Maths Heron privacy notice

For young people: the short version

This part is for you if you're the student using Maths Heron. Your parent or guardian has the full version below.

• Your parent or guardian set up Maths Heron for you. They hold the account, not you.
• We only know a little about you: the first name or nickname your parent typed in, your school year (9, 10 or 11), and whether you're doing Foundation or Higher.
• We keep your answers and scores so we can mark your work, pick questions that help you improve, and show your progress.
• Your parent or guardian can see your answers, scores and progress, including your grade estimate, mock paper results and flashcard progress. That's part of how Maths Heron works, so it's worth knowing.
• We don't show you adverts, we don't sell your information, and we don't track you around the internet. There's no chat, and nobody else using Maths Heron can see your work.
• The link to your sets is personal to you. Don't share it. If it stops working, ask your parent or guardian for a new one.
• Your information belongs to you. If you want to see it, fix it or have it deleted, talk to your parent or guardian, or email us yourself at [email protected]. If you're not sure about something, ask an adult you trust.

1. Who we are

Maths Heron (https://mathsheron.co.uk) is run by Maths Heron, a small UK business. We're the "controller" of your personal data, which means we decide how and why it's used.

• Email: [email protected]

We're a small organisation and haven't appointed a Data Protection Officer, because the law doesn't require us to. For anything about privacy, email [email protected].

2. What Maths Heron is, and who this notice covers

Maths Heron is a GCSE maths practice service for UK families, aligned to the Pearson Edexcel GCSE Mathematics (1MA1) specification. It isn't affiliated with or endorsed by Pearson. During the pilot, a parent or guardian aged 18 or over creates an account using an invite code and adds up to five children. Each child then practises through personal links sent to the parent by email.

This notice covers:

• parents and guardians who hold an account
• the children they add
• anyone who emails our support address

3. What we collect

About you, the parent or guardian

• Your email address. We use it to sign you in and to send you the service emails described in section 5.
• Your password, stored only as a one-way scrambled form (an Argon2 hash). We can't see your actual password.
• Account records: when you signed up, which invite code you used, when you confirmed your email address, when you last signed in, and that you confirmed you're the parent or guardian, aged 18 or over, and had read this notice (with the version of the notice you saw).
• Your email choice: whether you want the weekly progress email.

About your child

We deliberately keep this to a minimum.

• A first name or nickname (up to 30 characters), their year group (9, 10 or 11) and their tier (Foundation or Higher).
• The practice settings you choose: which days sets are sent, daily/weekly/monthly sets, mock paper type, topic areas, difficulty, send time, pauses, the exam date and the number of revision sessions per week.
• Their work: the questions in each set, their answers, the marks they get, any retries and hints shown, and when they opened and finished sets and timed mock papers.
• What we work out from their work:
  • how accurate they are on each topic
  • when a topic or formula card is due for review
  • their formula flashcard progress
  • their streaks
  • a GCSE grade estimate, shown as a likely grade range with a confidence level
  • a revision plan
• "This question looks wrong" reports. If your child flags a question, we record which question it was and which set it came from, so we can check it.

We don't ask for, and you shouldn't enter, your child's surname, date of birth, email address, school, photo or any other personal details. There's nowhere in Maths Heron to type free text about your child.

Technical and security information

• IP address. We record it alongside security events such as sign-ups, sign-ins, password changes and account deletions. We also use it briefly in memory to limit repeated attempts, for example too many wrong passwords.
• Server logs. Our web server logs each request to the site: the IP address, the page address and the time. These logs rotate automatically and we only ever keep a short, limited amount of recent log data. We never record the one-time links in your emails (sign-in, password reset, email confirmation or your child's set link) in these logs.
• Email delivery records: when each email was sent to you, what type it was, its subject line and whether it was delivered.
• Cookies and similar technology, explained in section 11.

If you email us

If you email [email protected], we receive your email address, your message and anything you include in it.

What we don't collect

• No location data. The site blocks access to your device's camera, microphone and location.
• No advertising or analytics trackers, and no third-party scripts on our pages.
• No open-tracking or click-tracking in our emails.
• No payment details. The pilot is free.

4. Where the information comes from

Almost everything comes from you (your account and your child's settings) or from your child using Maths Heron (their answers). We generate the rest, such as marks, progress summaries, grade estimates, revision plans and security records. We don't buy data or get it from other organisations.

5. Why we use it, and our legal reasons

UK data protection law says we need a valid legal reason, called a "lawful basis", for each use of personal data. Here are ours.

