Math Scrimmage
Security & privacy
Last updated October 11, 2026
Most of our students are under 13. We built Math Scrimmage the way we'd want it built for our own kids: collect as little as possible, show each person only what they should see, and let parents decide.
- A parent gives permission before we keep a child's practice data, and can delete it all any time.
- Kids' names are never sent to the AI service. It sees "Student A", not your child.
- No ads, no analytics, no trackers, no selling data. Ever.
- Kids don't have email addresses, and we never ask for a phone number or location.
- Every connection is encrypted. Passwords and PINs are stored scrambled.
Parents are in charge
- Permission first. When a coach adds a child, a parent confirms before the child can practice. We record each permission and email a confirmation. A coach can't give permission for a family.
- See everything. In your parent account you can see every test with your child's answers, every report, every practice sheet and every email we've sent you.
- Delete any time. One button in Settings deletes your child's account and all of their practice history. Copies of past emails about your child are blanked too. We email you a confirmation.
- We don't keep data forever. Accounts that have been inactive for two years are deleted, under a written retention policy.
What we don't collect
- No email address, phone number, home address, location or contacts for kids. Kids sign in with a username and PIN from their coach.
- No advertising, analytics, tracking or crash-reporting services, in the app or on this website.
- This website sets no cookies and collects nothing (see the website privacy statement).
How we use AI, carefully
- AI (Anthropic's Claude) helps write practice questions, check written answers, and draft summaries and reports.
- It never sees a child's name: students appear as "Student A", "Student B", and names are put back on our own server.
- Under Anthropic's commercial terms, the data isn't used to train its models.
- Anything a child reads from the AI is written under child-safety instructions, and every practice question is reviewed before a child sees it.
Who can see what
- Parents see only their own children.
- Coaches see only their own teams.
- School administrators can look at their school's teams but can't change anything.
- Teammates never see each other's scores. Team rankings show a child only their own place.
Keeping accounts safe
- Encrypted connections only. Every page and app request uses HTTPS with modern encryption (TLS 1.2 or newer); older, weaker connections are refused.
- Scrambled passwords. Passwords and PINs are stored hashed with Argon2, never as plain text.
- Limits on guessing. Sign-ins are rate-limited, and a PIN locks for 15 minutes after 5 wrong tries.
- Face ID and Touch ID for coaches. Coaches can sign in with a passkey, and adding one requires their password.
- Sign-ins stay on the device. On iPhone and iPad, sign-in details are kept in the device's Keychain.
- Extra checks for big changes. Deleting a child's data asks for the parent's password again.
Checked regularly
- We run automated security reviews on a regular schedule, and every problem found is fixed with a test so it can't come back.
- We follow a written security program, with a yearly review and a plan for telling families promptly if anything ever goes wrong.
- Found a security issue? Email security@mathtrainerapp.com.
The companies that help us
Railway hosts the app and its database, Cloudflare delivers it securely, Resend sends our emails, Anthropic provides the AI (without names), and Apple distributes the iPhone and iPad app. That's the whole list.
The full details
The app's privacy notice for families explains exactly what we collect and why, written for the U.S. children's privacy law (COPPA): mathtrainerapp.com/privacy.