Your family’s learning records.

How families find us

On the public family introduction (/families), free sampler (/try), and parent guide to fractions (/guides/help-child-with-fractions), approved campaign links let us count browser opens by source. Across these three pages, visits from the same source in the same browser tab on the same UTC date share one browser-open count. A random request token in that browser tab helps prevent duplicate counts; it changes by source and date, is cleared when the tab closes, and is not an account or device identifier. The server uses a hash of the token only for 24-hour request deduplication. Opening another tab or returning on another day may count again. These are browser opens, not unique people.

At parent registration, an optional “How did you hear about us?” selection may be filled from the campaign link. You can change it or choose “Prefer not to say.” We count the source only when a new parent account is created, including accounts awaiting email verification. Existing accounts are not attributed retroactively. The report contains daily aggregate source counts from the last 90 days; the source is not saved on your parent or learner profile. Expired request hashes and aggregate counts older than 90 days are removed during subsequent tracking activity or operator checks, so physical deletion can occur later when the service is inactive.

These growth counts do not collect IP addresses, referring page addresses, names, email addresses, student answers or learning activity. No advertising cookies or external analytics service are used. Only the verified site operator can view the aggregate report; test traffic is shown separately. Service sign-in and infrastructure security records have their own purposes and retention described elsewhere in this notice.

Optional paid reasoning plan

A parent may choose a one-time plan for a learner aged 13 or older when sales are open. We save the order reference, amount, status, parent age declaration, accepted terms version, activation and expiry, and refund-request status to provide the purchased plan. The age declaration is not identity verification. Existing free learning remains available. The plan reuses the family's existing learning evidence; it adds no advertising profile or external AI processing.

Zelle transfers take place in your bank's application. Numerive does not collect bank account numbers, banking passwords, verification codes or payment screenshots. Only the verified operator can record a payment or refund after checking the bank. Duplicate-transfer checks use a hash of the bank reference. Zelle and your bank process the transfer under their own terms. Zelle does not offer purchase protection; Numerive provides the refund policy stated on the plan page.

Family exports include your order and access history. Deleting the learner or family removes its linked orders; the bank retains its own transaction records. Unlinked duplicate-transfer markers are removed after 90 days from confirmation. Learning backups exclude orders and payment markers: after an incident, paid access requires reconciliation with bank records, so an old backup cannot reverse a refund. Keep your order reference when contacting support about a payment, including after account deletion. Deleting an account does not cancel a valid refund claim.

Problem reports

Report a problem saves the selected category, optional description, page path, relevant topic or question reference, interface language, submission time and any screenshot you choose to attach. Screenshots are resized and file metadata is removed; crop out visible personal information before uploading. It does not automatically attach account identity, sign-in tokens or learning answers. Do not include personal information. Authorized operators and the Codex task assisting with site maintenance review reports; other families cannot view them. Reports, screenshots and review notes are retained for up to 90 days, then removed during daily maintenance, and are excluded from family recovery packages. For earlier deletion, contact support with the report reference.

Optional friends, study groups and parent-reviewed messages

Separate notice: us-social-groups-signed-2026-10-12-v2. Learning permission alone does not enable social features. For every minor, including children under 13, the guardian must use a verified parent account, read the direct social notice, print and hand-sign a learner-specific consent form, and return its photo or scan. The operator checks the signed form; only after approval can the parent separately activate messaging. No government ID or child photo is requested.

We store the guardian name, under-13 or 13–17 age range, signed form and review record, friendship and group approvals, blocks, selected group problems, private submissions, text messages and solution steps, reports and moderation actions. Known friends connect through a separate expiring invite code, student acceptance and both parents’ approval. There is no public directory. Nicknames, selected avatars and approved messages are shared with approved friends and their parents; grades and privately submitted answers are not automatically shared.

Study groups have a fixed roster of 2–4 mutually approved friends. Parents must separately opt in before invitations can disclose roster nicknames to the proposed students and their parents. Every student accepts and every parent approves that full roster before selected problems or discussions become visible. Members cannot be added later; create a new group for a different roster. Each text contribution waits for its author’s parent to review it before other members and their parents can read it. Answers voluntarily included in approved discussion are visible to the group. Private answers and feedback remain visible only to the learner and their own parent. Earlier social consent versions do not authorize this expanded use; the updated signed form must be verified first.

Every outgoing text message waits for its sender’s parent to approve or reject it. Both parents can read the approved conversation; the site operator reads reported messages and their reasons. Do not include contact details, outside links, photos or files. Basic automated restrictions supplement parent review and do not guarantee that harmful content will be detected. Report concerns and block contact from the conversation. The operator can remove reported messages or pause all messaging.

Unsigned drafts expire after 7 days. Signed images, messages, reports and moderation logs expire within 30 days. Groups, selected tasks, submissions and discussions also expire within 30 days; expired records are inaccessible and removed by successful maintenance. Permission and block status remain as needed to enforce parent choices. Withdrawal, leaving or blocking immediately stops access to affected groups; discussions and invitations are removed. Report copies and review logs may remain until their 30-day expiry. Independent learning, homework and parent reports remain available. Deleting a learner removes their social records; another family's report may remain until expiry. Orphaned signed images immediately become inaccessible and are removed during maintenance.

Parents can review permissions and conversations, download their learner’s own messages in the family export, and withdraw social permission in the family workspace. Signed evidence is available privately until expiry. These short-lived social records are excluded from the application’s long-term learning recovery packages; after recovery, separate authorization and friendships must be established again. Hosting-provider backups have their own policies. Social use is optional and has no effect on learning rewards.