Privacy

MathPop is designed for children and adults. Every player has one Authentik-linked account. We store the verified email, Authentik identity reference, approved public alias, settings, learning attempts, progress, rewards, and verified game results needed to run the service.

Public information

Leaderboards are public. They show an approved character alias and avatar, score, accuracy, ruleset and achievement time. They do not show your email or private account nickname. You can leave or rejoin public leaderboards from Player settings.

Sign-in and recovery

Authentik manages sign-in, account verification and recovery. MathPop requires a verified email from Authentik and does not accept passwords, passkeys or recovery codes directly. Previously stored credentials cannot sign in; an old password hash is removed when its account is linked to Authentik.

Analytics

We use a self-hosted Umami service to understand anonymous page and feature use. Account emails, nicknames, answers and learning records are never sent to analytics.

Storage and deletion

Production data and encrypted backups remain on the bigboy cluster. You can correct your nickname and export your data from Account. Contact us to request account deletion. Deletion removes the account and its linked progress and public entries. Expired or used sign-in tokens are removed after 1 day, used recovery codes and expired sessions after 30 days, and security events after 90 days. Backup copies age out under the separate 14 daily, 8 weekly and 12 monthly schedule.

Your choices

You can request access, correction, deletion, withdrawal from a public board, or ask a privacy question at mathpop@deverall.nz.