Data Security and Privacy Plan

How Mighty Mathletes protects student data, as required of third-party contractors by New York Education Law §2-d and Part 121 of the Commissioner’s Regulations. Schools and districts can attach this plan to their agreement with us.

Last updated October 19, 2026

1. Scope and who is responsible

This plan covers all student personally identifiable information (PII) that Mighty Mathletes receives from schools, districts and BOCES (“educational agencies”), or that students create while using the program for their school. The founder, Ryan Greenstein, is responsible for this plan and is the privacy contact for schools: send a privacy request. We review the plan at least once a year and whenever the program changes in a way that affects student data.

2. Following the law and each school’s policy

We follow Education Law §2-d, Part 121, FERPA, COPPA and the terms of each school’s data privacy agreement for the whole life of the agreement.
We follow each educational agency’s data security and privacy policy. Where a school’s policy asks for more than this plan, the school’s policy wins.
Each agreement includes the school’s Parents’ Bill of Rights and our supplemental information (see our Parents’ Bill of Rights).
Student data is used only to provide Mighty Mathletes to the school. It is never sold, never used for advertising or marketing, and never used to build profiles for any other purpose.

3. The data we collect, and nothing more

The student’s name as entered by the teacher, school or student, a 4-digit PIN, their class and school.
Learning and game data created while practicing (facts answered, lessons, check-ups, assignments, rewards, avatar and game progress).
A short activity log, cleared every week, and optional messages a student sends us (shown to us with first name and school only).
If the school uses ClassLink sign-in, a one-way hashed code (never the email address).
We never collect student emails, birthdays, addresses, phone numbers, photos, audio, location or free chat between students.

4. Safeguards

Our safeguards follow the NIST Cybersecurity Framework, which Part 121 requires schools to use.

Administrative

Only the founder can reach the database and server settings. Access uses strong, unique passwords and two-step sign-in.
Teachers see only their own classes, school admins only their own school, and parents only their own family. These rules are checked by our server on every request.
Everyone who handles student PII is trained before getting access and at least once a year after that, and each training is recorded (see section 6).
We collect the least data needed, and we keep it only as long as needed (see section 9).

Technical

Encryption: all data is encrypted in transit (HTTPS/TLS) and at rest by our database provider.
Every change to student data goes through our server, which checks who is asking. Students can’t change their own balances or progress directly.
The database blocks direct reads and writes from the browser (row-level security). Keys that can bypass it stay on the server and are never shared.
Mathlete sign-in codes are locked out after repeated wrong guesses.
An access log records every time staff open, export, change or delete student data. The log can’t be edited, and it is kept for 2 years.
The app loads no ads, trackers or analytics, and no images or scripts from other companies while students use it.

Operational

Changes to the program are tested before release, and security updates are applied promptly.
Our providers’ security alerts are turned on, and logs are reviewed regularly for unusual access.
Daily backups are kept by our database provider and roll off within 30 days.

5. How this maps to the NIST Cybersecurity Framework

Identify: We keep a list of the student data we hold (section 3), where it lives, and every provider that touches it (section 7).
Protect: Role-based access, server-checked permissions, encryption, sign-in lockouts, minimal data, training and short retention.
Detect: The access log, provider security alerts, and regular log reviews.
Respond: The incident steps in section 8, including notice to schools within 7 calendar days.
Recover: Provider backups, restoring service, a review of what happened, and changes so it doesn’t happen again.

6. Training

Anyone with access to student PII completes training on Education Law §2-d, FERPA, COPPA and safe data handling before getting access and again every year. The date, course, provider and hours of each training are kept in a permanent record that can’t be edited. Schools may ask to see it.

7. Subcontractors

We use only these providers, each bound by written terms to protect the data, use it only to provide their service to us, and meet security requirements at least as strict as ours:

Supabase: database, sign-in and our server.
Netlify: hosts the website and app files (it does not receive student records).
ClassLink: sign-in, only if the school chooses it.
Stripe: payments for family memberships only. It never receives student data.

We will not add a subcontractor that receives student PII without updating this plan and telling the schools we serve.

8. Incidents and breach notification

Find and contain: stop the problem, block the affected access and keep the evidence.
Assess: work out what data, which schools and how many students were affected.
Notify: tell each affected school or district in the most expedient way possible and no later than 7 calendar days after discovering a breach or unauthorized release, with what happened, what data was involved and what we are doing about it.
Cooperate: help the school notify parents and NYSED, and pay for notices when the breach was our fault, as the law requires.
Recover and learn: fix the cause and update this plan.

9. Keeping, returning and deleting data

The activity log is cleared every Friday at midnight, Eastern time.
A student account that isn’t used for a year is deleted automatically, with all of its data.
Schools can delete any student at any time from their dashboard, and the data is deleted right away.
When an agreement ends, we delete all of the school’s student data within 30 days, or first return it in a common format if the school asks. Backups roll off within 30 days. We confirm deletion in writing on request.
Parents, eligible students, teachers and principals can ask to see or correct a student’s data through the school or by contacting us.