Privacy Policy

Effective 23 August 2026

PEDMAS is a mathematics learning service at www.pedmas.com, operated by BAAF Consulting Inc.. This policy explains what we collect, why we collect it, and how you remove it. It covers parents and children alike.

Who holds an account

Accounts are held by adults. A parent or guardian creates the account and adds a profile for each child. Children do not create their own accounts and we do not ask children for contact details.

What we collect

About the account holder:

• Name and email address, so we can identify the account and send service messages.
• A password, stored only as a salted scrypt hash. We never store the password itself and cannot recover it.
• Subscription status and billing identifiers supplied by Stripe. Card details are handled entirely by Stripe and never reach our servers.

About each child profile:

• A first name or nickname chosen by the parent. A real name is not required, and a nickname is fine.
• School grade, and optionally age and a learning goal.
• Learning activity: which questions were answered, whether each was correct, hints used, placement results, mastery levels and streaks.

We do not collect a child’s address, phone number, photograph, precise location, or any biometric data. We do not ask children to write free text about themselves, and we do not run advertising or third-party tracking on the service.

Why we collect it

• To place a child at the right level and choose their next question — the core purpose of the service.
• To show a parent how their child is progressing.
• To keep the account secure and to take payment for the subscription.

We do not sell personal information, and we do not use children’s learning data for advertising or to build profiles for any purpose other than teaching them mathematics.

Children under 13

A parent or guardian must consent before a child profile is created, and we record that consent with the date and the version of this policy. A parent may at any time review what we hold about their child, correct it, or delete it — see below. Deleting a child profile removes their learning history.

Deleting your data

You are in control. From your parent dashboard you can delete an individual child profile, or your entire account. Deleting the account removes the account record, every child profile on it and all associated learning history from our database.

Deletion is immediate and cannot be undone. Records we are required to keep for accounting or fraud-prevention purposes, such as Stripe payment records, are retained by Stripe under their own policy. You can also write to privacy@pedmas.com and ask us to do it for you.

How long we keep it

Learning data is kept while the account is in use, because progress and spaced review depend on history. If you delete a profile or account it goes immediately.

We do not keep it indefinitely. If nobody signs in and no child practises for 24 months, we email the account holder a warning and then, 30 days later, permanently delete the account and every child profile and learning record on it. Signing in at any point resets the clock, and an account with an active subscription is never deleted this way. This runs automatically — it is not something you have to ask for.

Who else sees it

• Stripe — payment processing and subscription status.
• Neon — the database that stores account and learning records.
• Vercel — hosting and delivery of the website.
• Brevo — sending service email such as password resets and progress summaries.

These providers process data on our instructions in order to run the service. We do not share personal information with anyone else, and we never sell it.

Security

Passwords are hashed with scrypt and a per-account salt. Sessions use signed, HTTP-only cookies. Traffic is served over HTTPS. Sign-in and password-reset attempts are rate limited. No system is perfectly secure, but we do not store card numbers and we keep what we do store to a minimum.

Your rights

Depending on where you live you may have rights to access, correct, export or delete personal information, and to withdraw consent. The deletion controls in the app cover the common cases immediately; for anything else, write to privacy@pedmas.com and we will respond.

Changes

If we change this policy materially we will ask account holders to review and accept the new version before continuing to use the service.

Contact

BAAF Consulting Inc.
67 Masters Green Cres, Brampton, Ontario L7A 3K6, Canada
privacy@pedmas.com