Privacy policy
Effective from 13 October 2026
mathme.lol is a game where pupils and adults send each other maths challenges. We collect as little data as possible: we never ask for your name, e-mail, phone number, date of birth or location. There are no ads and no tracking cookies.
1. Who is responsible for your data
The data controller is the owner of mathme.lol. For anything about your data, write to contact@mathme.lol. Include your nickname and player ID (shown in your profile and in the key file) - never send us the key itself.
2. What data we process
| Data | Why | Legal basis (GDPR) |
|---|---|---|
| Nickname, emoji, country, language | Profile, rankings (world and country), questions in your language adapted to your country | Art. 6(1)(b) - providing the service under the Terms |
| Player key (we store only its HMAC hash, never the key) | Logging in without a password or e-mail | Art. 6(1)(b) |
| Gameplay: challenges, answers, points, practice, daily question, groups, experience, day streak, badges, time zone (offset in minutes) | Running the game, results, profile stats, counting your streak by your own calendar | Art. 6(1)(b) |
| Reports of wrong questions (only which question - no text from you) | Fixing questions | Art. 6(1)(f) - legitimate interest: game quality |
| Learning log: which tasks and words you practised, whether the answer was right, how long it took and when (not the answer text) | Reviews at the right time (Daily review, “What I know”) | Art. 6(1)(b) |
| Player reports (the “🚩 Report player” button): who reported, whom, a reason picked from a fixed list (inappropriate nickname, inappropriate group name, something else) and the time - no text from the reporter. A report doesn’t change anything in the game | Moderation and children’s safety: the administrator checks the reported account (e.g. changes an inappropriate nickname or group name). Only the administrator has access; the reported player is never told who reported them | Art. 6(1)(f) - legitimate interest: players’ safety |
| Notification subscription (device address at the push service and encryption keys) | Notifications about challenges, results and invitations | Art. 6(1)(a) - consent given in your browser; you can withdraw it at any time |
| IP address, date and time, requested page, server response code, browser type (server logs) | Security and abuse prevention (request limits, bot protection, attack detection), troubleshooting and analysing how the game works. The IP is not stored in the game database or linked to your ranking profile | Art. 6(1)(f) - security and proper operation of the service |
We make no decisions about you based solely on automated processing that produce legal effects. Answers in the game are checked automatically - that is simply how the game works.
3. Cookies and browser storage
- mm_token - a single cookie that is strictly necessary for the game (login). Scripts cannot read it (httpOnly); it lasts up to 400 days.
- Browser storage (localStorage) keeps your settings: language, theme, last grade and category, earned badges (so we only celebrate new ones). This data is not sent to the server.
We use no analytics, advertising or tracking cookies, which is why the game shows no cookie consent banner.
4. Who receives data
- OVH Sp. z o.o. (Poland) - the server running the game and the database (EU).
- Cloudflare, Inc. - protection and fast delivery of the site. It sees your IP address and technical connection data. Processing outside the EEA may occur under standard contractual clauses / the Data Privacy Framework.
- Anthropic PBC (USA) - the AI model that writes and checks questions. We send it no personal data: to create a question we pass only the grade, category, language and country. If you write an answer in words (without digits), just that text - without your nickname or ID - may be sent to the AI to read the number. Don’t type personal data into answers.
- Google LLC (Google Fonts) - your browser downloads fonts from Google’s servers, so Google sees your IP address.
- Push services (Google, Apple, Mozilla, Microsoft - depending on your browser) - only if you turn notifications on. Notification content is encrypted; the service sees a device identifier.
We don’t sell data or share it with advertisers. Other players only see your nickname, emoji, country, language, points, level, streak, badges, game stats and whether you are in the game right now (a green dot on your avatar).
5. How long we keep data
- Account and game data - until you delete your account (you can do it in your profile). Accounts unused for 24 months may be deleted.
- Server logs (with IP address) - for a limited time: the system deletes the oldest entries automatically.
- Database backups - up to 14 days.
- Question reports - until reviewed, at most 12 months; after you delete your account they are no longer linked to you.
- Learning log - 90 days (older entries are deleted automatically).
- Player reports - 12 months (older ones are deleted automatically), or earlier when the reporting or reported account is deleted. Your data copy (“Download my data”) shows only your own reports.
- Notification subscriptions - until you turn notifications off, log out, or the browser expires them.
6. Your rights
You have the right to access, correct and delete your data, to restrict processing, to data portability, to object to processing based on legitimate interest, and to withdraw consent for notifications. You can do most of this yourself in the game:
- Profile → Edit - change nickname, emoji, country, language.
- Profile → Your data → Download my data - a copy of all your data (JSON file).
- Profile → Delete account - permanently deletes your account and game history.
- Profile → Notifications - turn notifications off.
You may also lodge a complaint with a supervisory authority - in Poland, the President of the Personal Data Protection Office (UODO, ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl), or the authority in your country.
7. Children
The game is also meant for primary-school pupils, so we collect no data that could identify someone. Don’t use your real name as your nickname. If you are under 16, show this page to a parent or guardian. A parent or guardian can ask us to delete a child’s account - just give us the nickname and player ID.
8. Security
The connection is encrypted (HTTPS). Player keys are stored only as HMAC hashes with a secret server key. Correct answers never reach the browser before a question is finished. We use request limits, bot protection and server logs to detect abuse.
9. Changes
We’ll announce important changes to this policy in the game. The current version is always at this address.