What we keep, and why.
CartoMath is a map of the math pathway with practice behind its nodes. To show a child where they are it has to remember what they got right. This page says exactly what is remembered, where, and how to have it removed.
Who is responsible
The site is run under the name CartoMath by one person, not a company. Questions, requests and complaints go to hello@cartomath.com and are answered by that person.
Optional learning coach
A grown-up uses their PIN to enable AI for each managed learner. Submitted math questions, explanations and pictures are sent to OpenAI to recognize handwriting or suggest feedback. We do not intentionally send the learner's name, email, school or account details; remove personal information from anything you submit.
Pictures are processed for the request and are not saved by CartoMath. Confirmed text, AI suggestions, and server-checked answers are stored with the learner for up to 30 days, then removed by scheduled cleanup. A family daily usage count limits requests. Turning AI off erases coaching history; erasing learner progress or deleting the learner also removes it. A request already sent to the provider cannot be recalled.
We request that OpenAI not store responses. This setting is separate from the provider's abuse-monitoring retention. Child-profile AI is enabled only after the operator verifies appropriate provider data controls. AI suggestions may be incorrect and do not independently establish mastery. Ordinary practice and the typed step checker can work without sending work to AI.
What is kept
- The name and email address given at sign-up, and a hash of the password, never the password. Signing in through an external account gives us the name, email and profile picture the sign-in provider shares; nothing else from that account is read.
- A first name or nickname and the course they are on. A child under 13 never has an account, an email, or a password: a parent or teacher adds them as a profile under their own account. That adult can explicitly invite additional adults to view progress, assign practice, or manage shared access. Invited adults cannot practice as the child, delete the profile, or change AI consent.
- For every question answered: which question, whether it was right, how many tries, and when. Which nodes are marked as mastered, and the score on each mock paper. This is what draws the map. New completed-question outcomes are also kept as history, including whether hints were used, so progress can be compared over time. The device keeps the latest 2,000 history records. Family accounts keep synced history until progress or the learner is deleted.
- Assignment and goal titles, selected topics, dates, and weekly practice targets are saved with the learner. Saved worksheets keep their title and question selection with the account. Adult invitations keep the invited email, permission, expiry date, and a hash of the private link. Accepting requires that adult's verified email. The owner can remove shared access even after Family ends. Deleting a learner deletes their plans and access records; deleting an account deletes its saved worksheets.
- When a parent or teacher invites a student of 13 or over by email, the address and the invitation code are kept until it is accepted or it expires.
- If a parent or teacher sets one, only a salted hash of it, a count of wrong tries, and until when it has opened teacher editions on a signed-in device.
- What a parent or teacher writes in "How is it going?", and whether they agreed to be quoted. It is emailed to us and kept with the account; a quote appears on the site only if they ticked the box, word for word, signed as they asked.
- For a family plan, the payment provider's customer and subscription identifiers, the plan, and the date it renews. The card number never reaches this site; the payment provider holds it.
- The hosting provider keeps ordinary request logs, including IP addresses, for a short time for security and to diagnose faults. They are not used to profile anyone.
What is not kept
- No advertising, no advertising identifiers, no tracking pixels. The site measures page views and how quickly pages load without a cookie, without storing an IP address and without following anyone between sites: it cannot tell which child, or which household, was reading. Nothing is sent to an advertiser.
- Nothing written on the board leaves the device. The pages of working are stored in the browser only, and wiped when the browser data is.
- No location, no contacts, no microphone or camera. No data is sold, rented or shared for anyone else's marketing.
Where it is, and who else touches it
Each of these handles data only to do the one job named, under its own contract with us.
- Runs the site and keeps request logs for security and diagnosing faults.
- Stores account information and synced learning records in the United States, encrypted at rest.
- Sends sign-in links, invitations, and weekly summaries when an adult opts in. It sees the address and message. Summaries include child nicknames and saved progress; they can be turned off in Account or through the unsubscribe link. Pending delivery snapshots are kept for up to 30 days and cleared after successful delivery.
- Used only when a parent chooses to sign in through an external account.
- Processes family-plan payments and stores payment card details. This site never receives the card number.
Cookies and the browser
Two cookies, both needed for the site to work: one holds the signed session so you stay signed in, one remembers which child's profile is open on this device. The browser's own storage keeps the theme, the board's pages, and a copy of practice results so the site works offline; Family syncs when it is back. There are no cookies for advertising, and the page-view and speed measurement sets none either, so there is nothing to consent to.
Downloaded practice units stay on this device for up to seven days. Downloads are removed when you sign out, switch learners using the account controls, or choose Remove all downloads. The offline cache contains a generic practice page and public scripts and fonts, never account pages or teacher editions. Read prompt uses an English voice installed on your device; prompt text is not sent to a speech service.
Fault reports contain a fixed error category, an error fingerprint and the software release. They exclude names, email addresses, answers, cookies, page URLs and exception messages. When configured, these reports go through our server to our error monitoring provider.
Children
The site is for children, and it is built so that a child never gives it anything about themselves. A child under 13 uses a profile a parent made; the parent's consent is the act of making it, and the parent can see and delete every result under it. A student of 13 or over may have their own account, either by accepting a parent's or teacher's invitation or by signing up; the inviter can then see that student's progress but never change it. We do not knowingly collect anything from a child under 13 without a parent, and if you believe a child has an account, write to hello@cartomath.com and it will be removed.
Seeing, taking and deleting it
- Everything kept about a child is on that child's progress sheet in the account, which can be printed.
- Deleting the account, from the account page, removes the account, every child profile under it and all their results from the server at once, and clears this device. There is no waiting period and no copy kept, other than the hosting provider's short-lived logs and the payment provider's records of past payments, which the law requires it to hold.
- Ask for a copy of the data in a file, a correction, or anything else at hello@cartomath.com. You will have an answer within thirty days, usually far sooner.
Changes
If this page changes in a way that matters, the date at the top changes and every account is told by email before the change takes effect. Nothing is collected retroactively.