MathBugs is an educational game designed for children. We take the privacy and safety of young players very seriously and comply with the EU General Data Protection Regulation (GDPR) and the US Children's Online Privacy Protection Act (COPPA).
2 · What Data We Collect
We collect only the minimum data required to operate the game:
- Account data: username and hashed password (we never store plain-text passwords).
- Game progress: subjects completed, exercises solved, and currency earned.
- Preferences: chosen interface language (English or Spanish).
- Avatar: selected character appearance and cosmetic items.
- Usage data: anonymous request logs retained by Cloudflare for up to 30 days for security and abuse prevention.
We do not collect real names, email addresses, phone numbers, or payment information. We do not use cookies or third-party trackers.
3 · Children Under 13 (COPPA)
MathBugs is intended to be used under parental or teacher supervision. In compliance with COPPA:
- Player accounts for children under 13 must be created by a parent, guardian, or teacher (Administrator role).
- Children cannot self-register. All account creation is controlled by Administrators.
- We do not knowingly allow children to submit personal information beyond the gameplay data listed above.
- Parents or guardians may request a full data export or account deletion at any time (see Section 6).
4 · How We Use Your Data
- To authenticate players and maintain their session securely (JWT tokens).
- To save and restore game progress across sessions.
- To generate personalised arithmetic challenges based on subject configuration.
- To display leaderboards (only if the player opts in; disabled by default).
- To detect and prevent abuse (e.g., rate limiting login attempts).
We do not sell, rent, or share your data with third parties for marketing purposes.
5 · Data Retention
Gameplay data is retained for as long as the account is active. Accounts soft-deleted by an administrator are flagged as deleted but gameplay statistics may be retained in aggregate for up to 90 days before permanent removal.
Request logs at the infrastructure level (Cloudflare) are automatically purged after 30 days.
6 · Your Rights (GDPR)
If you are in the European Economic Area, you have the following rights:
- Right of access (Art. 15): Request a copy of all personal data we hold. Use
GET /api/v1/auth/me/export while logged in, or contact us.
- Right to erasure / right to be forgotten (Art. 17): Delete your account and all associated data via
DELETE /api/v1/auth/me (password confirmation required), or contact us.
- Right to rectification (Art. 16): Update your username or avatar from within the game settings.
- Right to data portability (Art. 20): Download all your data in machine-readable JSON format using the export endpoint above.
- Right to object (Art. 21): You may opt out of the public leaderboard at any time from the in-game settings.
To exercise any of these rights, contact us at privacy@mathbugs.example. We will respond within 30 days.
7 · Security
- Passwords are hashed with PBKDF2-SHA256 (100,000 iterations) — we cannot recover your password.
- All communication is encrypted in transit via HTTPS/TLS enforced by Cloudflare.
- Authentication uses short-lived signed JWT tokens (1-hour expiry).
- Rate limiting protects login and answer submission endpoints against brute-force attacks.
8 · Changes to This Policy
We may update this policy as the application evolves. The "Last updated" date at the top of this page reflects the most recent revision. Continued use of MathBugs after a policy update constitutes acceptance of the changes.