Index

Our Commitment Summary Definitions What Data We Collect How We Use Data How XtraMath Uses AI Optional Features and Outside Services Sharing Personal Data with Third Parties Research and De-identified Data How We Securely Store Data Data Retention and Deletion Compliance with Data Privacy Laws Cookies and Local Storage Changes To This Policy Contact Us Appendix A: Service Providers and Outside Services Appendix B: Record of Data Processing

XtraMath Privacy Policy

Effective October 15, 2026

Our Commitment

XtraMath is a nonprofit that helps all children build math fluency. Three commitments come before anything else in this policy:

Technology at XtraMath, including AI, is and will remain subordinate to human judgment. Teachers and parents decide; our software assists.
We collect only the minimum data needed to help children learn, and we do not commercialize student data. We never sell it, and we never allow advertising to kids.
Data security, privacy, and compliance are essential to our mission, not an afterthought bolted on.

This policy explains what data we collect, how we use it, who we share it with, how long we keep it, and the rights you have. Appendix A lists the material service providers and outside services that receive Personal Data. Appendix B is our record of data processing.

Summary

We collect the minimum data needed to run XtraMath.
We use students' Personal Data only to run XtraMath. We never sell it, rent it, or use it for advertising, in identified or de-identified form.
We use parents' and teachers' Personal Data to run their accounts and, with their permission, to contact them about XtraMath.
No advertisements, offers, prices, or promotions appear in any student session, in XtraMath or in third-party content reached through XtraMath.
Fluency Intelligence is a teacher-facing feature. The AI model receives practice statistics under a temporary code, never a name, email address, school, class, or account identifier. Every output is checked against quality rules before a teacher sees it, and a teacher always makes the call.
Awakening is optional game-based practice operated by Legends of Learning, Inc., an outside service, turned on by an adult. We tell it which learning objective to practice, and the results come back into the Student's XtraMath record for their teacher and parent to see. Appendix A lists what we share and what we never share.
Student and customer data is never used to train third-party AI models, and our service providers are barred from doing so.
We share de-identified data with educational researchers under written agreements. Schools and account holders can opt out.
We comply with applicable privacy laws, including FERPA, COPPA, state student-privacy laws, CCPA, and GDPR, and we enter into data privacy agreements with Schools where required and mutually agreed.
You can see, correct, export, or delete your data by contacting privacy@xtramath.org.

Definitions

Data means all information connected with a person's or educational entity's use of XtraMath, including Personal Data, metadata, and usage and performance data.
Personal Data means any data that can directly or indirectly identify an individual person. An email address is always Personal Data; a student's grade level generally is not, but could be when combined with other information.
Student means a child who uses XtraMath through an account an adult created for them. Student Data means Personal Data about a Student, including practice and performance data.
De-identified Data means data from which all direct and indirect personal identifiers have been removed so that it can no longer reasonably be used to identify an individual student, parent, or teacher.
School means an individual school, a school district, another local educational entity, or a teacher acting on behalf of one. School Account means an account or class provisioned under a School license, a data privacy agreement with a School, or a rostering or sign-in integration such as Clever or ClassLink. Origin governs: a class rostered by a School is a School Account even if the teacher created the account.
Customer means a School or other organization that purchases a license or paid plan from us.
Commercial Data means business information XtraMath holds to run its operations and provide the Service: purchase and billing records, contracts and price quotes, School and Customer contacts, and aggregate statistics about the Service. Commercial Data never includes Student Data.
Service provider means a company that processes data on XtraMath's behalf and only on our instructions, such as our hosting, payment, and AI providers.
Outside service means a third party service that a Student can enter from XtraMath, such as Awakening. Where that provider processes what XtraMath sends, it does so on our instructions, under contract, and only for the educational purpose we set. Where it collects information under its own terms, it acts as an independent operator under its own privacy policy.
Fluency Intelligence is our teacher-facing decision-support feature, described in “How XtraMath Uses AI.”
Awakening is optional game-based math practice operated by Legends of Learning, Inc., described in “Optional Features and Outside Services.”

What Data We Collect

XtraMath collects the minimum data needed to run the program. Appendix B lists every category, why we process it, and when we delete it.

Student Data

We collect a Student's first name, grade level, and program settings from the Student's parent or teacher. As the Student uses XtraMath, we collect usage and performance data: when they signed in, which problems they answered, whether they answered correctly, and how long each answer took. If a Student signs in through a single sign-on provider such as Clever, ClassLink, or Google, we collect an identifier from the provider that lets us authenticate the sign-in. We do not collect the Student's email address, even when one is used for that sign-in.