What we do	Information used	Lawful basis
Create and run your account, sign you in, and confirm your email address	Your account details	Contract. We need it to provide the service you signed up for (UK GDPR Article 6(1)(b)).
Create practice sets for your child, mark them, and show you and your child the results, progress, grade estimates, mock papers, revision plan and flashcards	Your child's profile, settings and work	Legitimate interests (Article 6(1)(f)). See below.
Send service emails: email confirmation, sign-in links, password resets, "your set is ready" emails, password-changed and account-deleted confirmations	Your email address, plus your child's nickname and set details in set emails	Contract (Article 6(1)(b))
Send the weekly progress email (Sunday evening)	Your email address; your child's nickname, year group, tier and weekly progress	Legitimate interests (Article 6(1)(f)). You can turn it off at any time in Account → Emails.
Keep the service and your account secure: limit repeated attempts, keep security records, prevent misuse	IP address, security records, email delivery records	Legitimate interests (Article 6(1)(f))
Check that our maths questions are correct, and investigate questions that are reported as wrong	The reported question and set; our own question checks	Legitimate interests (Article 6(1)(f))
Answer your emails and support requests	Your email and anything you send us	Legitimate interests (Article 6(1)(f))
Handle your data protection requests and complaints, keep the records the law requires, and deal with legal claims	Whatever the request involves	Legal obligation (Article 6(1)(c)), and legitimate interests for legal claims
Keep backups so we can recover from accidents	All of the above (in the backup copy)	Legitimate interests (Article 6(1)(f))

Our legitimate interests are:

• giving families the maths practice they have asked for
• making that practice useful to each child
• keeping the service secure and the questions accurate
• answering people who contact us

We have balanced these against your and your child's interests. We treat the child's best interests as the main consideration, which is why we collect so little about children and never use their data for advertising or marketing.

We don't rely on consent for using your data. The tick-boxes at sign-up confirm that you're the parent or guardian, aged 18 or over, and that you've read this notice. They aren't a request for consent.

Do you have to give us this information? To use Maths Heron, we need a working email address for you and a nickname, year group and tier for each child. Without them, we can't provide the service.

How Maths Heron adapts to your child, and what a grade estimate is

Maths Heron uses your child's past answers to:

• choose a mix of current topics, topics due for review, and weaker topics
• schedule topic reviews after 2, 7 and 21 days when an answer is wrong
• bring back formula cards they don't yet know
• decide the order of weeks in the revision plan
• produce a grade estimate

Using answers like this is a form of "profiling". It's done only to help your child practise maths, and only within Maths Heron. It's never used for advertising, and we don't share it with anyone.

• You can change the difficulty. "Adapt automatically" is the default because adaptive practice is the core of the service, but you can choose a fixed level instead (Support, On track or Stretch) in your child's settings.
• The grade estimate is only an estimate. It's not an official or predicted grade. It doesn't decide anything about your child, and it has no legal or similarly significant effect. Nobody uses it to make decisions about your child.
• We don't make any automated decisions about you or your child that have legal or similarly significant effects.

6. Who we share it with

We never sell personal data, and we never share it for advertising or marketing. We use a small number of service providers ("processors") who handle data only on our instructions:

Provider	What they do	Data involved	Where
Cloudflare, Inc.	Delivers the website securely over an encrypted connection (Cloudflare Tunnel and DNS). Also protects our admin area and forwards emails sent to [email protected] to our team's inboxes (Email Routing).	IP address and technical request data for everyone who visits the site. The contents of support emails pass through in transit.	Global network, including the USA
Resend (Plus Five Five, Inc.)	Sends our emails from [email protected]	Your email address and the email contents, which can include your child's nickname, year group, tier and progress	Sent from Ireland (EU); the company is in the USA
Microsoft (Outlook.com) and Apple (iCloud Mail)	Host the inboxes that support emails are forwarded to	Support emails you send us and our replies	USA and other countries

Maths Heron itself, including the database and backups, runs on our own server in the UK. It's not hosted with a cloud provider.

We may also share information if the law requires it, for example in response to a valid request from the police or a court. We may share it to protect someone's safety, or with our professional advisers. If Maths Heron is ever transferred to a new owner, your data would go with it, and we would tell you first.

7. International transfers

Some of our providers process data in the USA.

• Resend (Plus Five Five, Inc.) is certified under the UK Extension to the EU–US Data Privacy Framework (the "UK–US data bridge"). The UK government recognises it as giving adequate protection (Data Protection (Adequacy) (United States of America) Regulations 2023). Resend's data processing terms also include the UK's standard contractual clauses as a fallback. We have switched off open and click tracking.
• Cloudflare, Inc. is certified under the UK Extension to the Data Privacy Framework. Its data processing terms include the EU Standard Contractual Clauses with the ICO's UK Addendum as a fallback.

You can ask us for more information about these safeguards by emailing [email protected].

