Privacy Policy

What Mighty Mathletes collects, why, who can see it, and how you stay in control. Written so a grown-up can read it in a few minutes.

Last updated October 19, 2026

1. Who we are

Mighty Mathletes (“we”, “us”) is a math fact fluency program for students, used by schools and families at mightymathletes.com. This policy covers students, teachers, school administrators, parents and visitors to our website.

2. What we collect

About students

The name their teacher or parent entered (or that they typed when joining a class), and a 4-digit PIN that is part of their Mathlete sign-in code.
Their class or family, and their school.
Learning data: which math facts they answered, right or wrong, how quickly, daily checks, lessons and assignments.
Game data: MathBux, avatar choices, quest progress, game records, and friends (classmates they both agreed to add).
An activity log of what they played and when (cleared every week), and alerts if they typed many wrong answers on purpose.
Messages they choose to send us from the Message us button (a bug report, comment or suggestion). We see only their first name and school with it.
Their time zone, so “today” matches their clock.
If their school uses ClassLink sign-in: a scrambled (one-way hashed) code made from their school account, used only to match them to their Mighty Mathletes account. We do not store the email address itself.

We never ask students for an email address, birthday, home address, phone number, photos, voice recordings or location, and there is no open chat between students.

About teachers, administrators and parents

Name, email address and sign-in details (or your ClassLink account, if you sign in that way).
The school, classes or family you manage, and your settings.
For family memberships: your plan and renewal dates. Payments are handled by Stripe. Card numbers are typed on Stripe’s page and never reach us.
Anything you send us through our contact forms.

Technical information

Like any website, our hosting providers keep short-lived server logs (such as IP addresses) to run and protect the service. We do not use advertising or tracking cookies. The app stores a few settings in your browser (like whether sound is on).

3. How we use it

To run the program: sign-in, games, lessons, progress and rewards.
To show teachers and parents how their students are doing, and to make practice adapt to each student.
To keep accounts safe, prevent cheating and fix problems.
To improve Mighty Mathletes, using totals that don’t identify any child.

We never sell student data, never use it for advertising, and never build profiles of students for any purpose other than their learning in Mighty Mathletes.

4. Who can see it

A student sees their own progress, and their friends’ names and game records.
Teachers see the students in their classes. School administrators see their school. Parents see the kids in their family.
Classmates in the same multiplayer game see each other’s first names, avatars and game scores (never right/wrong counts).
Our service providers, only to run the service: Supabase (database and sign-in), Netlify (website hosting), Stripe (family payments) and, if your school uses it, ClassLink (sign-in). They may only use data to provide their service to us.
If the law requires it, or to protect someone’s safety.

5. Schools (FERPA)

When a school uses Mighty Mathletes, student data is part of the student’s education record and the school is in control of it. We act as a “school official” under FERPA: we use the data only for the school’s educational purposes and as the school directs. We sign data privacy agreements with schools and districts on request. New York families: see our Parents’ Bill of Rights.

6. Children under 13 (COPPA)

In schools: the school may consent on parents’ behalf to collecting student data for educational use only, as COPPA allows. Parents can ask their school to review or delete their child’s data, or contact us.

In families: a parent or guardian creates the family account and adds each child, which is how we get the parent’s consent. Parents can see everything we keep in their dashboard, download a copy of each child’s data, delete a child (which deletes their data), or delete the whole family account. Parents can also refuse further collection at any time by deleting the account.

7. How long we keep it

We keep data only while it is needed:

The activity log (what a student played and when) is cleared every Friday at midnight, Eastern time.
A student account that isn’t used for a year is deleted automatically, with all of its data.
When a teacher, parent or school deletes a student, their data is deleted right away.
When a school’s agreement ends, we delete the school’s student data within 30 days (or return it first, if the school asks).
Our record of who accessed student data is kept for 2 years, then deleted.

Deleted data disappears from our backups as they roll off, within 30 days.

8. How we protect it

All data is encrypted when it travels (HTTPS) and when it is stored.
Each school, class and family can only see its own data. Every change goes through our server, which checks who is asking.
Sign-in codes are locked out after repeated wrong guesses.
Only the people who run Mighty Mathletes can reach the database, with strong passwords and two-step sign-in.
Every time staff open, export, change or delete student data, it is written to an access log that can’t be edited.
If there is ever a breach of student data, we will notify affected schools within 7 days of discovering it (and families as quickly as possible), as required by law.

Schools can read the full details in our Data Security and Privacy Plan.

9. Your choices

Teachers and parents can view, download, correct or delete student data from their dashboard.
Anyone can ask us to see, correct or delete their data: send us a privacy request. We answer within 30 days.

10. Changes

If we change this policy in a way that matters, we’ll update the date above and tell teachers and parents before the change takes effect. We will never make an existing student’s data less private without permission.

11. Contact

Questions or requests? Send us a privacy request.