Privacy Policy of EbMath

EbMath, commercialized and managed by Prescott Hub, was created to make math learning a safe, fun, and personalized adventure. The privacy and security of children, teachers, and guardians are our absolute priorities. This policy explains in a simple way how we handle data in our ecosystem, in compliance with LGPD (Brazil), COPPA (USA), and GDPR (European Union).

1. What information do we collect?

To make EbMath work and offer adaptive learning, we collect only what is necessary:

• Account Data (Teacher and "Learn Alone"): Name, email, and registered class data. In the individual "Learn Alone" mode, sign-up can use email and password or login with a Google account — in which case we only receive the name and email associated with the Google account, with the consent of the legal guardian.
• Classroom Student Data: A school student signs in with a codename and a local password, without email, phone, or personal documents.
• Learning Data: Multiplication table progress, response time (latency), and history of correct/wrong answers. Used solely for the adaptive intelligence of the game and for the pedagogical reports available to teachers.
• Gamification and Engagement Data: Coins, lives, streak (consecutive practice days), avatars, daily missions (progress and completion history), and ranking position. Used only for the game experience. In rankings, only the student codename/nickname is shown to other participants — never the real name.
• Preferences: Language, music theme, and accessibility options (dyslexia font, high contrast, calm mode).
• Technical Data: Device model, operating system version, and IP. We use this information only for security, prevention of attacks (Rate Limiting), and system stability.

2. How do we use this data?

• Personalized Learning: The EbMath algorithm uses the student history to create challenges that suit their rhythm.
• Pedagogical Management: The teacher can view the performance of the class to intervene and help where necessary.
• Security: We protect access through secure tokens and encryption, ensuring only authorized people see the data.

3. Advertising and Monetization (Google AdMob)

To enable sustainability and keep the app free, we display Google AdMob ads. In compliance with family policies:

• Non-Personalized Ads: All ads displayed in the app are programmatically flagged as child-directed content ("tagForChildDirectedTreatment"). This prevents Google from collecting personal data and tracking identifiers (IDFA/AAID) for behavioral targeting.
• General Audience Rating (G): Only ads with a general/free classification are authorized to load.
• Accidental-Click Prevention: Ad units have protective visual margins and are displayed so as not to interrupt or harm the focus of the student during exercises or assessments.

4. Data Sharing

We do not sell, rent, or trade user data.

• Third-Party Services: We use only strictly necessary services for the app operation: database hosting and cloud infrastructure, Google AdMob (non-personalized ads), and Google Sign-In (optional login in "Learn Alone" mode).

5. Rights and Responsibilities

• Access and Deletion: The teacher/guardian has full control. You can request account and data deletion in the admin panel, through the account deactivation option within the app itself, or by contacting support.
• Consent: For school use, consent is mediated by the school/teacher for exclusively pedagogical purposes. In "Learn Alone" mode, use by minors is consented to and mediated by the legal guardian, in accordance with the terms presented here.

6. Security and Data Protection

• Encryption at Rest on the Device: Authentication tokens and session data are protected on the hardware of your device using Android KeyStore and iOS KeyChain, with robust industrial-grade cryptographic algorithms (AES-GCM-NoPadding).
• Encryption in Transit: All communication between the app and our servers travels exclusively over the secure HTTPS protocol with active HSTS (Strict-Transport-Security) policies, preventing interception.
• Anti-Malware Screen Protection: The mobile app actively blocks screen capture and recording to prevent visual leakage of school data of students.
• Code Auditing and Hardening: The app and backend source code underwent code obfuscation and strict sanitization of debug logs in production to mitigate vulnerabilities and reverse engineering.
• Backend and API Defenses: Our routes are protected by JWT-based Bearer Tokens, Prepared Statements against SQL injection, and hardening against IDOR and brute-force.

7. For Children (GDPR-K / COPPA)

Hi there, student! We keep track of the points and achievements you earn while practicing multiplication tables to help you and your teacher see how well you are doing. To help keep our app free for everyone, we show some simple ads that are safe for your age and that do not track you. And the best part: we do not sell your data to anyone! Your achievements are kept safe and sound! 🚀

8. Policy Changes

We may update this policy from time to time. When this happens, we will notify teachers and guardians through the admin panel.

Account deletion and grace period

Account deletion can be requested at any time directly in the app, through the account deletion option in Settings. The account is deactivated immediately, and all associated pedagogical history is removed or anonymized from production servers after 30 days.

This waiting period is intentional: if you sign in again within it, the deletion is cancelled and everything is restored — it protects anyone who clicked by mistake. After 30 days, anonymization is permanent and cannot be undone.

If you prefer, requests can also be made by emailing suporteebbingmath@prescotthub.com.

Access records

We keep, for 6 (six) months, the date, time and IP address of each access to the platform — that is, of each sign-in and each session renewal. We also keep the identifier of the browser or app used.

The purpose is platform security: these records are what allow us to investigate unauthorized access to an account, intrusion attempts and irregular use. The legal basis is legitimate interest (Brazilian LGPD, art. 7, IX), and the six-month period follows the parameter set by art. 15 of Law No. 12,965/2014 (Brazilian Internet Civil Framework).

These records are not used for advertising, profiling or any other purpose, and are only disclosed to third parties under a court order.

Because they are security evidence, access records are kept for the period above even after an account deletion request, dissociated from the remaining data: once the account is anonymized, the identifier in the record no longer points to an identifiable person.

How long we keep each record

• Access records (date, time, IP): 6 months.
• Error records (technical message, device model, feature address): 90 days.
• Administrative records (creation, change and deletion of classes and students by a teacher or administrator): 12 months.
• Sign-in attempt control: 24 hours.
• Database backups: 7 days.

Disposal is automatic, through a daily routine. We do not keep geolocation data, nor do we associate exercise answers with an IP address.

Device data in error records

When an error occurs in the app, the error record includes the app version, the device model and operating system version (for example, manufacturer, model and Android version), the screen size, the font scale, the language and an installation code — a random number created by the app itself, which is not the serial number, the advertising identifier or any other identifier of the device.

The purpose is exclusively to diagnose and fix faults: knowing on what type of device the error happens is what allows us to reproduce and fix it. This data is not used for advertising, profiling or any other purpose and is deleted automatically within 90 days.

Error records do not include the serial number, IMEI, MAC address, advertising identifier, geolocation or the list of installed apps.