Privacy policy | Math Mastery for All

Who we are

Math Mastery for All (“we”, “us”) is a free, student-led maths education programme at mathmasteryforall.in, founded and run by Tanish Jain. For any privacy question, or to use any of your rights below, email [email protected].

What this website collects

No sign-up. You can use every page, worksheet, paper and test without telling us who you are. Student logins are optional and are made only by teachers, with a parent's consent (see Student accounts).
No analytics or advertising trackers on our pages. We do not use Google Analytics, Facebook pixels or any similar tool, and we show no adverts. The only cookie is the login cookie described below, and it is set only when someone logs in.
Hosting logs. The site is hosted on Cloudflare Pages. Like any web host, Cloudflare processes technical data such as IP addresses and browser type to deliver pages and protect the site from attacks. We do not use this data to identify visitors.
Video lessons. Our lessons are hosted on YouTube. Nothing loads from YouTube until you press play on a video. When you do, the video plays in YouTube's privacy-enhanced mode, and Google's privacy policy applies to that video.
Settings on your device. Your browser's own local storage remembers a few things so the site works better for you: the grade you last chose, your last test settings and recent test scores, and a list of short codes for the practice questions already shown, so that new tests don't repeat them. None of this leaves your device. You can clear it at any time in your browser settings, or with Forget them on the test page. If you log in, your browser also remembers the name shown in the menu, so the site can show it.

Student accounts

Students can have a login, so that their practice is saved and their teacher can see how they are doing. A teacher can make one for their own students, or a student can sign up and our programme administrator approves it. Logging in is always optional.

Who makes accounts. A teacher or our programme administrator can create a student account after confirming that a parent or guardian has given consent; we record when that confirmation was made and by whom. A student can also sign up themselves: they tick a box to say that a parent or guardian knows and agrees, and we record that they said so and when. We do not check this with the parent ourselves. A sign-up is only a request: nobody can log in with it until our programme administrator approves it and chooses the student's teacher.
Sign-up requests. While a sign-up waits, we keep only the name and grade the student gave, the username, the password in hashed form, and the time they said a parent or guardian agrees. No email address or other contact details. The request is deleted when it is approved (it becomes the account) or rejected, and unanswered requests are deleted after 30 days. Only our programme administrator can see requests.
What we store. A username, the name given for the student (we ask for first name and last initial only), the grade if given, and the password in scrambled (hashed) form that cannot be turned back into the password. We do not ask for email addresses, phone numbers, schools or dates of birth. While a student is logged in, we save each test they mark and each problem they check: the questions, their answers, the right answers, how many hints they opened on each question, roughly how long they spent on each question, their score, the total time and the date. If a teacher sets homework, we store its title, the settings of the paper (grade, topics, length, style), an optional due date, which students it is for, and whether each student has handed it in, linked to the marked test that handed it in. Nothing is recorded about what they type before they mark the test or check the answer.
Who can see it. The student, the teacher who looks after them, and our programme administrator. No one else, and it is never published.
The login cookie. Logging in sets one cookie, which holds a random code that keeps you logged in for up to 14 days. It is strictly necessary for the login to work, is not used for tracking, and is deleted when you log out.
Where it is kept. In a Cloudflare D1 database, run by Cloudflare as our hosting provider.
How long. Until the account is deleted. A teacher can delete a student's account and everything saved about them at any time, and a parent or guardian can ask us to do it by email; we will do so within 7 days.

Trainee accounts

Volunteers who want to teach with us are trained on this website before they can look after any students. A volunteer can sign up themselves, or our programme administrator can make their login.

Who has one. Volunteers aged 18 or over, and volunteers under 18 whose parent or guardian has agreed. When volunteers under 18 sign up themselves, they tick a box to say that a parent or guardian knows and agrees; we record that they said so and when. We do not check this with the parent ourselves. When the administrator makes the login, the administrator confirms the age, and for anyone under 18 that a parent or guardian has consented, and we record who confirmed it and when. A parent or guardian can ask us at any time to delete a volunteer's account.
What we store. A username, the name given at sign-up (we ask for first name and last initial), whether they are 18 or over or under 18 with a parent's or guardian's agreement (and who confirmed it and when), whether they signed up themselves, their school grade (or that they have left school), the highest grade they will teach, and the password in hashed form. We do not ask for email addresses or phone numbers. As they train, we save their answers to each module quiz and their scores; each subject test they take, with the questions, their answers, the right answers, their score and the time; their written answers to the teaching assessment; the administrator's scores and feedback on those answers; the administrator's notes and checklist from watching them teach; and the date they were certified. Every child, class and result in the training is made up: trainees never see a real child's data.
Who can see it. The trainee and our programme administrator. No teacher, student or parent can see it, and it is never published.
The login cookie and where it is kept. The same as for student accounts above.
Checking sign-ups are made by people. The sign-up pages (for volunteers and for students) use Cloudflare Turnstile to stop automated sign-ups. It runs only on those two pages. Turnstile looks at technical signals from your browser and device, such as how the page is used, to decide whether you are a person; it does not use cookies to track you across websites. Cloudflare's privacy policy applies to that check.
How long. Until the account is deleted. A trainee can ask us by email to delete their account and their training record, and we will do so within 7 days. When a trainee is certified, their account becomes a teacher account and their training record is kept with it, so we can show they were trained, until they ask us to delete it.

When you email us

If you email us, or use the feedback form (which only opens your own email app), we receive your email address and whatever you choose to write. We use it only to reply, to arrange tutoring or partnerships you ask about, and to improve the programme. We keep emails for up to 12 months after our last contact, unless you ask us to delete them sooner.

Children's personal data

Most of our students are children. In line with India's Digital Personal Data Protection Act, 2023:

For students, we process a child's personal data only with the consent of a parent or lawful guardian. When a teacher makes the account, the teacher confirms that consent. When a student signs up themselves, we rely on their statement that a parent or guardian agrees, and nothing is saved for them until our administrator approves the sign-up. For volunteer tutors under 18 who sign up themselves, we rely on their statement that a parent or guardian agrees (see Trainee accounts).
We never track, profile or behaviourally monitor children, and never target advertising at them.
On our Results page we show a child's first name, last initial and grade only, and only with written consent from a parent or guardian. We do not publish full names, schools, photographs or ranks of children.
A parent or guardian can withdraw consent at any time by emailing us, and we will remove the child's details from this website promptly, and within 7 days.
Detailed contest results are shared only with the child's own parent or guardian, on request.

We ask children not to send us personal information. Volunteers under 18 should ask a parent or guardian before signing up to train, and copy them in if they email us.

Sharing

We do not sell, rent or trade personal data. We share it only when a parent or guardian asks us to (for example, to help register their child for a contest), or when the law requires it.

Links to other websites

Some pages link to other sites, such as news articles and answer keys hosted on Google Drive. Those sites have their own privacy policies, which apply when you visit them.

Your rights

You can ask us to tell you what personal data we hold about you or your child, to correct it, or to erase it. You can also nominate someone to exercise these rights on your behalf. Email [email protected] and we will respond within 30 days. If you are not satisfied with our response, you may complain to the Data Protection Board of India.

Security

The website is served only over encrypted HTTPS connections. We keep the little personal data we receive by email in a password-protected email account with two-step verification, and only the founder has access. Account passwords are stored only in hashed form, repeated wrong guesses are slowed down, teachers can see only their own students, and trainees can see only their own training.

Changes to this policy

If we change this policy we will update it on this page and change the date at the top.