Some information about a Student can be inferred from what we collect. If a Student account belongs to a class, for example, we can infer that the Student attends a certain school.

Parent Data

We collect a parent's name and email address when they create an account, and an authentication identifier if they sign in through a single sign-on provider. We also collect account metadata and settings, such as time zone, the language used at sign-up, and email preferences.

A parent chooses a password when they create an account. The password is hashed (scrambled) on the parent's device before it is sent to XtraMath. We never have access to the original password and cannot recover it from the hashed version.

We can infer, for example, that a parent whose account is linked to a Student account is that Student's parent or guardian.

Teacher and School Administrator Data

We collect the same data for teacher accounts as for parent accounts, plus the name by which students address the teacher (such as “Ms. Smith”) and information about each class the teacher creates, such as its name and end date. For School administrators, we also collect their role and the School they administer. We can infer, for example, that a teacher works at a specific school from their email address.

Customer and Billing Data

When a family, teacher, or School buys a paid plan, we collect the purchaser's name, email address, and billing details, and we keep records of purchases, invoices, price quotes, and any tax-exemption certificates. Card details are entered directly with our payment processor; we keep only a payment reference, never a full card number. This is Commercial Data.

What We Do Not Collect

We do not request health information through the program. We do not collect Student email addresses, precise geolocation, biometric data, photos, or free-text content written by Students. We do not collect data from Students outside their use of XtraMath.

Fluency Intelligence and Awakening

Fluency Intelligence analyzes data XtraMath already collects. It does not collect anything new from Students. When a Student enters Awakening, we collect the Student's practice results on the objective we set, in the same form as practice completed in XtraMath. Legends of Learning also collects data within its own service under its own privacy policy, as described in “Optional Features and Outside Services.”

We process data to create and maintain accounts, to give Students the right practice activities, to report progress to teachers and parents, to run paid plans, to keep XtraMath secure, and to understand and improve how well the program works. Appendix B has the detail.

Student Data

A Student's Personal Data is used by our application to give the Student appropriate practice activities and to report their progress to their parents and teachers. Adaptive practice adjusts each Student's work using fixed rules based on the Student's recent performance. We may access Student Data when providing customer support or investigating a reported problem. We never use Student Data for advertising, and we never sell it.

Parent and Teacher Data

A parent's or teacher's Personal Data is used to sign them in, to send them progress reports and account messages, and to support them when they ask. We may access it when providing that support.

Email you choose to receive. When you create a teacher or parent account, we ask whether we may send you product updates, teaching resources, and occasional offers for optional paid features. You can change your choice at any time in your account settings or with one click in any email. Account, security, and progress-report emails are separate and are always sent. We record what you chose, when, and the exact wording you saw. Students never receive marketing email.

Schools

When a School provides Student Data, we process it on the School's instructions and only for the purposes the School has authorized, as described under FERPA below and in Section 4 of the Terms of Service. The School stays in control of its data.

Commercial Data

We use Commercial Data to provide and bill paid plans, to manage our relationships with Schools and Customers, to meet tax and accounting obligations, and to report aggregate statistics about the Service. Commercial Data never includes Student Data.

How XtraMath Uses AI

Our position is simple: technology serves the people doing the teaching. It never replaces their judgment.

Adaptive practice is deterministic. XtraMath adjusts each Student's daily practice using fixed rules based on recent performance. No generative AI interacts with a Student in XtraMath.

Fluency Intelligence is for teachers, in classrooms that turn it on. Fluency Intelligence is our teacher-facing decision-support feature, available with certain paid plans. It runs only for classrooms whose teacher or School has enabled it. It analyzes the practice data XtraMath already collects and drafts a brief that helps the teacher see which students may need attention and decide what to do next.

Recommendations come from fixed, research-based rules. Fluency Intelligence computes its findings with rules we wrote and can explain, grounded in research on math-fact fluency. It does not generate findings freeform.

AI narrates evidence; teachers make decisions. Fluency Intelligence uses large language models to put its findings into words for the teacher. The model may not add findings, diagnoses, or recommendations of its own. Any instructional decision about a Student is made by a teacher or School, using Fluency Intelligence as one input among others. It is never used, and may not be used, as the sole basis for a decision with a legal or similarly significant effect on a Student, such as placement, discipline, retention, or eligibility for special education or other services. A teacher may disregard, edit, or override any output at any time.

