FlashMath Education Privacy Policy (US)

Introduction

FlashMath LLC ("FlashMath," "we," "us," or "our") provides this Education Privacy Policy to explain how we collect, use, disclose, and retain personal information when students and educators use FlashMath's education services: FlashEDU, licensed to schools and districts, and FlashClass, used by teachers directly (together, the "Education Services").

Where a school or district has signed the FlashEDU Student Data Privacy Agreement (the "DPA," published at https://edu.flashmath.io/legal/dpa), the DPA governs that district's student data and controls over this policy if the two differ. This policy is intended for schools, educators, parents and students in the United States. FlashMath's consumer products (FlashMath+ and FlashFamily) are covered by FlashMath's general Privacy Policy, published at flashmath.io.

1. Scope

This policy applies to personal information collected through:

1. Student accounts created or managed by a school, a district or a teacher, including accounts created through a roster or single sign-on integration.
2. Student accounts a student creates by registering with an email address and password, which is refused for anyone under 13 — for example to join a class with a class code.
3. Educator and administrator accounts.
4. Data generated through use of the Education Services.

2. Information We Collect About Students

1. Identifiers: a first and last name, or a student identifier, as provided by the school or teacher; a username; and account credentials. For an account a school or teacher creates, we keep an encrypted copy of the student's password so that the student's teacher or a school administrator can recover it behind their own PIN.
2. Roster and sign-in information: where a school connects Clever, Google Classroom or its own single sign-on identity provider, the identifier that system issues and the name, grade, school and class information it supplies. An email address supplied by Clever is used only to match accounts and is kept in one-way hashed form.
3. Grade and enrollment: grade level and class or group membership.
4. Self-registration: a student who registers with an email address and password gives a name, that email address, a password and a date of birth. That registration is refused for anyone under 13.
5. Learning activity: practice sessions and results, assignments, benchmark assessments, match history, ratings and statistics, progression (XP, levels, achievements), and virtual-currency and item activity.
6. Accommodation indicators: delivery flags entered by school staff — untimed, extended time, read aloud, large text, reduced distractions. We do not collect diagnoses or medical records.
7. Chat and reactions: where a teacher turns on typed chat for a class and, for a district's students, the district allows it (it is off by default), short messages a student sends to their party or team during play. Only the latest 100 messages of each party's chat are kept, and they are deleted one hour after the party's most recent message — each new message restarts that hour. They are not written to our database unless another user reports one. Preset quick reactions, kept the same way, are available whether or not typed chat is on.
8. Safety reports: reports users submit about another user's conduct, including a copy of the reported message, and the notes and restrictions staff record in response.
9. Support requests: a student's problem report stays in the Education Services for the student's teacher, or the district's administrators when there is no teacher, and is never sent to our support staff. A teacher's or administrator's request to our support staff carries their own name, email address and text, refers to a student only by an anonymous account identifier, and goes to our dedicated support tracker.
10. AI-generated reports: summaries of a student's progress generated for educators or parents by the AI-assisted features described in Section 9.
11. Voice sessions: where a voice feature is used, the time each session started and ended and how it ended. We do not store the audio or a transcript.

3. Information We Collect About Educators and Administrators

1. Name and email address, and the school or organization you belong to.
2. Classroom, roster and assignment information you enter.
3. Account credentials, two-step verification settings, and the PIN you set to view student passwords.
4. Subscription and billing information. Card payments are processed by Stripe; we do not receive full card numbers.
5. Support communications and the problem reports you submit.
6. The text you type into AI-assisted tools, such as a question about your district's data.

4. Device and Technical Information

We collect IP addresses; the browser, device type and operating system a browser reports; server logs; and the time of sign-ins and other activity. We do not collect precise geolocation, and the Education Services do not use third-party analytics, advertising or crash-reporting services.

5. How We Use Student Information

We use student personal information only to:

1. Provide and maintain the Education Services, including practice, gameplay, assignments and progress tracking.
2. Provide educator features such as classroom management, progress reports and assignment tools.
3. Enforce platform rules, detect abuse and maintain security.
4. Provide technical support.
5. Improve and develop the Education Services, using de-identified or aggregated data where feasible.
6. Provide the optional AI-assisted features described in Section 9.

We do not use student personal information for:

1. Targeted or behavioral advertising.
2. Creating advertising profiles.
3. Selling to third parties.
4. Any purpose materially different from providing and improving the Education Services.

