Zombie Math Privacy Notice
Effective date: October 3, 2026
This notice explains what information Best Friend Labs ("we," "us," "our") collects when you use Zombie Math at zombiemath.org (the "Service"), how we use it, who can see it, and the choices you have. It is part of our Terms of Service.
The short version: Zombie Math is built to collect as little personal information as it can. The only personal information we store about a person is the email address of a parent, guardian, or teacher who creates an account. Students never give us a name, email, birth date, school, or location. We do not run advertising, we do not use third-party analytics, we do not track anyone across other sites or apps, and we do not sell or rent anyone's information.
1. Who this notice covers
- Parents and guardians who create a family account.
- Teachers who create a teacher account and student accounts for their class.
- Organization administrators at a school, district, or tutoring business.
- Students who use accounts created for them by one of the adults above.
- Live Session participants who join a teacher's Live Teaching Session by link, without an account.
- Visitors to our public pages.
2. What we collect
2.1 Parents and guardians
| What | Why |
|---|---|
| Email address | To create your account and your student's account, send the student's sign-in details, send password-recovery and account emails, and reach you about the Service |
| Password | Stored only as a one-way hash; we cannot read it |
| Link to the student accounts you observe | To show you your student's progress on the parent/guardian dashboard |
| Settings you choose (for example, the fact-practice timer or Guided Practice hints) | To apply them to your student's experience |
We do not ask for your name, your child's name, your address, or a phone number.
2.2 Teachers and organization administrators
| What | Why |
|---|---|
| Email address | Account sign-in, recovery, and Service emails |
| Display name (optional) | Shown to your students and colleagues inside the Service |
| Password | Stored only as a one-way hash |
| Class names, seat allocations, and organization membership | To run your classes and, for organizations, to manage seats and teacher accounts |
2.3 Students
Student accounts are created by a parent, guardian, or teacher. The Service does not collect from a student, and the adult creating the account is not asked for, the student's name, email, birth date, age, grade, school, photo, or location.
| What | Why |
|---|---|
| Username | Generated by the Service (an adjective, a noun, and digits) or assigned by the teacher; it is the student's identifier and display name |
| Password | Stored only as a one-way hash |
| Avatar choice | A cartoon avatar the student picks |
| Learning activity | Which questions were answered, whether they were right, which help was used on each one (a hint, a worked solution, or step-by-step Guided Practice), points and scores, skill mastery levels, fact-practice results, pretest and review-round results, time spent, streaks, session history, and confidence taps (whether the student marked an answer as "sure" or "not sure") |
| Content flags | If a student reports a problem with a question, we store the report, the question, and the student's username at the time |
| Class and organization membership | Which class and, if any, which organization the account belongs to |
Learning activity is the core of the Service. It is what drives problem selection, spaced review, and the progress reports parents and teachers see.
2.4 Live Teaching Sessions
Participants in a Live Session do not need an account. The Service assigns each participant a temporary handle and relays their in-session activity (which question they are on, right and wrong answers, hand raised) to the teacher's screen in real time. None of this is written to our database. When the teacher closes the session, it is gone. Live Session traffic passes through our real-time messaging provider (see Section 5) in transit only.
2.5 Collected automatically
| What | Details |
|---|---|
| Sign-in session cookie | Set when you sign in so you stay signed in. Required for the Service to work. |
| Student-view cookie | Set only when a teacher previews the Service as a student; it holds a mode flag, nothing personal. |
| Abuse-prevention hashes | When someone signs up or attempts to sign in, we store a one-way hash of the email or username and a one-way hash of the IP address, so we can slow down repeated attempts. We never store the raw IP address for this purpose, and these rows are deleted after 24 hours. |
| Server logs | Our hosting provider keeps standard web-server logs (IP address, browser type, pages requested, timestamps) for a short period for security and reliability. We do not use them to profile anyone. |
| Screens used | For every account (student, parent or guardian, and teacher), which screens of the Service it opened on each day, and how many times. We keep only a daily count per screen: no web addresses, no times of day, and nothing about the device. We use it to see which parts of the Service are used, by which kind of account, so we can improve them. |
We do not use third-party analytics, advertising pixels, social-media widgets, session-recording tools, or fingerprinting. We do not respond differently to "Do Not Track" signals because we do not track anyone across sites or apps.