8. How long we keep it

Information	How long
Your account, your children's profiles and all their work and progress	While your account is open. When you delete your account, it's removed straight away from the live system.
A child profile you remove	Removed straight away, with all that child's work
Accounts with no activity	After 18 months without activity, we flag the account for review. We don't currently email you or delete it automatically — if we start doing that, we'll update this notice first.
Sign-in links and email confirmation links	They expire after 20 minutes (sign-in), 1 hour (password reset) or 48 hours (email confirmation), and are deleted a day after expiry. We only ever store a scrambled copy.
Signed-in sessions	14 days, then deleted
Your child's set links	They work for 30 days. You can switch them off sooner in your child's settings.
Email delivery records	12 months
Security records (including IP addresses)	24 months. When you delete your account, your email address in these records is replaced with an anonymous reference.
Backups	A rolling 30 days, so deleted data disappears from backups within 30 days
Copies of emails held by Resend	30 days
Web server logs	They rotate automatically and we only ever keep a short, limited amount of recent data. They never contain sign-in or reset links.
Support emails	12 months after the conversation ends

9. How we keep it safe

• The whole site is served over an encrypted (HTTPS) connection.
• The server isn't directly reachable from the internet. Traffic reaches it only through an encrypted Cloudflare Tunnel, and the database isn't exposed at all.
• Passwords are stored only as Argon2 hashes. Sign-in links, session tokens and child set links are stored only as scrambled (hashed) values.
• Sign-in attempts are rate-limited, and every form is protected against cross-site forgery.
• Strict browser security settings stop third-party scripts from running on our pages.
• The admin area needs a Cloudflare email-code check and a two-factor authenticator code, and only named team members can get in. Every time an admin views, exports or deletes a family's data, it's recorded.
• Backups are taken nightly. They aren't encrypted yet. We're working on adding encryption, and we'll update this notice once it's in place.
• Your child's set links can be switched off at any time from your child's settings.
• If a data breach happens that's likely to put you at risk, we'll tell you and the ICO as the law requires.

No system is perfectly secure, but we work hard to protect your family's information and to keep as little of it as possible.

10. Your rights

You have the right to:

• Access your data. You can download everything we hold about your family at any time from Account → Download my data. This gives you a file you can open or move elsewhere, so it also covers your right to data portability. You can also email us for a copy.
• Correct it. You can edit your child's nickname, year group, tier and settings yourself. To change your email address, email [email protected]. You can't do this in the app yet.
• Delete it. Account → Delete my account deletes your account and all your children's data straight away. You can also remove a single child in their settings. Or email us.
• Restrict how we use it while a concern is looked into.
• Withdraw consent. We don't rely on consent, but if we ever do, you'll be able to withdraw it at any time.

Your right to object. Where we rely on legitimate interests (see section 5), you have the right to object to how we use your or your child's data. For example, you can turn off the weekly progress email in Account → Emails, or choose a fixed difficulty instead of adaptive practice. For anything else, email [email protected] and we'll stop unless we have strong reasons to continue.

Children's own rights. These rights belong to your child as well as to you. In the UK, children aged around 12 or 13 and over who understand what they're asking can usually make requests themselves. We'll take your child's wishes into account.

How to make a request. Email [email protected] from the email address on your account, so we can confirm it's you. There's no charge. We'll reply within one month. If a request is complex, we may take up to two more months, and we'll tell you if we need to.

11. Cookies and similar technology

We only use what's needed to make the site work. There are no advertising, analytics or tracking cookies, so we don't show a cookie banner.

Name	What it's for	How long it lasts
sid	Keeps you signed in	14 days, or until you sign out
csrf	Security: protects forms against cross-site forgery	30 days
stu	Lets your child's set link and "My sets" work on their device, without a password	30 days
flash	Shows a one-off message, such as "Settings saved"	60 seconds
totp_setup	Used only by our team, while setting up admin two-factor sign-in	15 minutes

On your device:

• "Add to home screen" hint. If your child taps "Not now" on this hint, we remember that in the browser's local storage (a2hs-dismissed) so it doesn't keep appearing. Nothing is sent to us. You can clear it at any time by clearing your browser's site data.
• Installable app (service worker). If you install Maths Heron on a phone or computer, it saves copies of our styles, scripts and icons, plus an offline page. This makes it load faster and lets it show a message when you're offline. These copies contain no personal data. Your child's sets, answers and results are never stored offline.

Cloudflare also uses its own strictly necessary security and performance technology to protect the site. If you're on our team, it also sets a sign-in cookie for the admin area.

12. Complaints

If you're unhappy with how we've handled your or your child's data, please tell us first at [email protected]. We'll confirm we've received your complaint within 30 days, look into it, keep you updated, and tell you the outcome.

You can also complain to the Information Commissioner's Office (ICO), the UK's data protection regulator:

• Website: ico.org.uk/make-a-complaint
• Helpline: 0303 123 1113
• Post: Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF

13. Changes to this notice

We'll update this notice when how we use data changes. If we start using your or your child's data in a new way, we'll tell you by email before we start, and update the date at the top. Each version has a reference, and we record which one you saw when you signed up.