen or server, and the service version are sent to the United States for processing.
Account identifiers, emails, answers, working and authentication information are not included in error reports, and screens are not recorded. The installed app does not collect error information through Sentry.
8. Your rights
You or your legal representative may request access to, correction or deletion of, or suspension of processing of your personal information using the email in Section 10. We verify your identity or your representative’s authority to the extent needed to handle the request.
• Account deletion: Delete your MathTap account from Account deletion in Settings. Your Google or Apple account itself is not deleted. The server separately attempts to revoke Apple connection permissions. You can manage Google connections or incomplete Apple connections directly in the provider settings.
• You can turn off notifications in MathTap settings and change device notification permissions in operating-system settings. See Section 5 for external providers’ processing and deletion practices.
Suspending the processing of personal information may limit access to some services.
9. Protecting personal information
We encrypt personal information in transit and protect it through identity verification and access controls. We do not collect or store social account passwords. Access logs do not contain authentication information, original answers or working, or URL query parameters.
10. Contact and policy changes
Privacy contact: MathTap
When our handling of personal information changes, we describe the changes and their effective date on this screen. Where separate notice or consent is required, we follow the procedures required by applicable law.