1. Who We Are

MAF ("Math + Fun") is an educational math practice platform for children in grades 1–8, developed and operated by RiskXLabs LLC. This Privacy Policy explains how we collect, use, and protect information when you use our service.

Contact us at: Team@RiskXLabs.com

2. Information We Collect

Parent accounts:

• Email address (required for account creation and communications)
• Password (stored as a secure hash — we never see your actual password)
• Payment information (processed by Stripe — we never store raw card data)
• Notification preferences (email address and/or phone number if provided)

Child accounts:

• Username (chosen by the child — no real name required)
• Grade level and avatar selection
• Math session data: problems attempted, accuracy, time per problem, problem types
• Points earned and Robux redemption history
• Streak and badge data

What we do NOT collect from children:

• Real name
• Home address
• Phone number
• Photos or videos
• Location data
• Any information beyond what is needed to provide the educational service

3. How We Use Information

• To provide and personalize the math tutoring service
• To track progress and calculate reward points
• To generate AI-powered performance analysis and tutorial recommendations
• To send parents notifications about their child's progress (only if requested)
• To process subscription payments and gift card purchases
• To maintain the leaderboard (usernames only — no real names)
• To improve our service through aggregated, anonymized analytics

We do not use children's data for advertising, sell it to third parties, or use it for any purpose beyond providing the educational service.

We will never share your child's username, contact information, or any personally identifiable information with our affiliates, partners, or any third party for commercial purposes. Your child's identity within MAF is protected — their username exists solely to personalize their experience and display on the in-app leaderboard.

4. Children's Privacy (COPPA)

In compliance with the Children's Online Privacy Protection Act (COPPA), 15 U.S.C. §§ 6501–6506:

• Parental consent: We require a parent or legal guardian to create an account and provide consent before a child under 13 uses MAF.
• Limited data collection: We collect only the minimum information necessary to provide the educational service.
• No third-party sharing: We do not share children's personal information with third parties for marketing or advertising purposes.
• Parental access: Parents may review their child's information at any time through the parent dashboard.
• Parental deletion: Parents may request deletion of their child's account and all associated data at any time.
• No retention: We do not retain children's personal information longer than necessary to provide the service.

5. Parental Rights

As the parent or legal guardian of a child using MAF, you have the right to:

• Review all personal information we have collected about your child
• Request correction of inaccurate information
• Request deletion of your child's account and all associated data
• Refuse further collection of your child's information by deleting their account
• Consent to collection and use of your child's information without consenting to disclosure to third parties

To exercise any of these rights, contact us at Team@RiskXLabs.com or use the account deletion feature in the parent dashboard.

6. Data Sharing and Third Parties

We share data only with the following service providers who are necessary to operate MAF:

• Firebase (Google): Authentication and database storage. Firebase Privacy Policy →
• Anthropic: AI tutoring responses. Session questions and performance context are sent to generate tutoring content. No personally identifiable information is included. Anthropic Privacy Policy →
• Stripe: Payment processing for subscriptions and gift card purchases. We never store raw payment card data. Stripe Privacy Policy →
• Cloudflare: Hosting and content delivery. Cloudflare Privacy Policy →

We do not sell, rent, or trade personal information to any third party.

We will never share your child's username, contact information, or any personally identifiable information with affiliates, marketing partners, or advertising networks — regardless of any business relationship RiskXLabs LLC may have with those entities.

7. Data Security

• All data is transmitted over HTTPS (encrypted in transit)
• Passwords are hashed using Firebase Authentication — we never see them
• Payment data is processed by Stripe and never stored on our servers
• Firestore security rules restrict data access to authorized users only
• Firebase credentials are stored as encrypted secrets — never in source code

8. Data Retention

We retain account data for as long as the account is active. When an account is deleted, all associated data is permanently removed from our systems within 30 days. Anonymized, aggregated analytics data (with no personally identifiable information) may be retained indefinitely.

9. Cookies and Tracking

MAF uses browser localStorage to store session preferences and login state. We do not use advertising cookies or third-party tracking pixels. Cloudflare may collect anonymized traffic analytics (page views, device types) as part of hosting the service.

10. Changes to This Policy

We will notify parents of material changes to this Privacy Policy by email and by displaying a notice in the app at least 30 days before changes take effect. For changes affecting how we collect or use children's data, we will obtain fresh parental consent where required by COPPA.

11. Contact Us

For privacy questions, parental rights requests, or data deletion requests:

Email: Team@RiskXLabs.com

For COPPA-related inquiries you may also contact the FTC: www.ftc.gov/coppa →