Privacy Policy

Who we are

Magic Math Sparkies is a maths practice app for primary school children in Singapore. In this policy, “we” and “us” mean Magic Math Sparkies, and “you” means the parent or guardian who sets up the account.

Our Data Protection Officer looks after your family's information. How to reach them is under Questions and complaints, below.

What we collect

We keep only what we need to teach your child and to run your account.

About you

• Your email address and your password. We keep the password only in a scrambled form that nobody can read back. The same goes for your Parent Mode PIN, if you set one.
• Your name, if you give it to us.
• Your plan, and whether each payment went through. Stripe tells us this. We never see your card number.
• Your consent record: what you agreed to, when, which version of this policy, and the internet address of the device you used.
• Sign in records, for you and your child: when you signed in, the device's internet address, and a code made from the browser's details. They help us spot a sign in that is not you.
• The treats you set up for your child, and any picture you add to one.
• Your settings, such as daily time limits and which emails you want.
• What you send us: messages through our contact form, and notes from the feedback button in the app.
• If you ask us for a TheFirst50 place: your email address, your phone number if you choose to give it, how many children would learn and their levels, and which link brought you to us, if any.

About your child

• Their first name, which you type when you set up their account. It is how we greet them.
• Their school level, P1 to P6.
• Their companion: which one they chose, and the name they gave it.
• Their answers, their working (typed or drawn), how long they take, and their progress, badges and the rewards they earn in the game.
• When, and for how long, they use the app.
• Their friends in the app, only if you switch Friends on.

What we do not collect

We do not ask for your home address, or for your child's age, birthday, school or photo. We do not collect your location or your child's location. We never ask your child for their own email address.

Why we use it

We use your family's information only for these reasons:

• To teach your child: to choose questions at their level, mark their answers, give hints, and suggest what to practise next.
• To show you how they are doing: in Parent Mode, and in the emails we send you about your child.
• To run your account: to sign you in, take payment for your plan, and send you emails about your account.
• To keep accounts safe: to spot sign ins and sign ups that are not genuine, and to stop misuse.
• To answer you: when you write to us, or ask us for a place.
• To fix problems: error reports tell us when something breaks.
• To make the app better: we count how the app is used, such as which screens are opened.

We do not use it for anything else without asking you first.

We never sell your information, and we never share it with anyone for their own marketing. Some of our emails invite you back after a free period ends. Those, and many of our other emails, have a link at the bottom to stop them or to get fewer. To stop any other email, write to us. Emails you need to use your account, such as sign in links, still come.

Your child's information

Singapore's Personal Data Protection Commission asks for extra care with children's information. Here is what that means at Sparkies.

You set up your child's account, and you give consent for your child. Every child's account is set up and agreed to by a parent or guardian.

Your child can try the app before you set up an account. That trial has no name in it, and we delete it 30 days after it starts. If your child wants to keep their progress, they can type your email address and their level, and we email you a link. Nothing is saved to an account unless you open the link and agree.

Our promises about your child:

• We never show ads to your child.
• We never sell your child's information, and we never use it to build a profile for advertising.
• Your child's profile is never public, and nobody can find it by searching.
• Other children never see your child's name, level or progress. Friends starts switched off. If you switch it on, a friend sees only your child's companion: what kind it is, and its name. You can switch it off again at any time.
• We never collect your child's location.

If something goes wrong with your child's information, we tell you. See If something goes wrong, below.

How we use AI

When your child's answer needs more than a tick, we send that question, their answer and their working, typed or drawn on the screen, to our AI provider, so the answer can be read and marked and a helpful question sent back. We do not send your child's name. The AI sees a stand-in word, and our own server puts the name back into the reply before your child reads it. If your child writes or draws their own name in their working, the AI will see it there. A clearly correct answer is marked on our own server, and nothing about it is sent to our AI provider.

If your child is trying the app without an account, nothing personal is sent. The request carries the fixed word "Explorer" instead of a name, and none of their working.

When the Practice Dungeon re-teaches an idea your child keeps missing, we also send their level, the topic, how many times that same slip has come up with a short note of what it was, and their companion's name.

We never send your email address, your address, your payment details, or your child's school.

AI does not write our lessons or worksheets. Those are built and checked in advance, so no child's data is involved in making them.

