Privacy at Math Vale

Math Vale asks for a username, a display name and a password. That is all. There is no email address, no phone number, no date of birth, no real name and no address — nowhere to type them, and no column in the database to hold them.

There is no advertising, no analytics, no tracking pixels and no third-party scripts. Nothing about a player is sold, shared or used to build a profile, because none of the machinery for doing that exists here.

• Your account — username, the display name you chose, and your password stored as a bcrypt hash. Nobody, including whoever runs this server, can read your password.
• Your adventurer — its name, appearance, class, level, gold and where it is standing on the map.
• Your learning — every problem answered, whether it was right, which hints were opened, how long it took, and the mistakes recorded in your Journal. This is what makes the game adapt to you, and it is the point of the whole thing.
• Your groups — the classes and family you belong to, if any.
• Your blocks and reports — who you have blocked, and, if you reported somebody, who, which of three fixed reasons you picked and when. There is no box to type into, so a report never holds anything you wrote.

A display name does not have to be your real name, and the game never asks for one. A first name or a nickname is fine.

• Other students see almost nothing. Classmates never see each other’s marks, scores or mistakes. On the map they see a display name and an adventurer walking around.
• Class boards are off until you turn them on. Nobody appears on one by default, and nothing is lost by staying off.
• A teacher sees the progress of students in their own class.
• A parent or guardian sees the progress of a child linked to them.
• Travellers are not people. Some characters you meet are part of the game, not other students, and every screen that shows one says so.

One cookie, ym_session, which keeps you signed in. It is HttpOnly (scripts cannot read it), Secure (it only travels over HTTPS) and SameSite=Lax. There are no advertising or analytics cookies, so there is nothing here to consent to or opt out of.

• Cloudflare carries traffic between your browser and this server and protects it from attack. Like any web host it processes IP addresses and ordinary request logs. Math Vale itself does not store your IP address.
• Backblaze B2 holds the nightly backups. Those are encrypted with AES-256 before they leave this machine, and the key is not shared with them — the backups are unreadable to Backblaze and to anyone who obtained them from Backblaze.

That is the complete list. Fonts are served from this domain rather than fetched from Google, so loading a page here does not tell anyone else that you did.

Your data stays while the account exists. Backups are kept for 30 days and then deleted automatically, so a deleted account disappears from the backups within a month.

You can delete an account yourself, from inside the game: on the web it is at the bottom of the character sheet, and in the apps it is the last thing in Settings. A full account asks for its password first; a guest account has none, so it asks you to confirm. Deleting removes the adventurer, the learning history, the Journal, the homestead and every block and report that names the account, at once and for good. A spar or a Castle Defense that has already finished stays in the other players’ history, under the name “Adventurer” rather than yours. Deleting a teacher’s account also closes that teacher’s classes.

To see a copy of everything held about an account, or to correct it, ask whoever runs this server — for a family that is the parent who set it up, and for a class it is the teacher or the school. For mathvale.com itself, the address is on the support page.

This game is built for children, which is why it asks for so little: no email address means no mailing list, no password resets by email, and nothing to leak. If a school or a club runs Math Vale for a class, the school decides what is collected and remains responsible for it, and a parent should ask the school first.

If you are a parent and something here is unclear, ask before your child signs up. A question about a child’s privacy is always a reasonable question.

If what the game collects ever changes, this page changes with it and the date at the top moves.