Privacy Policy

1. Who We Are

Multiply.Cards ("we", "our", or "us") is operated by Fresh Online Pte Ltd, a company registered in Singapore. We provide educational card-based learning games to help students improve their mathematical skills.

We are committed to protecting the privacy of our users, especially children. This Privacy Policy explains how we collect, use, and safeguard information when you use our website and applications.

2. How Our Platform Works

Understanding how Multiply.Cards works is important for understanding what data we collect. Our platform has three types of users, each with different data requirements:

• Students sign in using a simple share code (e.g., sage.2026) provided by their teacher or parent. No account creation, no email, and no password is required.
• Teachers create an account to set up classes, generate student share codes, and view learning progress reports.
• Parents (Multiply@Home) create an account to manage their child's learning at home.

3. Information We Collect

3.1 Student Data

When a student uses Multiply.Cards, we collect only:

• Share code: A teacher-assigned code used to sign in (e.g., sage.2026)
• Nickname or label: A first name or nickname assigned by the teacher (e.g., "Mike") — no full names are required
• Learning performance data: Game accuracy scores, which times tables were practiced, game modes played, and session duration
• Device identifier: A short code derived from general characteristics of the browser (screen size, timezone, language, browser version and processor count). It lets a student reconnect to their share code on the same device without typing it again, and it lets us detect a code being used on an unexpected device. It is stored both in the browser and on our servers, against the student's share code. It contains no name, no account details, and cannot be used to track a student across other websites.

We do NOT collect the following from students:

• Email addresses
• Dates of birth or age
• Full names or surnames
• Home addresses
• Parent or guardian contact information
• Photos, videos, or location data
• IP addresses (beyond standard web server logs)

3.2 Teacher Data

When a teacher creates an account, we collect:

• Email address and name: Provided via sign-in with Google, Microsoft, or Apple (using OAuth 2.0)
• Organisation name: Optional, provided by the teacher
• License and subscription details: Plan type and activation status

3.3 Parent Data (Multiply@Home)

When a parent creates an account, we collect:

• Email address and name: Provided via sign-in with Google, Microsoft, or Apple (same OAuth scope as teachers)
• License details: Purchase and activation status
• Your child's first name: Typed in by you when you set up a child, so that you can tell your children apart on the progress dashboard. A nickname or initial works just as well — it is only a label. We do not ask for your child's surname, age, date of birth, school or any contact details. You can change or delete it at any time from your parent dashboard.

3.4 Automatically Collected Information

For all users, our web servers may automatically log:

• Device information: Browser type, operating system, and device type
• Session data: Session duration and features used within the app

Learning analytics — the progress data behind teacher and parent reports — are stored only in our own database. They are never sent to an advertising or analytics company.

Website analytics. On our public marketing pages (such as our home page, pricing, and information pages for teachers and parents) we use Google Analytics and the Meta (Facebook) pixel to understand how people find us and to measure advertising. These measure visits to marketing pages; they are not connected to any pupil's learning record.

They do not run on the pages children use. The sign-in page, the games and the practice apps (/playnow/, /auth/, /match-icons/, /mtc/, /parents/ and /voices/) carry no third-party analytics or advertising code of any kind.

4. How We Use Your Information

• Deliver educational games and track learning progress
• Generate progress reports for teachers and parents
• Allow students to reconnect to their share code on the same device (via local browser storage)
• Process teacher and parent subscriptions and payments
• Improve our educational content and game design using anonymised, aggregated learning data
• Provide technical support
• Ensure platform security and prevent abuse

5. Children's Privacy

Our approach: Multiply.Cards is designed so that students never need to provide personal information. Students sign in with a share code — there is no account creation, no email required, and no password to manage.

5.1 How We Protect Children

• Children never type personal information into Multiply.Cards — they enter a share code and play. The only identifying detail we hold is the first name or nickname their teacher or parent chose for them
• Student share codes are generated and managed by teachers or parents
• No behavioural advertising or ad targeting of any kind, and no advertising or analytics code on any page a child uses
• Nothing a child does is sent to an AI provider. Where teachers use our AI assistant, pupil names and codes are replaced with random tokens before the request leaves our servers
• No social features, messaging, or communication between users
• Teachers and parents can delete student data at any time

5.2 COPPA Compliance (US)

Children do not create accounts and cannot type personal details into the platform. The limited information held about a pupil — a share code, a first name or nickname, and their progress — is entered and controlled by the responsible adult, so verifiable parental consent is addressed by design through teacher or parent oversight built into the share code system.

5.3 School Use

When used in schools, teachers act as the responsible party for their students' data. Teachers control the creation and deletion of student share codes and can remove student data at any time.

6. Legal Basis for Processing (GDPR)

We process personal data based on:

• Contract Performance: To provide the educational services you have subscribed to
• Legitimate Interests: To improve our platform, ensure security, and conduct educational research using anonymised data
• Consent: For optional communications (you can withdraw consent at any time)
• Legal Obligation: To comply with applicable laws

7. Data Sharing

7.1 We Do Not Sell Personal Information

We never sell, rent, or trade personal information to third parties for marketing or any other purpose.