How we keep our AI safe for children

Sparkies is made for children. We follow Singapore's Personal Data Protection Act, and because children read what our AI writes, we add these safeguards:

• A grown-up behind every account. Every account is set up by a parent or guardian, who gives consent for each child. A child cannot make an account on their own. We send a link to the grown-up's email address to check that it is theirs. We never ask your child's age: we ask for their school level instead.
• Strict rules on every request. Each time we ask our AI for a reply, we give it the rules for a children's app: no violence, no grown-up topics, nothing unkind, and never asking for personal details.
• Every reply is checked. Before your child sees a reply, our own server checks it for words that are not safe for children. We also check the hints and new explanations: they must suit your child's level, and must not just give away the answer. If a reply fails a check, your child sees words we wrote and checked in advance instead.
• Your child knows it is AI. When your child first meets their companion, we tell them it is an AI companion: it comes from a computer and is not a person. Their profile page says so too, and we remind them from time to time.
• Telling us when something is wrong. Inside the app, every screen has a feedback button. You or your child can use it to tell us something looked wrong, and the note comes straight to us. You can also write to us at hello@magicsparkies.com.

Companies that help us

We use these companies to run Magic Math Sparkies. Here is what each one receives, and where it handles it.

• Anthropic (Claude), our AI provider. Some of your child's answers and their working, typed or drawn, so the answers can be marked and a mistake can be explained in a new way. We do not send your child's name. See How we use AI above. Anthropic keeps what we send for up to 30 days, to run its service and to check for misuse, and then deletes it, unless the law says it must keep it longer. If its safety systems flag something as possible misuse, it may keep that for up to 2 years, and it keeps the score from its safety check for up to 7 years. Its terms do not let it use what we send to train its AI. Where: United States.
• Railway, our hosting. Our servers and our database run on Railway, so everything in your account is stored there. Where: Singapore.
• Cloudflare, our network, storage and visitor counts. Our website runs through Cloudflare, which also stores our pictures and our encrypted backups. Like any network that carries a website, it sees your device's internet address and the pages you open. Cloudflare also counts visits to our public pages, such as this one, so we know how many people find us. It does this without cookies and without identifying anyone. Where: Many countries, through the Cloudflare centre nearest you. Our encrypted backups are kept in its Asia Pacific region.
• Resend, our email service. Your email address and the emails we send you. An email can mention your child's name in the app and how they are doing. Where: United States.
• Stripe, our payment service. Your email address and the plan you choose. You type your card details on Stripe's own page, so we never see them. Where: United States.
• Sentry, our error reports. When something goes wrong, a short report of the error, the page it happened on and the type of browser. For a small share of visits, it also gets how long pages took to load. The report leaves out what you or your child typed, and we remove email addresses and sign in details from it. Where: Germany.

We give each company only what it needs to do its job for us. Anthropic (Claude), Cloudflare, Resend and Stripe include a data protection agreement in the standard terms we accepted to use them. We have signed a separate data protection agreement with Railway and Sentry.

We also give information to a government body or a court if the law requires us to.

Sending information outside Singapore

Our servers and our database are in Singapore. Some of the companies above handle information in other countries: Anthropic (Claude), Cloudflare, Resend, Stripe and Sentry. The list above says where.

We stay responsible for your information wherever they handle it. For Anthropic (Claude), Cloudflare, Resend and Stripe, the promise to protect it is in a data protection agreement that is part of the terms we accepted to use them.

Cookies

A cookie is a small file a website keeps in your browser. We use only our own cookies. They are needed to sign in and to keep your account safe, and two of them remember a trial or an unfinished sign up on this device. We do not use advertising cookies, and no other company sets cookies on our site.

• session: Keeps your child signed in on this device.
• parent_token: Keeps you signed in to Parent Mode.
• csrf_parent: A security check that stops another website from acting in your name.
• csrf_student: The same security check, for your child's side of the app.
• mmk_guest_code: Remembers your child's trial on this device when they are trying the app without an account.
• parent_trial_status: Remembers that you started setting up your account and have not finished, so we can take you back to finish it.

If you turn these cookies off in your browser, signing in will not work. The app also keeps a few small things in your browser's own storage, such as your child's companion and where they were on the map, so the game opens where they left off.

Withdrawing your consent

You can withdraw your consent at any time, and it is as easy as giving it.

• To stop everything: in Parent Mode, open Settings, then use Delete my account and all our data. We cannot teach your child without their information, so withdrawing consent closes your account and your children's accounts, and deletes them right away, as described under Deleting your information below. You can download a copy first.
• To stop some of our emails: use the link at the bottom of the email, or write to us.
• To stop Friends: switch it off for your child in Parent Mode.

If you would rather write to us, email hello@magicsparkies.com from your account email address. We act on it within 10 business days.

Seeing and correcting your information

You can download everything we hold on your family yourself, without asking us. Sign in to Parent Mode, open Settings, and use Download my data under Your data and privacy. You get one file holding your account details, your consent record, and every child's progress, worksheets, badges and rewards. Nothing to request and nothing to wait for.

