Privacy Policy

This Privacy Policy describes how Third Technology LLC (“we,” “us,” or “our”) collects, uses, shares, and protects information when you use Nummmbers and the Make Math Mine learning service (collectively, the “Service”).

1. Information We Collect

Information you provide directly. When you create an account, we collect your email address. We do not store your password. When you create an account, your password is sent to our authentication provider (Supabase), which stores only a salted hash for verification purposes. You may optionally provide additional profile information such as a display name, your learning goals, math background, and interests.

Learning activity. We collect information about your interactions with the Service, including lessons viewed, answers submitted, problems attempted, time spent on each section, mastery progress, written reflections, and feedback you provide on content.

Payment information. If you start a paid subscription, our payment processor (Stripe, Inc.) collects and processes your payment details directly. We do not see or store full payment card numbers; we receive only a transaction identifier and limited metadata (such as the last four digits of your card and billing country).

Device and usage data. We automatically collect technical information when you use the Service, including IP address, browser type and version, operating system, device type, referring URL, pages viewed, and timestamps. This information is used for security, debugging, and product analytics.

Communications with us. If you contact support, we collect the content of your messages and any information you choose to share.

2. How We Use Information

We use the information we collect to:

• provide, maintain, and improve the Service, including personalizing lessons, hints, and practice problems based on your activity;
• process payments and manage your subscription;
• send you transactional emails (account confirmations, receipts, security notices) and, with your consent, occasional product updates;
• generate AI-powered explanations, hints, and feedback by sending relevant context to our AI providers (see Section 3);
• analyze usage patterns to improve curriculum quality and product design;
• detect, prevent, and respond to fraud, abuse, security incidents, and violations of our Terms;
• comply with legal obligations and enforce our agreements.

You may opt out of non-transactional emails at any time using the unsubscribe link at the bottom of those emails or by contacting us at support@nummmbers.com. We will continue to send transactional and service-related messages (such as account confirmations, receipts, security notices, and billing reminders) for as long as your account is active.

3. How We Share Information

We do not sell your personal information, and we do not share it for cross-context behavioral advertising (as those terms are defined under the California Consumer Privacy Act). We share information only with the categories of recipients described below.

Service providers (sub-processors). We use trusted third parties to operate the Service. Each is contractually bound to handle your information consistent with this policy. Our current sub-processors include:

• Vercel, Inc.: application hosting and content delivery
• Supabase, Inc.: database and authentication
• Anthropic, PBC: AI model provider for lesson explanations, hints, and feedback
• Stripe, Inc.: payment processing
• Resend: transactional email delivery
• PostHog, Inc.: product analytics
• Sentry (Functional Software, Inc.): error monitoring and debugging

AI providers. When you use AI features, we send relevant context (such as your current lesson, your answer, and your question) to our AI provider to generate a response. Under our current agreements with our AI providers (including Anthropic), they are prohibited from training their foundational models on data we send through their APIs. Your prompts, answers, reflections, and uploaded materials may be processed and retained by AI providers as needed to generate responses and operate their service (including safety review), in accordance with their API terms. We do not send your full account profile or payment information to AI providers, and we do not use Your Content to train AI models. If this changes, we will notify you in advance and provide an opportunity to opt out before the change takes effect.

Legal and safety. We may disclose information if required by law, subpoena, or court order, or if we believe disclosure is necessary to protect the rights, property, or safety of us, our users, or the public.

Business transfers. If we are involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction, subject to standard confidentiality protections.

4. Cookies and Analytics

We use cookies and similar technologies to keep you signed in, remember your preferences, and understand how the Service is used. We use the following categories:

• Strictly necessary. Required for the Service to function (authentication, security, session continuity). These cannot be disabled.
• Analytics. PostHog cookies help us understand aggregate usage patterns. You can opt out of analytics cookies; opting out does not affect access to the Service.

You can change your analytics-cookie choice at any time: manage cookie preferences.

You can also manage cookies through your browser settings. Most browsers allow you to refuse, block, or delete cookies, though this may affect Service functionality.

Do Not Track and Global Privacy Control.We do not currently respond to “Do Not Track” browser signals. We do not sell personal information and do not share it for cross-context behavioral advertising, so the practical effect of these signals on the information we collect is limited.

5. Data Retention

We retain your information for as long as your account is active. When you request account deletion, your account is scheduled for deletion after a 30-day grace window — you can sign back in at any time during that window to cancel the deletion and keep your account and data. After the grace window ends, we apply the following retention windows:

• Account, profile, and learning activity (including reflections and uploaded materials): purged from live systems within 7 days after the grace window ends.
• Backups: rotated out within 90 days of the purge from live systems.
• Security and system logs: retained approximately 90 days for incident response, then purged.
• Billing and tax records: retained for up to 7 years to comply with tax and accounting obligations.
• Aggregated, de-identified information (that cannot reasonably be used to identify you): may be retained indefinitely.

You may request deletion of your account and associated data at any time (see Section 6). We may retain information beyond the windows above where required to resolve disputes, comply with legal obligations, or enforce our agreements.

6. Your Privacy Rights

Depending on where you live, you may have the right to:

• access the personal information we hold about you;
• correct inaccurate or incomplete information;
• request deletion of your information;
• object to or restrict certain processing;
• receive a copy of your information in a portable format;
• withdraw consent where processing is based on consent;
• lodge a complaint with your local data protection authority.

We provide all users with the ability to access, correct, and delete their personal information from within the app, regardless of location. To receive a copy of your information in a portable format, email support@nummmbers.com and we will provide it. Residents of the European Economic Area, the United Kingdom, or Switzerland have these rights under the GDPR and equivalent laws. If you are a California resident and the California Consumer Privacy Act / California Privacy Rights Act applies to our business in the future (we are currently below the statutory thresholds), additional statutory rights and procedures will apply and we will update this policy and provide required notices. We do not sell your personal information and we do not share it for cross-context behavioral advertising.

To exercise any of these rights, contact us at support@nummmbers.com. We will respond within the timeframe required by applicable law. We will not discriminate against you for exercising your privacy rights.

7. International Data Transfers

We are based in the United States, and our sub-processors may process your information in the United States and other countries. By using the Service, you understand that your information may be transferred to and processed in countries with data protection laws different from those in your country. Where required, we rely on appropriate safeguards (such as Standard Contractual Clauses) for international transfers.

8. Security

We use industry-standard technical and organizational measures to protect your information, including encryption in transit (HTTPS), encryption at rest, access controls, and regular security review. No system is perfectly secure; we cannot guarantee the absolute security of your information. If we become aware of a breach affecting your information, we will notify you and applicable authorities as required by law.

9. Children's Privacy

The Service is intended for adults aged 18 and older. We do not knowingly collect personal information from anyone under 18. If you believe a child has provided us with personal information, contact us at support@nummmbers.com and we will delete the information promptly.

10. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or through the Service before the changes take effect. The “Last updated” date at the top of this page indicates when the policy was last revised.

11. Contact

If you have questions about this policy or our privacy practices, contact us at support@nummmbers.com.