MathsFamily Privacy Policy

Effective Date: 13 July 2026   Last Updated: 29 July 2026

MathsFamily.com ("MathsFamily," "we," "us," or "our") provides free maths learning resources, quizzes, and tools. These help parents and teachers support the maths learning of their children and students. We take data protection seriously. We have written this Policy to comply with the General Data Protection Regulation (GDPR), the GDPR provisions specific to children ("GDPR-K"), and the U.S. Children’s Online Privacy Protection Act (COPPA).

This Policy explains what information we collect, how we use it, who we share it with, and the rights available to you. By using our website (the "Service"), you agree to the practices described here. If you do not agree, please do not use the Service.

1. Who This Policy Covers

MathsFamily is built for use by parents, teachers, and legal guardians who wish to help the children and students in their care learn maths. Our learning resources are freely accessible to all. Creating an account to track a child’s progress, however, is restricted to parents and legal guardians only - see Section 4 for details.

2. Who We Are / Controller Information

MathsFamily.com is operated as a data controller for the purposes of the GDPR. Our Service is deployed and hosted for users in the European Union.

• Controller: MathsFamily.com
• Contact email: info@mathsfamily.com
• Data Protection queries: info@mathsfamily.com (subject line: "Privacy Request")

3. Information We Collect

We collect the minimum information necessary to operate the Service. The table below sets out exactly what we collect, where it comes from, and why.

We do not knowingly collect personal information directly from children, and we do not require or request a child’s name, email address, or any other personal identifier to use the learning content.

4. Account Registration - Minimum Age 16

You must be at least 16 years old to create an account on MathsFamily.com. If you are under 16, a parent or legal guardian must register and manage the account on your behalf. Children under 16 are strictly prohibited from registering directly.

At registration, we ask for a self-declared birth year and require you to read and accept our Terms of Service and Privacy Policy before any account data is stored. The full text of your attestation and the timestamp are recorded as part of our consent audit trail. No personal data is written to our database until this step is completed.

Account creation and progress-tracking are not available to teachers. Teachers may use MathsFamily’s freely accessible learning resources, quizzes, and tools with their students, but do so without creating an account or having any student progress data collected or stored against their name.

If we become aware that an account has been created by someone under 16 without parental authorisation, we will suspend the account and delete the associated personal data.

5. How We Use Your Information

We use the information described in Section 3 only for:

• Creating, authenticating, and managing the registered adult’s account.
• Providing profile and progress-management features for that account holder’s own use.
• Operating, maintaining, and securing the Service.
• Analysing anonymized site usage via Google Analytics 4 (only after your consent, using anonymized IP addresses, with Google Signals and ad personalization signals disabled).
• Displaying contextual advertisements via Google AdSense to help keep the Service free (personalized ads only on adult-facing pages, and only with your consent - see Section 10).
• Responding to support requests and exercising data protection rights.
• Complying with our legal obligations, including maintaining the consent audit record.

We do not use your information for any other purpose. We do not build advertising profiles from account or progress data.

6. We Do Not Sell Your Information

We do not sell, rent, or trade your personal information, or your child’s progress data, to any third party, under any circumstances. We do not share this data with data brokers or use it for third-party marketing.

The only sharing that occurs is described in Section 7 below (service providers strictly necessary to run the Service) and any disclosure required by law.

7. Who We Share Information With

We use a small number of service providers to run the Service. The table below names each one, what they receive, and why.

We do not permit any service provider to use your data for their own purposes, and each is contractually bound to process data only on our instructions.

8. Legal Basis for Processing (GDPR, Article 6)

We rely on the following legal bases.

• Consent - for creating an account via Google Login, for analytics cookies, and for advertising cookies where applicable (Article 6(1)(a)).
• Contract - to provide the account and progress-tracking features you request (Article 6(1)(b)).
• Legitimate interest - for essential site security and the strictly necessary session cookies required for login, balanced against your rights (Article 6(1)(f)).
• Legal obligation - where we must retain or disclose data to comply with law, including maintaining our consent audit records (Article 6(1)(c)).

Where processing relates to a child’s data collected via a parent’s or guardian’s account, the parent/guardian provides consent and directs the processing on the child’s behalf, consistent with GDPR-K and COPPA.

9. Children’s Privacy - COPPA and GDPR-K Compliance

MathsFamily is designed so that any account-based tracking of a child’s activity happens only under the direct supervision and account of a parent or legal guardian. We comply with COPPA and GDPR-K as follows:

• We do not collect personal information directly from children.
• We do not permit children to independently register, log in, or submit personal information.
• Any personal data connected to a child’s learning activity (e.g., progress data) exists only within, and is controlled by, the supervising adult’s account.
• We do not use behavioral advertising or tracking cookies targeted at children. All advertisements on child-facing learning pages are non-personalized and contextual only.
• We do not condition participation in an activity on a child disclosing more information than is reasonably necessary.
• Parents and guardians may review, correct, or request deletion of any data associated with their child’s activity at any time (Section 12).
• We may learn that a child under 16 has provided personal information directly to us. We may also learn that an account has been created by someone under 16 without parental authorisation. In either case, we will promptly delete that information and, where applicable, suspend the associated account.

Parents and guardians with questions about our children’s privacy practices can contact us at info@mathsfamily.com with the subject line "COPPA/GDPR-K Request."

10. Advertising

We display advertising via Google AdSense to help keep the Service free for parents, teachers, and schools. When you visit MathsFamily.com, Google may use cookies - including the DoubleClick cookie - to serve advertisements based on your prior visits to this or other websites, subject to your consent.

