MateMatt teaches maths
step by step

Last updated: March 2026 · Read the full version →

Design Principle

Matematt is designed from the ground up for Data Protection by Default (Privacy by Design, Art. 25 GDPR). The protection of children's privacy is not an added compliance measure, but the architectural foundation of the app. Every feature is designed by asking first: "What data can we NOT collect?".

• Matematt does not require email, phone number, or contact details.
• Matematt does not collect real names, surnames, dates of birth, or location.
• Matematt does not contain any form of advertising.
• Matematt does not profile users for commercial purposes.
• Matematt does not sell or share data with third parties for marketing.
• Matematt does not use analytical tracking tools.

Encryption of Family data

When the Family feature is active, sensitive data (profile names, exercise results, assigned homework) is encrypted with AES-256-GCM end-to-end encryption before being sent to the cloud. The group key is exchanged between family devices via RSA-2048. Not even the server can read the contents.

Intended audience

The app is intended for children aged 6–11, used under the supervision of a parent or legal guardian.

Data stored on device

The app saves locally: a random avatar (e.g. "Lion 42"), a game nickname (if changed by the user), exercise results, guided path progress, MatCoin balance, and homework codes. This data stays on the device and is deleted when the app is uninstalled.

Family feature (optional)

If activated by a parent, it allows assigning homework and viewing results via the Firebase cloud service (Google LLC). Data is associated exclusively with an anonymous technical identifier randomly generated by the app (UUID) — not linked to email, name, or device. Contents are protected with end-to-end encryption. Parent sections can be protected with a 4-digit parental PIN (local SHA-256 hash), synchronised across the group with AES-256-GCM encryption.

Technical error reporting

The app uses Firebase Crashlytics, activated exclusively after explicit parental consent. It collects only technical information about errors. No personal data or exercise results are sent.

Data retention

On-device data is deleted when the app is uninstalled. Homework reports and assignments on Firebase are auto-deleted after 90 days. Family groups are retained until user-initiated deletion; inactive groups are auto-deleted after 365 days.

Parental rights (Art. 15–22 GDPR)

Parents can at any time:

• Access (Art. 15): view results in the Report section and group data in the Family section
• Rectification (Art. 16): edit profile and avatar within the app
• Erasure (Art. 17): delete all data (local and cloud) from Family → “Delete all data”
• Restriction (Art. 18): request restriction of processing by writing to privacy@matematt.app
• Portability (Art. 20): export your data in JSON format from the Settings section
• Objection (Art. 21): object to processing by writing to privacy@matematt.app
• Withdraw consent (Art. 7.3): disable Crashlytics or the Family feature individually from Settings. Withdrawal does not affect the lawfulness of prior processing

Contact: privacy@matematt.app — we respond within 30 days. EU residents: Garante per la Protezione dei Dati Personali; UK residents: Information Commissioner’s Office.

Technical services and data transfers

Firebase Authentication, Cloud Firestore and Firebase Crashlytics, provided by Google LLC (data processor, Art. 28 GDPR). Data transfers to the United States are covered by the EU–US Data Privacy Framework (DPF). Sensitive data is end-to-end encrypted and unreadable by the processor.

Data Controller

Davide Sironi
Privacy contact: privacy@matematt.app

Regulatory compliance

Privacy policy drafted in compliance with EU Regulation 2016/679 (GDPR) — Art. 5, 6, 8, 13, 17, 25, 28; Italian Privacy Code (D.Lgs. 196/2003); COPPA (15 U.S.C. §§ 6501–6506); UK Age Appropriate Design Code (Children’s Code); UK Data Protection Act 2018.