Privacy Policy

The data controller is the MathVoyage project operator (GitHub @forty4). The repository and change history are available in the public repository.

For general questions, use GitHub Issues, but do not post personal information such as email addresses, tokens, or anonymous identifiers in a public issue. Before public account access is enabled, we will publish an email address that is actively monitored. It may be an existing address and does not need to be dedicated to MathVoyage.

• Before sign-in: the random mv:client-id created in the browser; exploration, quiz, learning-path, and season progress; the anonymous identifier needed to edit notebooks and open-problem contributions; and, when analytics is enabled, a random per-tab voyage session identifier with a 30-minute inactivity boundary. If selected in analytics settings, we also process a separate persistent voyage identifier with a 30-day inactivity boundary, device/browser/OS families, and IP-derived country, region, and city.
• When signing in with Google: the Google account’s unique identifier, email address, display name, profile image, and language setting
• Information you create: math notebooks and cards, open-problem attempts, an optional nickname, visibility choices, recommendations, and reports
• Operations and security information: request timestamps and error or security events. Account export and deletion logs use a shortened hash instead of the original user ID.

Raw OAuth ID tokens and session JWTs are not stored in the database or application logs.

• Preserve local progress and editing rights for anonymous contributions before sign-in
• Merge progress across devices and claim existing contributions after sign-in
• Share and index public notebooks and attempts when the user chooses public visibility
• Improve flows from a question to exploration, comparison, and sharing through either the default anonymous session or a pseudonymous persistent voyage selected by the user
• Process reports, prevent duplicate recommendations, secure the service, and respond to incidents

We do not sell personal information or use it for advertising profiles beyond the purposes described here.

• Progress before sign-in remains in browser localStorage until the user clears browser data or resets progress.
• The analytics voyage session is stored only in the tab’s sessionStorage, rotates after 30 minutes of inactivity, and disappears when the tab is closed.
• The optional persistent voyage identifier is stored in localStorage and rotates after 30 days without activity. The analytics choice remains in the browser until withdrawn and can be turned off from this page at any time.
• Accounts and user data remain in PostgreSQL until an account-deletion request is made.
• The mv_session cookie lasts up to 30 days and is set as HttpOnly, Secure in production, and SameSite=Lax.
• Account deletion is applied to the active database immediately. Before public account access is enabled, production backups will use daily snapshots retained for six days, and we will verify that deleted data expires from backups within no more than seven days.

Google sign-in will not be opened to the general public until the backup schedule and a restore drill have been verified in production.

The service may use infrastructure from the following providers:

• Google: optional Google sign-in and account information selected by the user
• Vercel: frontend hosting and same-origin API forwarding
• Railway: backend and PostgreSQL hosting
• Sentry: error tracking. Tokens and raw anonymous identifiers are intentionally not sent.
• PostHog: semantic activity metrics and device/browser/OS families when configured. GeoIP and person profiles are off by default. If selected, we use country/region/city GeoIP and 30-day continuity, and connect a pseudonymous analytics profile to the account flow only when that separate option is selected. URL queries, referrers, exact time zones, and mathematical inputs are removed; autocapture and session recording remain disabled.

Each provider’s processing location and retention policy also apply. We will update this policy before changing which services are active.

Public notebooks and open-problem attempts that have not been hidden can be viewed by anyone. When deleting an account, the user chooses one of the following:

• Keep anonymously: keep public contributions, but remove the account, nickname, and prior anonymous identifier and replace them with new unlinkable tombstone identifiers
• Delete all: delete notebooks and open-problem attempts owned by the account regardless of visibility

Reports and fact-check history may be retained for service integrity after removing the link to the user.

Signed-in users can use Account settings to export data as JSON or delete the account. Local data created before sign-in can be reset in Progress or removed by clearing browser storage.

If you cannot access your account, contact support. Optional analytics can be changed or withdrawn at any time in the analytics settings on this page. Do not include personal information in a public request.

Learning content that does not require sign-in is available regardless of age. Account features are not offered to users under 14 until a process for legal-guardian consent is in place.

Sessions use an HttpOnly cookie, user-data changes require authorization checks and transactions, and content synchronization does not write user data.

If processing purposes, external services, or retention periods change, we will update this page and its effective date before the change and announce material changes in the service.