What the model receives. Before any model is called, we replace direct identifiers with a temporary code. The model receives practice statistics under that code, and never a Student or teacher name, email address, school, class, or account identifier. XtraMath holds the code and re-attaches the result on our own systems, so we treat this as pseudonymous Personal Data rather than anonymous data. Results are shown only to the Student's own teacher and authorized School staff. Appendix A states exactly what our AI provider receives.

Governed and evaluated. The data going into a model is fixed and minimized, our AI providers are contractually barred from training models on your data, and every output is checked against quality rules before a teacher sees it. Schools may request our Data Protection & AI Governance Assessment, which documents our AI data flows, providers, and safeguards, at privacy@xtramath.org.

Raising a concern. Anyone may report a concerning Fluency Intelligence output to privacy@xtramath.org. We investigate and respond within a commercially reasonable time.

Optional Features and Outside Services

XtraMath may offer additional educational content to Students, teachers, and parents that is provided by outside organizations. The rules do not change when an outside service is involved.

For educational purposes. We use an outside service only where it gives children additional curriculum-aligned math practice. Today, we offer a service called Awakening, operated by Legends of Learning, Inc.

What Awakening is. Awakening is optional, game-based math practice. It becomes available only after a Student completes their daily XtraMath practice, and it is offered at no charge within XtraMath.

Who activates it. Awakening access is controlled by the parent, guardian, teacher, or School administrator who activates the service for their classrooms and can then turn it on or off for their Students. The adult who turns it on reviews and accepts Legends of Learning's terms of service and privacy policy as part of doing so. Teachers can enable Awakening for a class or an individual Student; parents can control it for their child. Turning it off does not affect a Student's XtraMath practice or progress.

What we share. When a Student enters Awakening, the Student uses a service operated by Legends of Learning, Inc. For the Student's math practice, Legends of Learning acts on XtraMath's instructions: XtraMath sends a one-time session token and the learning objective for that session, chosen by the same fixed rules that set the Student's XtraMath practice, and Legends of Learning returns the Student's results on that objective, processing what we send only on our instructions and only for that educational purpose. Those results are available for their teacher and parents to see them alongside practice completed in XtraMath. For the information Legends of Learning collects inside its own service, it acts as an independent operator under its own terms and privacy policy. XtraMath does not share records of the Student's performance with Legends of Learning.

No ads to Students, ever. No advertisements, offers, prices, or promotions appear in any Student session, in XtraMath or in third-party content reached through XtraMath. We bind these providers to this commitment by contract, and we remove content that fails it.

Offers go to adults only. Optional free and paid features, ours or an outside provider's, appear only on parent- and teacher-facing accounts. They are never targeted using an individual Student's data, and they never appear on School Accounts. If you buy from an outside provider, you buy from that provider, on its site, under its terms and privacy policy. XtraMath may receive a share of that revenue.

XtraMath has never released, traded, or sold anyone's Personal Data for advertising, and never will. We disclose Personal Data only in these circumstances:

When you ask us to, such as a teacher sharing a class with another teacher, or a parent linking to a Student account.
To our subprocessors, when the data is required to perform the service. They process data only on our instructions, under contracts that bar any other use. Appendix A lists them and what each receives.
To an outside service that has been activated, limited to what Appendix A lists for that service.
When required by law, a court order, or a lawful government request. We will tell you unless the law forbids it.
In a merger, acquisition, or transfer of our operations approved by our Board of Directors. The successor must honor this Privacy Policy for all existing accounts, and we will give you advance notice before any account is transferred.

Research and De-identified Data

Research is a public good, not a product. We may share De-identified Data with professional educational researchers to understand and improve how children learn math, under written agreements that bar re-identification and, where required, with institutional review board oversight. Research data is never sold and never used for advertising. Student Data is never used to train third-party AI models, and neither our researchers nor our processors may train AI models on it.

Our own use of de-identified data. We may use De-identified Data internally to improve XtraMath and develop new features, including Fluency Intelligence, and to publish aggregate statistics such as the number of students who use XtraMath. We remove direct and indirect identifiers before this use and aggregate across users, classes, or Schools where feasible. We will never attempt to re-identify data that has been de-identified.