7.2 Who Can See Student Data

• Teachers can view learning progress for their own students only
• Parents (Multiply@Home) can view their own child's progress only
• Student data is never shared with other students, other schools, or third parties

7.3 Service Providers

We use the following third-party services to operate our platform:

All service providers are contractually required to protect your information and process it only as instructed, and we hold Data Processing Agreements with the processors that handle personal data on our behalf.

8. Data Storage and International Transfers

Our database is hosted on Google Cloud (Firebase Firestore) in the nam5 multi-region (United States). Google Cloud infrastructure is:

• ISO 27001 certified
• SOC 1, SOC 2, and SOC 3 audited
• GDPR compliant

International Transfer Safeguards

For users in the UK and EU, international data transfers to the United States are protected by:

1. Standard Contractual Clauses (SCCs) approved by the European Commission and UK Information Commissioner's Office (ICO-approved Article 46 mechanism under UK GDPR)
2. UK Extension to the EU-U.S. Data Privacy Framework — Google Cloud is certified under this framework, providing additional adequacy-level protections for UK data transfers
3. Technical safeguards:
   • All data encrypted at rest using AES-256 encryption
   • All data encrypted in transit using TLS 1.3
   • Regular third-party security audits
   • Google Cloud ISO 27001 and SOC 2 Type II certifications

Our website content is served via a global Content Delivery Network (CDN), meaning static assets are delivered from the server closest to each user.

9. Data Security

We implement industry-standard security measures to protect your data:

• All data encrypted in transit using HTTPS / TLS 1.3
• All data encrypted at rest using AES-256 on Google Cloud infrastructure
• Secure authentication via OAuth 2.0 (Google, Microsoft, Apple) and Auth0
• Firebase Security Rules enforce role-based access controls at the database level
• Multi-factor authentication (MFA) is handled by your sign-in provider. Because we do not hold passwords, whatever MFA your school has enabled on its Google, Microsoft or Apple account applies to Multiply.Cards automatically. We cannot weaken it, and we do not add a second, separate one
• Automatic session timeout after 30 minutes of inactivity
• Account lockout after multiple failed login attempts
• No payment card data stored on our servers (handled by Paddle)
• Regular security monitoring and updates
• Staff access limited on a need-to-know basis
• Audit logging of data access and modifications

While no system is 100% secure, we continuously monitor and update our security practices to protect your information.

10. Data Retention

• Active accounts: Data retained while the account remains active
• Deleted accounts: Personal data soft-deleted immediately upon request, then permanently deleted within 30 days. Backup data is automatically purged within 90 days of deletion.
• Student data: Deleted when the student's share code is removed by the teacher or parent, or when the teacher/parent account is deleted
• Anonymised data: Aggregated, anonymised learning data may be retained indefinitely to improve our educational content

11. Local Storage

Multiply.Cards uses browser local storage (not tracking cookies) to:

• Remember your sign-in session
• Store your preferences and settings (e.g., sound on/off, language)
• Allow students to reconnect to their share code on the same device (device identifier stored locally only)

On the pages children use — the sign-in page, the games and the practice apps — we set no advertising or tracking cookies at all. Only essential storage is used, for the purposes listed above.

On our public marketing pages, Google Analytics and the Meta (Facebook) pixel set analytics and advertising cookies (for example _ga and _fbp). These are not essential, and you can block or delete them in your browser settings. Essential cookies may also be set by our hosting providers for basic site functionality and security.

12. Your Rights

Under GDPR, UK GDPR, and similar laws, you have the right to:

• Access: Request a copy of your personal data
• Rectification: Correct inaccurate data
• Erasure: Request deletion of your data
• Portability: Receive your data in a portable format
• Restriction: Limit how we use your data
• Objection: Object to certain processing activities
• Withdraw Consent: Withdraw previously given consent at any time

How to Exercise Your Rights

For Teachers and Parents:

• Access & Modify: View and update your name and email address in your account dashboard at any time
• Export Data: Download your account data and anonymous student performance data in JSON format from your account settings
• Delete Account: Request account deletion via your account settings or by contacting privacy@freshonline.sg
• Delete Student Groups: Teachers can delete individual student groups and all associated anonymous performance data directly from their dashboard

For All Users:

To exercise any of these rights, contact us at privacy@freshonline.sg. We will respond within 30 days.

UK and EU residents: You also have the right to lodge a complaint with your local data protection authority:

• UK: Information Commissioner's Office (ICO) — https://ico.org.uk/
• EU: Your local data protection authority — https://edpb.europa.eu/about-edpb/about-edpb/members_en

13. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or service features. We will notify account holders of significant changes by email. The "Last Updated" date at the top indicates when the policy was last revised.

Continued use of the Service after changes constitutes acceptance of the updated Privacy Policy.

14. Contact Us

For privacy-related inquiries, data requests, or questions about this policy: