Legal

Privacy Policy

Effective September 6, 2026 · Version 1.4

The short version

• Children only interact with Numblewick through a profile a parent creates. Kids never enter an email, phone number, or address.
• We collect the minimum data needed to run a math tutor: a display name (typically the child's first name) and grade for each child; an email and first name for each parent.
• We never sell child-specific data. We never build ad profiles from a child's activity.
• Aggregated, anonymized statistics (like "grade-3 accuracy on fractions") may be shared or used commercially — but never anything that could identify a specific child or family.
• You can delete a child profile, an uploaded worksheet, or your entire account at any time from the parent dashboard.

1. Who this policy is for

This Privacy Policy explains what Numblewick collects, why, how we protect it, and what choices you have. It applies to numblewick.com and the Numblewick apps ("Service"). It works alongside our Terms of Service; where the two documents overlap, both apply.

2. Data we collect from children

Numblewick is built for kids in grades 1–7. Because of COPPA and because it's the right thing to do, we collect only what's strictly needed to run the tutor:

• Display name — typically the child's first name, though a parent may enter a nickname or initial instead. This name is shown in the child's own login screen and inside the parent dashboard; it is not shown to other families.
• Grade level.
• Practice activity — problems attempted, answers, scores, hints used, session length.
• Uploaded homework and worksheets (optional, parent-initiated only) — see Uploaded homework and worksheets for the full details, because these files are the most identifying data Numblewick touches.

We do not collect a child's email, phone number, home address, photo of the child, precise location, biometric data, or contacts. We do not ask children for any personal information beyond what their parent enters into the profile.

3. Uploaded homework and worksheets

Parents can optionally upload a photo, PDF, or Word document of their child's homework, tests, or worksheets from the parent dashboard. Numblewick reads the file with an AI model and generates similar practice problems for the next few weeks. Because these uploads are the most identifying data we handle, we treat them separately from the rest of the policy:

• What the files typically contain. A photo of schoolwork frequently includes the child's handwritten first name. It may also include a teacher's name, a class period, a school name, or the date. We do not ask for these details — they are simply what's visible on the page.
• Parent-initiated only. The upload feature lives exclusively in the parent dashboard. Children do not see the upload UI and cannot upload files themselves.
• Sent to Anthropic for processing. The uploaded file is transmitted to Anthropic's Claude API so the model can read the problems on the page and generate similar practice questions. Under Anthropic's standard API terms, inputs and outputs are not used to train their models and are retained by Anthropic for up to 30 days solely for abuse-detection and trust-and-safety review, after which they are deleted.
• Storage on our side is short-lived. The uploaded file is deleted from our storage immediately after the AI finishes reading it (and, in every case, within 24 hours of upload — a scheduled cleanup runs daily as a backstop for any file whose processing did not complete). Uploaded files are never shown to other families and are never used for advertising or third-party AI training.
• What we keep after that. The practice problems the AI generated from your worksheet remain in your Numblewick account so your child can use them, and so you (and any co-parent you invite) can see which practice came from which worksheet. You can delete these generated problems at any time from the Problem Library.
• How to delete it. Open the Problem Library section of the parent dashboard, find the document, and choose Delete — this removes the generated problems (the raw file is already gone). Closing your Numblewick account removes every worksheet, every derived problem, and all other family data (see Data retention & deletion).

4. Data we collect from parents

• Email address — required for account authentication and progress reports you opt into.
• First name.
• Optional profile fields such as state and school name, used only to personalize content (e.g., aligning practice to your state's standards).
• Technical usage data such as device type, browser, and IP address — used for security, debugging, and aggregated analytics.

We do not collect a parent's phone number, home address, payment card, or government ID. Numblewick is currently free during our launch phase.

5. How we use the data

• Run the practice sessions and adjust difficulty in real time.
• Generate hints, walkthroughs, and progress reports.
• Authenticate parent accounts and keep them secure.
• Send progress emails you have explicitly requested.
• Improve our curriculum and algorithms using aggregated, de-identified statistics (see How we do not use the data).
• Comply with legal obligations and detect abuse or fraud.

6. How we do not use the data

• We do not sell or rent personally identifiable information about any child or parent.
• We do not use a child's name, grade, or performance to serve targeted advertising.
• We do not allow third parties to track individual users across the internet from within Numblewick.
• We do not share individual student data with schools or districts without your explicit written consent.
• We do not use children's data to train third-party AI models beyond the transient use needed to answer the immediate request (see Third-party services we use).