6. How We Disclose Student Information

We disclose student personal information only:

1. To the school: educators and administrators see student data according to their role — a teacher their own classes and, unless the district turns this off, a view of the other classes at the same school, a school administrator their own schools, a district administrator the district.
2. To service providers: companies that operate parts of the Education Services for us — hosting and infrastructure, email delivery, payment processing, a support tracker for staff requests (which refer to students only by an anonymous identifier), the roster and sign-in integrations a school chooses, and the AI providers described in Section 9. The Subprocessor and Security Overview, available from education@flashmath.io, names each of them. They may use the data only to provide their services to us.
3. For legal reasons: when required by law, court order, subpoena or other lawful process, or to protect rights, safety and security.
4. In a corporate transaction: in connection with a merger, acquisition or sale of assets, subject to the acquirer agreeing to be bound by these privacy commitments.
5. At the school's direction: where the school directs or authorizes the disclosure.

7. COPPA

1. For students under 13, the school provides consent on behalf of parents for the collection of student personal information for an educational purpose, as the FTC's COPPA Rule allows.
2. A student under 13 cannot register with an email address and password; the school or teacher creates the student's account.
3. We collect only the personal information reasonably necessary to provide the Education Services, and we do not condition a student's participation on collecting more.
4. Parents may review their child's personal information, ask for it to be deleted, and refuse further collection. Because the school controls the account, these requests are made through the child's school or teacher. If a parent contacts us directly, we will refer the request to the school and act on its instructions.

8. FERPA

1. To the extent student data constitutes "education records" under FERPA, FlashMath acts as a "school official" with a "legitimate educational interest" under the school's direct control.
2. We will not disclose student education records to third parties except as permitted by FERPA, directed by the school, or required by law.
3. The school retains ownership and control of student education records.
4. We will cooperate with the school to enable it to meet its FERPA obligations.

9. AI-Assisted Features

1. Coach Flash gives students AI-assisted practice coaching. For a district, it is off by default if the district's account was created on or after September 25, 2026; a district created earlier keeps the setting it had. It is not available to FlashClass students outside a district.
2. AI tools for educators — answering questions about a district's data, district and board reports, classroom digests, practice-problem generation, attention explanations, parent summaries, roster mapping and a voice assistant for staff — are controlled for a district by their own district-level setting, separate from Coach Flash, which the district's administrators set in the district console. That setting is off by default for a district whose account is created on or after September 28, 2026, the effective date of version 2.0 of this policy; a district created earlier keeps the state its educator tools were already in. For a teacher using FlashClass without a district, their use is covered by the FlashClass Teacher Agreement the teacher accepts.
3. What is sent: depending on the tool, data sent to an AI provider can include student names or usernames, school and class names, teacher names and practice results. For roster mapping, only the file's column headings and a small sample of values, with sensitive fields removed, are sent. The staff voice assistant sends the speaker's audio directly from the browser to the provider.
4. Providers: Anthropic, OpenAI and Google, and models reached through OpenRouter, an AI routing service, where it is configured. We do not permit these providers to use Education Services data to train their general-purpose AI models.
5. What we keep: we do not keep the text of Coach Flash conversations; we keep counts of AI usage (the model used, the size of the request and response, and timing). AI-generated reports shown to educators are kept with the class or district records.

