Privacy Policy

Maths Tycoon ("we", "us") is an educational maths game. During the closed beta the service is operated by the Maths Tycoon team. You can reach us at privacy@mathstycoon.uk.

Maths Tycoon is intended for children aged roughly 5–11. Accounts are created with an email address, and we ask that a parent, guardian or supervising teacher creates the account and stays involved. We do not currently have an automated age-verification or parental-consent mechanism — consent is given by the adult who creates the account and accepts these terms.

We only collect what the game needs to work:

• Account information — email address and password (the password is stored securely, hashed, by our authentication provider), plus the date the account was created.
• Username — a display name chosen at signup. Please choose a nickname, not a child's full real name.
• Year group — Year 1 to Year 6, used to pick suitable questions.
• Game and progression data — gold coins, XP, level, badges/achievements, avatar and character customisation choices, daily streaks and onboarding status.
• Quiz performance — questions attempted, whether answers were correct, topic, difficulty and time taken.
• Mastery / progress data — a per-subskill mastery score used to choose the next questions.
• Inventory and items — shop items owned, what is equipped, and colour/finish customisation.
• Battle results — solo battle outcomes, scores and rewards.
• Investment data — in-game (pretend) investments owned and virtual earnings collected.
• Beta feedback and waitlist information — if you join the waitlist or send feedback: the email address and message you provide, plus the page you sent it from.
• Basic technical data — our hosting and database providers process standard connection information (such as IP address) in their logs to deliver and secure the service.

We do not collect real names, addresses, phone numbers, school details, photos, voice or location data. There is no chat, no messaging between users, no advertising, no advertising identifiers, no third-party analytics and no behavioural tracking or profiling for marketing.

• To create and run the account and keep the child signed in.
• To choose maths questions at the right year group and difficulty, and to adapt to weaker subskills.
• To save progress: coins, XP, levels, items, collections, battles and investments.
• To show leaderboards. Leaderboards only reveal a rank, username, avatar, level and a score — never email addresses or answer-level history.
• To manage closed-beta access and to read and act on feedback.
• To keep the service secure and to fix faults.

We do not sell data, share it with advertisers, or use it to build marketing profiles.

We rely on the necessity of processing to provide the service the account holder asked for, and on our legitimate interest in keeping the service safe and working. Where consent is the appropriate basis — including consent given by a parent or guardian on behalf of a child — that consent is given when the adult creates the account and can be withdrawn by deleting the account. This section in particular should be confirmed by a qualified adviser before public launch.

• The child / account holder — signed in, they can see their own data.
• Other players — only the limited leaderboard fields listed above.
• The Maths Tycoon team — a small number of people, only where needed to run the beta, respond to a request, or investigate a fault.
• Nobody else. Anonymous (signed-out) visitors cannot read any player data.

• All traffic is encrypted in transit (HTTPS).
• Passwords are hashed by our authentication provider; we never see them.
• Database row-level security means each signed-in account can only read its own records.
• Coins, XP, items and rewards are changed only by server-side rules, not by the browser.
• Access to the production backend is limited to the operating team.

• Supabase — database, authentication and account emails (such as verification and password-reset emails).
• Lovable — application hosting and deployment.

These providers process data on our instructions. Depending on provider infrastructure, data may be processed outside the UK; providers use standard contractual safeguards. We use no other third-party service — no analytics, no advertising networks, no social plug-ins.

We keep account and progress data for as long as the account exists, because it is the child's saved game. If an account is deleted, the account and its linked game data are removed. Waitlist and feedback entries are kept for the duration of the beta programme and then deleted. Provider security logs follow those providers' own short retention periods.

Parents, guardians and account holders can ask us to access, correct, export or delete the data we hold. Under UK GDPR you also have the right to object to or restrict processing and to complain to the Information Commissioner's Office (ICO).

The quickest route is the Account & data page when signed in: it shows exactly what is stored, lets you download a copy of your own data, and lets you submit a deletion request. Deletion requests are actioned manually by our team during the beta, normally within 30 days. You can also email privacy@mathstycoon.uk.

If we change what we collect or how we use it, we will update this page and change the date at the top. Significant changes during the beta will also be mentioned in-app.

Questions, requests or concerns: privacy@mathstycoon.uk. See also our parent & guardian guide and Terms of Use.