7. Aggregated & de-identified data

We may combine data across many users to produce statistics — for example, "students in grade 4 solve long-division problems with 68% accuracy on average." These aggregates cannot be traced back to any individual child, family, or account. We may use these aggregates to improve the Service, publish research, and support advertising or partnership activities as described in our Terms of Service. Individual child records are never used commercially.

Opt-out: If you'd prefer your account's anonymized usage patterns not be included in these aggregates, email support@numblewick.com with the subject "Data Opt-Out." We'll process the request within 30 days without affecting your access to the Service.

8. When we share data

We share information only in these situations:

• Infrastructure providers that host and secure the Service, listed under Third-party services we use.
• Family members you invite (e.g., a second parent) — they can see the practice data for the shared child profile.
• Legal compliance — if required by valid legal process, we may disclose information; where the law permits, we'll try to notify you first.
• Business transfers — if Numblewick is ever acquired or merged, personal data may transfer to the successor entity, which must honor the commitments in this policy or notify you and give you a chance to delete.

We do not sell personal information to advertisers, data brokers, or any third party.

9. Third-party services we use

• Google Firebase — authentication, database, file storage, and hosting.
• Anthropic Claude API — AI-generated hints and worksheet-derived problems. Uploaded worksheets and prompt text are sent to Anthropic solely to fulfil the immediate request. Under Anthropic's standard API terms this content is not used to train Anthropic's models, and is retained by Anthropic for up to 30 days for abuse-detection and trust-and-safety review only.
• Resend — transactional email (progress reports, password resets). Resend has access only to the email address and the message contents.

See Uploaded homework and worksheets for how homework uploads are handled end-to-end.

10. Payment information

When you subscribe, payment is processed by our payment provider. We receive a record that a payment succeeded, the amount, and the last four digits of the card. We never see or store your full card number. Our provider processes card details under its own privacy policy and PCI-DSS obligations.

11. Data security

Data is transmitted over TLS, stored with encryption at rest via our infrastructure providers, and access is limited by authentication and role-based controls. No system is perfectly secure — please use a strong, unique password for your parent account.

12. Data retention & deletion

• Uploaded homework files are auto-deleted from our storage within 24 hours of upload — usually within seconds of the AI finishing processing. See Uploaded homework and worksheets.
• Child profile data (name, grade, avatar, practice history) is retained while the profile is active. Deleting the profile from the parent dashboard removes it (and all associated practice history and generated problems) from our production database immediately.
• Parent account data is retained for as long as the account is open. You can permanently delete your account at any time from Settings → Danger zone → Delete account. This cascade-deletes every child, every session, every uploaded document, and your parent login itself from our production systems in the same request.
• Aggregated, de-identified statistics may be retained indefinitely as they cannot be tied to any individual.
• Encrypted backup snapshots may retain data for up to 30 days before rotating out. We do not restore from backups to reintroduce deleted data except in a disaster-recovery event.

13. Your rights & choices

• Access, update, or delete any child profile or your account from the parent dashboard.
• Download your child's practice history by emailing support@numblewick.com.
• Email preferences. Marketing emails and practice-progress emails are opt-in only, controlled by the two checkboxes on the sign-up form. Change them anytime at Email preferences or by tapping the unsubscribe link in the footer of any Numblewick email. Transactional emails (invites, password resets, account-deletion confirmations) always send when needed.
• Opt out of aggregated commercial data use (see Aggregated & de-identified data).
• Residents of California (CCPA/CPRA), Colorado (CPA), Virginia (VCDPA), the EU/UK (GDPR), and other jurisdictions with data-protection laws have additional rights, including to access, correct, delete, or port their personal data, and to lodge a complaint with a supervisory authority. Contact us to exercise any of these rights.

14. Cookies & local storage

We use browser local storage and first-party cookies to keep you logged in, remember your language preference, and cache assessment progress. We do not use third-party advertising cookies. We do not use cross-site trackers.

15. International users

Numblewick is operated from the United States. If you access the Service from another country, your data will be transferred to, stored, and processed in the U.S. and any Google Cloud region our infrastructure uses.

16. Changes to this policy

If we make material changes, we'll notify you by email and/or an in-app notice at least 14 days before the changes take effect. Continued use after the effective date constitutes acceptance.

17. Contact us

Privacy questions, data requests, or COPPA concerns: support@numblewick.com. We aim to respond within 5 business days.