2.6 What we do not collect
No names of children. No precise or approximate geolocation beyond what a server log inherently contains. No contacts, photos, microphone, or camera access. No payment details (the Service currently has no paid features; if that changes, payments will be handled by a payment processor and this notice will be updated first). No biometric data. No data from other apps or data brokers.
3. Children's privacy (COPPA)
Zombie Math is used by children under 13. We comply with the Children's Online Privacy Protection Act by collecting only the minimum information needed to run an educational service and by obtaining consent from an adult before any child account exists.
- Consent. A child's account can only be created by a parent or guardian (who consents by creating it) or by a teacher or school (which consents on parents' behalf for educational use, as COPPA permits, and is responsible for any notice the school owes parents).
- No personal contact information from children. Students cannot enter an email address, phone number, or free-text personal details. The only free-text field available to a student is a content-report description, and the Terms of Service prohibit putting personal information there.
- No behavioral advertising, no sale, no public profiles. Student data is used only to provide the Service to that student and to the adults responsible for them.
- Parental review and deletion. A parent or guardian can see their student's learning data on the dashboard at any time and can ask us to delete the student's account and all of its data (Section 8).
- Schools. Where a school created the account, student data belongs to the school. We act as a "school official" under the Family Educational Rights and Privacy Act (FERPA), use the data only as the school directs and only to provide the Service, and delete it on the school's request.
If we learn that we have collected personal information from a child without the required consent, we will delete it.
4. How we use information
We use the information above to:
- create and secure accounts and let people sign in;
- select problems, run spaced review, score answers, and track mastery for each student;
- show progress to the student and to the parent, guardian, teacher, or organization responsible for that student;
- send account emails: sign-in details, password recovery, parent-dashboard setup, and important notices about the Service;
- prevent abuse, fraud, and unauthorized access;
- find and fix errors in lesson content, including reviewing content flags;
- understand how the Service is used, in aggregate, so we can improve it; and
- comply with law and enforce our Terms of Service.
We do not use personal information for marketing to students, for advertising, or to build profiles for any purpose other than the educational one described here. We do not use student data to train machine-learning models.
5. Who can see information
Inside the Service, by role:
- A student sees their own progress.
- A parent or guardian sees the progress and settings of the students linked to their account.
- A teacher sees the progress of students in their classes, and the class-level content flags.
- An organization administrator sees the teachers, seats, and classes within their organization.
- Best Friend Labs staff can access account and learning data when needed to support users, investigate abuse, fix bugs, and administer the Service, including reviewing content flags and processing deletion requests.
Service providers. We use a small number of companies to run the Service. They process data only on our instructions and only to provide their service to us:
| Provider | What it does |
|---|---|
| Vercel | Hosts the application and keeps server logs |
| Supabase | Hosts the database, handles sign-in, and relays Live Session messages |
| Mailjet | Delivers the emails we send |
Legal and safety. We may disclose information if we believe it is required by law, subpoena, or court order, or is necessary to protect the safety of a child or other person, to investigate abuse, or to protect our rights.
Business transfers. If Best Friend Labs is acquired, merges, or sells assets, information may transfer to the successor, who must honor this notice or give you notice and a chance to delete your account before using your data in a materially different way.
We never sell or rent personal information, and we never share it with advertisers or data brokers.
6. Where information is stored
Information is stored on servers in the United States. If you use the Service from outside the United States, you are sending information to the United States, where privacy laws may differ from those where you live.