You can change your child's level yourself in Parent Mode. To correct anything else, such as your child's name or your email address, write to us and we will fix it. Please tell us if anything we hold is wrong, so it stays accurate.

When you write to us about your family's information, we reply as soon as we can, and within 30 days. If we ever need longer, we tell you in writing within those 30 days when you will hear from us.

To keep your family's information safe, write from the email address on your account. If you write from another address, we ask you to confirm from your account email first.

Deleting your information

In Parent Mode, open Settings, then use Delete my account and all our data. We show you exactly what disappears and what stays, and ask you to confirm. When you confirm, your account and every child linked to it are removed right away. There is no waiting period and there is no undo, so take a copy of your data first if you would like to keep one. Afterwards we hold only the things listed below, and nothing else. If you would rather write to us, email hello@magicsparkies.com from your account email address and we will do it for you.

• Payment and tax records, if you ever paid us. Singapore tax law makes us keep these for five years. They sit with our payment provider and hold no learning data at all.
• Your email address, with the dates of your free week and how many worksheets it used. This is the only way to tell that the free week has already been used, so it cannot be started a second time. It also holds the day your account was deleted. There is no name, no child and no schoolwork with it.
• A copy of your family inside our encrypted backups, until each one ages out. Backups are how we would put the service back after a failure, so the copies taken before today still hold your family. They are encrypted, nobody opens them except to recover the service, and they are deleted on a schedule: nightly backups after two weeks, and one backup a month for a year. Within a year the last copy is gone on its own.

What we delete automatically

Some things are deleted on a schedule, without anyone asking. Your account is never deleted while you have a plan or free access running. When that stops, we keep your account for a while, so your child can pick up where they left off. Then we delete it, with every child on it:

• If a plan ever started, even one you cancelled before any money was taken: 12 months after the plan stops.
• If you had free access from an invite code: 90 days after that free access ends.
• If you only had the free week: 90 days after the free week ends.

If more than one of these fits your account, the longest one counts. We email you 7 days before the date, so you can download your data first. If we could not send you that email, we do not delete, unless your email address no longer accepts our emails. If we send that email late, after the date, we wait 14 days from the day we send it before we delete. This email comes even if you asked us to stop our other emails, because it is about your own information. When it is done, we email you to confirm, and from then on we hold only the things listed under Deleting your information above.

We also delete these on a schedule. For a message or a request you send us, we keep a note that it came in, and delete your details from it at the time shown.

• A trial without an account, and everything done in it: 30 days after it started.
• A request from your child to save their trial, and our record of it, which holds a scrambled form of the device's internet address and a description of its browser: 30 days after the request. If the link we emailed you was never used, your email address goes at the same time.
• A message you send us through our contact form: 90 days after you sent it, we delete your name, your email address and the words you wrote. We keep only a note that a message came in, the day it came and what it was about. If we have not seen your message yet, we keep it until we have. If you have an account with us, the message stays with your account until the account is deleted.
• A request for a TheFirst50 place, or our record of a place we offered you: we delete your email address, your phone number if you gave one, and any note we made about you 180 days after your last request, or after we offered you a place if that was later. We keep the rest, such as how many children would learn and their levels, with no email address or phone number on it. If you set up an account with us, the request stays with your account until the account is deleted.
• The practice suggestions we make for your child, and our notes on which questions they needed: 12 months after they were made.
• Sign in records, and the record of when and for how long your child used the app: after 12 months.
• Our record of how the app is used, such as which screens were opened: after 90 days. Only daily totals, with no names in them, are kept longer.

Keeping it safe

• Everything between your device and our site travels encrypted.
• Passwords and PINs are kept only in a scrambled form that nobody can read back.
• Our backups are encrypted before they leave our servers.
• Inside Sparkies, only the people who run it can open the information we hold, and only to run the service or to answer you.
• Error reports leave out what you type, and we remove email addresses and sign in details from them.
• We keep sign in records, so we can spot misuse and stop it.

No system is ever completely safe, so we also plan for something going wrong.

If something goes wrong

If your family's information is lost, stolen, or seen by someone who should not see it, we act at once to stop it and to limit the harm. If it could harm you or your child, we email you to say what happened and what you can do. We also tell Singapore's Personal Data Protection Commission whenever the law requires it.

Questions and complaints

Our Data Protection Officer answers questions and complaints about your family's information. Write to hello@magicsparkies.com. We read it on Singapore working days. To help us answer quickly, write from the email address on your account and say what you would like us to do.

If you are not happy with our answer, you can contact Singapore's Personal Data Protection Commission at www.pdpc.gov.sg.

Changes to this policy

When we change this policy, the version number at the bottom changes too. If a change affects how we use information you have already given us, we email you before it applies.