• On child-facing and learning pages, advertisements are non-personalized and contextual only - no behavioral profiling or interest-based targeting is used on those pages, regardless of consent.
• On adult/general pages, personalized advertising may be shown to users who have given consent via our cookie consent banner. All advertising signals are blocked by default via Google Consent Mode v2 until explicit consent is received.
• We require our advertising partners to comply with COPPA and GDPR-K.

You can manage or opt out of Google’s personalized advertising at adssettings.google.com, and opt out of interest-based advertising more broadly at optout.aboutads.info. For more information on how Google uses data in connection with advertising, visit policies.google.com/technologies/ads.

11. Cookies and Tracking Technologies

We use the following categories of cookies and similar technologies.

• Strictly necessary cookies - access_token (1-hour session) and refresh_token (30-day rolling session), both HttpOnly and set only for logged-in users. Guest users who do not log in receive no cookies from MathsFamily.
• Analytics cookies - Google Analytics 4 (_ga, _ga_09E7E6B332) are only activated after you accept analytics on our consent banner. IP addresses are anonymized before any data reaches Google, and Google Signals are disabled.
• Advertising cookies - Google AdSense cookies (including __gads, __gpi, and the DoubleClick cookie) are only activated with your consent, and are never used for behavioral targeting on child-facing learning pages.

When you first visit MathsFamily.com, a banner appears asking for your permission before any analytics or advertising cookies are set. We implement Google Consent Mode v2 so all analytics and advertising signals are blocked by default until your consent is received. Your preference is stored in browser local storage and applies across all pages of the site. Full details are in our Cookies Policy.

12. Your Rights

If you are located in the European Union / EEA / UK, under the GDPR you have the right to:

• Access the personal data we hold about you.
• Rectify inaccurate or incomplete data.
• Erase your data ("right to be forgotten").
• Restrict or object to processing.
• Data portability (receive your data in a portable format).
• Withdraw consent at any time, without affecting prior lawful processing.
• Lodge a complaint with your local supervisory authority if you believe your rights have been violated.

If you are in California, you have equivalent rights under the CCPA. These include the right to know, delete, and opt out of sale/sharing of personal information. Note that we do not sell or share personal information as defined under the CCPA.

To exercise any of these rights, contact us at info@mathsfamily.com. We will respond within one month (GDPR) or as otherwise required by applicable law. We may need to verify your identity before actioning certain requests.

13. Data Retention

We retain personal data only for as long as necessary to:

• Provide the account and progress-tracking features (i.e., for as long as the account remains active).
• Comply with legal, accounting, or security obligations, including the consent audit record required under GDPR.

If an account is inactive for 24 months, or upon request, we will delete or anonymize the associated personal data, unless a longer retention period is required by law.

14. Data Security

We implement appropriate technical and organizational measures to protect your data, including:

• Encrypted transmission (HTTPS/TLS) across the entire Service.
• HttpOnly, Secure, SameSite=Lax session cookies that are inaccessible to client-side scripts.
• Short-lived access tokens (1 hour) combined with rolling 30-day refresh tokens, renewed on each active session.
• No personal data stored until explicit consent has been obtained and recorded.
• Access controls limiting internal access to personal data on a need-to-know basis.
• Use of reputable, contractually bound hosting and infrastructure providers (AWS).

No method of transmission or storage is 100% secure, and we cannot guarantee absolute security. If we become aware of a data breach affecting your personal information, we will notify affected users and relevant supervisory authorities without undue delay. This is in line with our legal obligations, including the GDPR’s 72-hour notification requirement to supervisory authorities where feasible.

15. International Data Transfers

Our core infrastructure includes compute (AWS Lambda), databases (AWS DynamoDB), and file storage (AWS S3). It is deployed in AWS eu-west-1 (Dublin, Ireland), which is within the European Economic Area. Personal data processed by these services remains within the EEA for all primary operations.

We also use Amazon CloudFront as our content delivery network. CloudFront operates a global network of edge locations, including locations outside the EEA (for example, in the United States and Asia-Pacific). When you access MathsFamily.com, your request may be routed through or served from an edge location outside the EEA, which may involve the temporary processing of your IP address and request metadata at that location.

All such international transfers are governed by Amazon Web Services’ Data Processing Addendum, which incorporates the European Commission’s Standard Contractual Clauses (SCCs) as the applicable transfer mechanism. AWS is also certified under the EU–US Data Privacy Framework. Further information on AWS’s data protection safeguards is available at aws.amazon.com/compliance/gdpr-center.

16. Third-Party Links

The Service may contain links to third-party websites or embedded content (e.g., videos). We do not control these third parties and are not responsible for their privacy practices. We encourage parents and teachers to review the privacy policies of any linked site before sharing information with it.

17. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. The "Last Updated" date at the top of this page will reflect the most recent revision. Material changes affecting how we handle children’s data will be communicated to registered account holders by email or an in-Service notice.

18. Contact Us

For any questions, requests, or concerns about this Privacy Policy or our data practices:

• Email: info@mathsfamily.com.
• COPPA / GDPR-K requests: info@mathsfamily.com. Use the subject line "COPPA/GDPR-K Request" for priority handling.
• General GDPR requests: info@mathsfamily.com. Use the subject line "Privacy Request".

This Privacy Policy works together with our Terms of Service, Cookies Policy, and Disclaimer.