Opting out. A School may opt out of having its data used for research or product improvement, and any parent or teacher may opt out for their own or their child's account, by emailing privacy@xtramath.org. We confirm when the opt-out is in place. An opt-out is prospective: it prevents your data from being included in future de-identified sets, but data that has already been de-identified can no longer be linked to an account, so it cannot be located or withdrawn. Opting out does not affect your use of XtraMath or Fluency Intelligence.

How We Securely Store Data

XtraMath uses industry-standard measures to prevent unauthorized access to user data, including data minimization; encryption in transit (HTTPS) and at rest; hashing of sensitive data such as passwords; role-based access controls and audit logging; deletion of outdated data; employee training; and administrator account security. We maintain a written information security program.

Deleted data may persist in encrypted backups for a limited period, where it is not available for use, before those backups are overwritten.

Data Storage and International Transfer

XtraMath stores and processes all data on servers in the United States, operated by service providers with whom we have contractual data processing addendums (Appendix A). Where we receive Personal Data from the European Union, United Kingdom, or Switzerland, we rely on the European Commission Standard Contractual Clauses, together with the UK International Data Transfer Addendum and the Swiss equivalent, and on any additional safeguards those transfers require.

Data Breach Response

No service can guarantee absolute security. We have a Breach Response Plan. If we discover that Personal Data has been accessed improperly, we will act to stop further loss or access; investigate how it happened; and notify supervisory authorities and other regulators, affected organizations, and affected individuals without unreasonable delay and within the periods required by applicable law or by contract. We notify law enforcement where appropriate.

Data Retention and Deletion

We keep Personal Data only as long as needed to provide continuity of practice for Students and convenience for parents and teachers, and to meet legal obligations. Appendix B is our authoritative retention schedule and lists the retention period for each category.

Automatic closure. Student accounts close on request, after two years of inactivity, or one month after being unlinked from all parent and teacher accounts. Parent accounts close on request or after two years of inactivity. Teacher accounts close on request. Detailed Student activity data is deleted one year after it is recorded.

Deletion on request. You may ask us to delete your account and all associated identifiable data at any time by emailing privacy@xtramath.org. We complete deletion from our live systems within 30 days, and we certify deletion in writing on request. Deletion means the data is rendered permanently unrecoverable from our live systems, not merely hidden; backups are handled as described above. A School may request deletion of its Student Data at any time, and for 90 days after a paid plan ends may export it or request its deletion, as Section 15 of the Terms of Service describes.

What we keep. We may keep De-identified Data for research and program improvement, subject to the opt-outs above, until it is no longer useful. We keep Commercial Data as long as needed for financial, tax, and legal records.

Compliance with Data Privacy Laws

XtraMath complies with the data privacy and data protection laws of the jurisdictions where it operates. Some specific frameworks are described below.

United States

Children's Online Privacy Protection Act (COPPA). XtraMath is a nonprofit organization, and whether COPPA applies to a nonprofit depends on how it is organized and what it does. Rather than rest on that question, we build the protections COPPA requires, including its 2025 amendments, into how XtraMath works. Children under 13 may not create their own accounts; a parent, guardian, or teacher creates a Student account for them. We collect from Students only the usage and performance data generated by their practice, use it only for educational purposes, and never for advertising or behavioral targeting. We do not disclose Student Personal Data to any third party for that third party's own use. This policy and Appendix B are our published data retention policy, and we maintain a written information security program. If we learn that a child is using XtraMath without appropriate consent, we close the account.

Family Educational Rights and Privacy Act (FERPA). Schools may provide Student Data to XtraMath under FERPA's “school official” exception. When a School designates XtraMath as a school official, determines that we have a legitimate educational interest, and the other conditions of that exception are met, we perform that role under the School's direct control with respect to that data and use it only for the purposes the School has authorized. The School remains in control of its Student Data and may access, export, correct, or delete it at any time.

State student-privacy laws. XtraMath complies with applicable state student data privacy laws, including those modeled on California's SOPIPA and those that require restrictions on commercial use of student data, breach notification, and data destruction on request or at the end of a contract. We enter into data privacy agreements where required and mutually agreed, including agreements based on the Student Data Privacy Consortium's National Data Privacy Agreement, and we offer our own. Contact privacy@xtramath.org.