10. Data Retention and Deletion

1. We keep student personal information while the school's or teacher's use of the Education Services continues.
2. FlashEDU: after a district's agreement ends, or on the district's request — for individual students or for the whole district — we delete or de-identify its student personal information within 90 days, as the DPA describes. For a request a district administrator makes in the district console, the 90 days run from when it is made; for a written request sent to us, they run from when we confirm it. When we confirm a request to delete the whole district, the district's service ends, and data export with it, so a district should export anything it wants to keep first.
3. FlashClass: removing a student from a class ends the student's access to that class; the student's account and practice history are kept, and FlashClass does not delete student data just because a teacher stops using it or a subscription ends. A teacher can delete a student's data at a parent's or guardian's request; the deletion runs after a hold, currently 24 hours, during which the teacher can cancel it. A parent or guardian can also ask through the public form at flashclass.edu.flashmath.io/data-deletion, which sends the request to the child's teacher to confirm the relationship and the student; nothing is deleted until the teacher confirms. A parent's request has a deadline no later than 30 days after we receive it: the teacher is reminded on days 7 and 14, and our support staff are alerted on day 21 if the request is still waiting. The deletion covers the child's records in that teacher's classes, and the child's account too when the teacher created it and no other teacher's class uses it, and the parent receives a completion record by email.
4. Closing a FlashClass account: a teacher can close their account from their account page. After a grace period, currently 14 days, during which the teacher can cancel and download their class data, we delete the teacher's classes and all of their records, the student accounts the teacher created that no other teacher's class uses, and the teacher's own account, and email the teacher a completion record. A student account another teacher's class still uses is kept for that class, without the closed classes' records. Closing a FlashClass Pro account stops the subscription from renewing; the students' data is still deleted when the grace period ends, and the teacher's own account closes when the paid period ends. Support tickets tied to the deleted records are deleted from our support tracker before the records are.
5. Audit trail: FlashMath keeps a tamper-evident audit trail of sign-ins and administrative actions in FlashEDU and FlashClass. It contains internal account identifiers, sign-in network data such as IP addresses, and the text recorded with each administrative action, which may include a student's name where staff typed one — for example in a stated reason or a note. FlashMath does not remove those identifiers or that text when the corresponding student data is deleted, and the audit trail has no scheduled deletion date; FlashMath uses it only for security, integrity and legal-compliance purposes. A second copy of a district's audit trail, kept with the district's other student data, is de-identified when all of the district's student data is deleted.
6. Backups: Backup copies are encrypted and are not altered when student data is deleted; they expire on their own schedule. Nightly backups kept on the servers that host a district's data are deleted within 16 days, database-log archives there are deleted 14 days after they are copied off-site, and the encrypted off-site copies are deleted once they are more than 90 days old — so every backup copy made before a deletion is gone within 91 days of it. The deletion certificate FlashMath issues when the district's student data is deleted states the dates.
7. Server and security logs are kept to investigate incidents. De-identified or aggregated data may be kept and used to improve the Education Services, and transaction and tax records are kept as accounting law requires.

11. Data Security

1. In transit: connections between users' browsers and our servers, and between our application servers and their PostgreSQL databases, use TLS 1.2 or higher.
2. At rest: the storage volumes that hold student data, and the backups made from them, are encrypted (AES-256). Stored student passwords, sign-in secrets and single sign-on secrets are additionally encrypted field by field.
3. Access: a teacher sees their own classes and, unless the district turns this off, can view (but not change) the other classes at the same school; a school administrator sees their own schools, and a district administrator the district. Classroom records are also protected by database-enforced row-level security. FlashMath staff sign in to administrative consoles with multi-factor authentication, and sign-ins and administrative actions are recorded in an audit trail.
4. Breaches: if a data breach affects student data, we will notify the school without unreasonable delay and as required by applicable law.
5. No system is completely secure, and we cannot guarantee absolute security.

12. Data Export

District administrators can export their district's student data, or one student's records, as CSV files from the district console while the district's service is active and, after its agreement ends, until the deletion begins ahead of the 90-day deadline. Confirming a request to delete the whole district ends export at once, so export first. Any school or teacher can also request an export by writing to education@flashmath.io; exports are provided in a commonly used, machine-readable format.

13. Third-Party Services

1. A school may connect Clever, Google Classroom or its own OpenID Connect or SAML identity provider for rostering and single sign-on. The school's own agreements with those providers govern what they do with the data.
2. We do not embed third-party advertising or tracking technologies in the Education Services.
3. Some decorative items in the student locker and shop display a typeface loaded from Google Fonts. When one is shown, the student's browser requests the typeface from Google, which receives the browser's IP address and browser details but no account information.

14. Parent and Student Rights

1. Parents, and eligible students, may review the student's personal information, ask for inaccurate information to be corrected, ask for it to be deleted, and refuse further collection.
2. Start with the student's school or teacher, which controls the account. You can also write to us at education@flashmath.io; we will refer the request to the school and act on its instructions.
3. We may verify identity and authority before acting on a request.

15. Changes to This Policy

1. We may update this policy from time to time. If we make material changes, we will notify subscribing schools by reasonable means. The version and effective date at the top of this page show which version applies.
2. Version 2.1 replaces version 2.0 (effective 2026-09-28). The one change: the accommodation indicators add extended time.
3. Version 2.0 replaced version 1.0 (February 8, 2026), which was published at flashmath.io/edu-privacy. It described the Education Services as they then operated: chat, support requests, voice sessions and roster integrations are disclosed; crash diagnostics, which are not collected, are removed; the AI section describes the Coach Flash default and the separate educator setting and its default; and retention describes what is kept after deletion.

16. Contact Us

FlashMath LLC, Attn: Education Privacy, 7901 4th St N #23864, St. Petersburg, FL 33702, USA. Email: education@flashmath.io.