7. How long we keep information
| Information | Kept for |
|---|---|
| Account, learning, and screen-use data | As long as the account exists. Deleted when the account is deleted (Section 8). |
| Sign-up and sign-in abuse hashes | 24 hours |
| Sign-in links and setup tokens | Until used or expired, whichever is first |
| Live Session data | Not stored |
| Seat promises | If we promise a teacher extra student accounts before they have an account with us, we keep the email address the promise is for until they sign up and it is applied. If they never sign up, the address stays until we remove it; ask us and we will. |
| Consent record | Kept indefinitely. When an adult creates an account they confirm a short statement (for example, that they are the student's parent or guardian). We keep that statement, the date, the version of these documents, and a one-way hash of the email address — never the address itself. The hash cannot be used to contact anyone or to recover an address; it only lets us check whether a particular address gave consent. This record survives account deletion so we can show that consent was given. |
| Deletion record | After an account is deleted we keep a short audit entry with the date, the role, and a masked email such as j***@example.com. The masked value cannot be used to contact anyone. |
| Emails we sent you | Retained by our email provider for a limited period for delivery diagnostics |
| Server logs | A short, rolling period set by our hosting provider |
We may keep aggregate or de-identified statistics (for example, how often a particular question is answered incorrectly) indefinitely; they cannot be linked back to a person.
8. Your choices and rights
See your student's data. Parents, guardians, and teachers can view learning data on their dashboards at any time.
Change your email or password. From your account settings, or through the recovery flow on the sign-in page.
Delete an account. Email hello@zombiemath.org from the address on your account. We will verify the request and delete the account and everything that belongs to it. Please note:
- Deleting a student account removes all of that student's learning data. It cannot be undone.
- Deleting a parent or guardian account also deletes any self-serve student accounts that have no other adult attached, because nobody could reach them otherwise.
- Deleting a teacher account deletes their classes; the students in those classes keep their accounts and progress but are no longer in a class.
- Student accounts created by a school belong to the school, and deletion requests for those accounts should come from the school.
Get a copy of your data. Email us and we will provide the information we hold about your account in a portable format.
Stop emails. We only send account and Service emails, not marketing. You cannot opt out of essential account emails while you hold an account, but you can delete the account.
We will respond to requests within 30 days. We do not discriminate against anyone for exercising a privacy right.
9. Additional rights under state law
Depending on where you live, you may have rights to know what personal information we hold, to correct it, to delete it, to receive a copy, and to opt out of sale, sharing for targeted advertising, and certain profiling. We do not sell personal information, share it for targeted advertising, or profile anyone in a way that produces legal or similarly significant effects, so there is nothing to opt out of. You can exercise the other rights as described in Section 8. If we deny a request, you may appeal by replying to our response; we will explain the outcome of the appeal in writing.
For students, these rights are exercised by the parent, guardian, or school responsible for the account.
10. Security
Passwords are stored only as one-way hashes. Data is encrypted in transit. Database access is restricted by row-level security so that each account can reach only the rows it is entitled to see, and the Service does not hold long-lived administrative keys. Sign-up and sign-in are rate-limited. No system is perfectly secure, so we cannot guarantee security, but we will notify affected account holders and any relevant school without unreasonable delay if we learn of a breach involving their information, as required by law.
You help by keeping sign-in emails and student credentials private, and by telling us at hello@zombiemath.org if you think an account has been compromised.
11. Links to other sites
The Service may link to outside websites. This notice does not cover them, and we are not responsible for their practices.
12. Changes to this notice
We may update this notice as the Service changes. If we plan to collect a new kind of personal information from students, or to use information in a materially different way, we will update this notice first and, where the law requires it, obtain fresh consent before the change takes effect. For other material changes we will give notice by email or within the Service before the change takes effect. The effective date at the top shows the current version.
13. Contact
Questions, requests, or concerns about privacy:
Best Friend Labs hello@zombiemath.org zombiemath.org