California Consumer Privacy Act (CCPA/CPRA) and other state privacy laws. XtraMath does not sell or share Personal Data as those terms are defined under the CCPA, and does not use or disclose sensitive personal information except to provide the Service. California residents have the right to know what Personal Data we hold, to delete it, to correct it, to opt out of any sale or sharing (which we do not do), and not to be discriminated against for exercising these rights. Residents of other states with comprehensive privacy laws have similar rights, and we honor them regardless of whether the law exempts nonprofits. To exercise any right, email privacy@xtramath.org; we will verify your identity and respond within the time the law requires. An authorized agent may act for you with your written permission.

International

General Data Protection Regulation (GDPR) and UK GDPR. For parent, teacher, and family accounts, XtraMath is the data controller. For School Accounts, the School is the controller and XtraMath is its processor, acting on the School's instructions. Appendix B lists what we process, why, for how long, and our legal basis. You have the right to access, correct, delete, restrict, or object to the processing of your Personal Data, to receive a copy of it, to withdraw consent where processing is based on consent, and to lodge a complaint with your supervisory authority. To exercise these rights or to reach our privacy contact, email privacy@xtramath.org. International transfers are described under “Data Storage and International Transfer.”

Cookies and Local Storage

Public website. Our public website (home.xtramath.org) uses Google Analytics cookies to count visitors and see which pages they visit, and embedded videos may set the video host's cookies. As with any web request, these providers also receive the technical information their services collect automatically, such as IP address, device and browser type, and the page requested. These cookies are not used in the XtraMath application. You can clear them through your browser settings.

The XtraMath application. Student sessions contain no third-party trackers, analytics, or advertising technologies. The application uses browser LocalStorage to remember sign-in information if you choose, and SessionStorage to store activity data temporarily during practice for performance. Neither is required to use XtraMath. You can remove remembered sign-in information from the sign-in page and clear all LocalStorage with the “Clear now” button on our support page or through browser settings.

Mobile apps. Our apps use application data for the same purposes as LocalStorage and SessionStorage. You can remove remembered sign-in information from the app's sign-in page; uninstalling the app removes all locally stored data.

Changes To This Policy

We may change this policy. We post changes on our website and in our apps. For material changes, we give at least 30 days' advance notice by email and on our website, as Section 16 of the Terms of Service describes. We will not apply a material change in how we use children's Personal Data to data already collected without the consent the law requires. Each version is archived, and a summary of changes is available at privacy@xtramath.org.

Contact Us

For privacy questions, to object to processing, or to request access to, correction of, export of, or deletion of your or your child's Personal Data, email privacy@xtramath.org. You may also write to XtraMath, 4742 42nd Ave SW #625, Seattle, WA 98116. Our privacy contact can be reached at the same address.

Appendix A: Service Providers and Outside Services

We keep this list up to date. It covers the material service providers and outside services that receive Personal Data from XtraMath.

Provider	Data received	Purpose	Protections
Amazon Web Services (AWS)	Account data, including names, email addresses, and program usage, in our databases and backups	Hosting, storage, and email delivery	AWS Data Processing Addendum; data stored in US regions; encryption in transit and at rest
Anthropic	For users with Fluency Intelligence enabled: practice statistics (facts practiced, accuracy, response-time bands) under a temporary code that only XtraMath can re-link on its own systems. Never a Student's or teacher's name, email address, school, class, or account identifier	Puts Fluency Intelligence evidence and findings into words for the teacher	Anthropic Commercial Terms and Data Processing Addendum or, where we access Anthropic's Claude models through Amazon Web Services (Amazon Bedrock), the AWS terms above; in either case the provider does not train models on our data, and retention is governed by those terms, which provide for deletion within a limited period subject to legal and policy-enforcement exceptions
Stripe	Purchaser's name, email address, billing address, and the payment details the purchaser enters	Payment processing for paid plans	Stripe Privacy Policy; PCI DSS Level 1; XtraMath never stores full card numbers
Clever, ClassLink, Google	Sign-in identifiers and roster synchronization status, at the School's or user's direction	Single sign-on and rostering	Each provider's privacy policy and the School's own agreement with it
HubSpot	Teacher, parent, and School-contact names, email addresses, account type, and email-engagement data. No Student Data	Sending the email you have agreed to receive; managing our relationships with Schools and Customers	HubSpot Data Processing Agreement; suppression honors your email choice
MaxMind	IP address	Geolocating school districts and setting time zone at sign-up	MaxMind Privacy Policy; IP addresses are not stored by XtraMath
Legends of Learning, Inc. (Awakening)	A one-time session token and the learning objective for that session.	Optional game-based practice on an objective XtraMath sets, after daily practice, when an adult has activated it. Results on that objective are returned to XtraMath and shown in the Student's practice record.	Legends of Learning Privacy Policy; by contract, no advertising, or offers, to XtraMath Students; what XtraMath sends is processed only on our instructions, to deliver that practice and display results.

