Children's privacy is not an afterthought. It is the principle on which the app was built, from the very first line of code.
Last updated: March 2026 · Read the full version →
Design Principle
Matematt is designed from the ground up for Data Protection by Default (Privacy by Design, Art. 25 GDPR). The protection of children's privacy is not an added compliance measure, but the architectural foundation of the app. Every feature is designed by asking first: "What data can we NOT collect?".
- Matematt does not require email, phone number, or contact details.
- Matematt does not collect real names, surnames, dates of birth, or location.
- Matematt does not contain any form of advertising.
- Matematt does not profile users for commercial purposes.
- Matematt does not sell or share data with third parties for marketing.
- Matematt does not use analytical tracking tools.
Encryption of Family data
When the Family feature is active, sensitive data (profile names, exercise results, assigned homework) is encrypted with AES-256-GCM end-to-end encryption before being sent to the cloud. The group key is exchanged between family devices via RSA-2048. Not even the server can read the contents.
Intended audience
The app is intended for children aged 6–11, used under the supervision of a parent or legal guardian.
Data stored on device
The app saves locally: a random avatar (e.g. "Lion 42"), a game nickname (if changed by the user), exercise results, guided path progress, MatCoin balance, and homework codes. This data stays on the device and is deleted when the app is uninstalled.
Family feature (optional)
If activated by a parent, it allows assigning homework and viewing results via the Firebase cloud service (Google LLC). Data is associated exclusively with an anonymous technical identifier randomly generated by the app (UUID) — not linked to email, name, or device. Contents are protected with end-to-end encryption. Parent sections can be protected with a 4-digit parental PIN (local SHA-256 hash), synchronised across the group with AES-256-GCM encryption.
Technical error reporting
The app uses Firebase Crashlytics, activated exclusively after explicit parental consent. It collects only technical information about errors. No personal data or exercise results are sent.
Data retention
On-device data is deleted when the app is uninstalled. Firebase data is retained until the user requests deletion or is automatically deleted after 180 days of inactivity.
Parental rights (Art. 15–22 GDPR)
Parents can at any time:
- Access (Art. 15): view results in the Report section and group data in the Family section
- Rectification (Art. 16): edit profile and avatar within the app
- Erasure (Art. 17): delete all data (local and cloud) from Family → “Delete all data”
- Restriction (Art. 18): request restriction of processing by writing to privacy@matematt.app
- Portability (Art. 20): export your data in JSON format from the Settings section
- Objection (Art. 21): object to processing by writing to privacy@matematt.app
- Withdraw consent (Art. 7.3): disable Crashlytics or the Family feature individually from Settings. Withdrawal does not affect the lawfulness of prior processing
Contact: privacy@matematt.app — we respond within 30 days. EU residents: Garante per la Protezione dei Dati Personali; UK residents: Information Commissioner’s Office.
Technical services and data transfers
Firebase Authentication, Cloud Firestore and Firebase Crashlytics, provided by Google LLC (data processor, Art. 28 GDPR). Data transfers to the United States are covered by the EU–US Data Privacy Framework (DPF). Sensitive data is end-to-end encrypted and unreadable by the processor.
Data Controller
Davide Sironi
Privacy contact: privacy@matematt.app
Regulatory compliance
Privacy policy drafted in compliance with EU Regulation 2016/679 (GDPR) — Art. 5, 6, 8, 13, 17, 25, 28; Italian Privacy Code (D.Lgs. 196/2003); COPPA (15 U.S.C. §§ 6501–6506); UK Age Appropriate Design Code (Children’s Code); UK Data Protection Act 2018.