Appendix B: Record of Data Processing

We publish this record to be transparent about how we use data and to comply with European law. It is our authoritative retention schedule; where another XtraMath document states a retention period, this appendix governs. Unless noted, we process data on the basis of performing our agreement with you (the Terms) and our legitimate interest in running XtraMath securely. We send optional email on the basis of your consent. For School Accounts, we process on the School's instructions as its processor.

Account type	Type of data	Processing purpose	Deletion
Student	First name, PIN, parent or teacher email, class	Account access and identification	Upon account closure¹. Some information is deleted upon removal from the class or linked account
Student	Single-sign-on provider and hashed ID	Account access using an optional third-party credential	Upon request or account closure¹
Student	Grade level	Determine initial activity level. De-identified and aggregated, used to analyze program usage	Upon account closure¹
Student	Program settings: current program, UI options, preferred language	Activity customization. De-identified and aggregated, used to analyze program usage	Upon account closure¹
Student	Activity data, including practice completed in Awakening	Activity customization and progress reports. De-identified and aggregated, used to analyze program usage	Upon account closure¹. Some data is deleted when a program is restarted. Detailed activity data is deleted after one year
Student (Fluency Intelligence enabled)	Practice statistics under a temporary code; the resulting teacher brief; quality-check records	Produce the teacher's Fluency Intelligence brief; audit its quality	Briefs while the class is active; inputs and quality-check records kept no longer than needed for quality review, and no longer than the account retention period above
Student (Awakening enabled)	One-time session token and the session learning objective	Start and direct an Awakening session	End of session; not stored by XtraMath
Parent or Teacher	Name, “addressed as” name, email address, hashed password	Account access and identification	Upon account closure^{2, 3}
Parent or Teacher	Email address	Send progress reports, account and security messages, and, with consent, product updates, teaching resources, and offers	Optional email stops on request; deletion upon account closure^{2, 3}
Parent or Teacher	Email consent state, timestamp, and consent-text version	Prove and honor your email choice (consent)	While the account exists, and afterward only as needed to demonstrate consent
Parent or Teacher	Terms acceptance record (version, timestamp) and arbitration opt-out flag	Contract records	Until account closure plus the period required for legal records
Parent or Teacher	Email address shared with linked accounts that access the same Student or class	Transparency and security of Student Data	Deletion upon account closure^{2, 3}
Parent or Teacher	Account settings: account type, email preferences, time zone	Progress reports and data preferences	Upon account closure^{2, 3}
Parent or Teacher	Electronic identifiers: change timestamps, version number	Technical support and account security	Upon account closure^{2, 3}
Parent or Teacher	Single-sign-on provider and hashed ID	Account access using an optional third-party credential	Upon request or account closure^{2, 3}
Parent or Teacher	IP address	Determine time zone at sign-up	Not stored
Parent or Teacher	Hashed IP address	Account security	After one year or upon account closure^{2, 3}
Teacher	Hashed IP address	Expedite classroom setup on multiple devices	After 24 hours
Teacher	Class name, class end date, student names	Progress reports and program use	Upon request, account closure³, or one year after the class end date
School administrator	Name, email address, role, School	Administer the School's license and accounts	Upon request or end of the School's agreement
Customer	Billing contact, purchase history, invoices, price quotes, tax-exemption certificates, payment reference (Commercial Data)	Provide and bill paid plans; tax and accounting compliance (contract; legal obligation)	As required for financial and tax records, generally seven years
Any user	Support correspondence	Respond to your request	No longer than needed to resolve and audit the request, and no longer than the account retention period above
All users	Hashed IP address, change logs	Network security	After 90 days
All users	De-identified and aggregated usage data	Product improvement and development, promotional statistics, and educational research (subject to opt-out)	Until no longer useful

¹ Student accounts close upon request, automatically after two years of inactivity, or one month after being unlinked from all parent and teacher accounts. ² Parent accounts close upon request or automatically after two years of inactivity. ³ Teacher accounts close upon request.

Effective October 15, 2026. Previous version: July 2025. Questions: privacy@xtramath.org.