Privacy Policy

Last updated: 17 August 2026

1. Who is responsible for your information

NumDojo is operated by Velislav Tihomirov Tsvetanov, a sole trader trading as NumDojo, 58 Beechley Road, Wrexham, LL13 7BA, United Kingdom. For direct family, adult, and public use, the operator is generally the controller. For school-directed learner accounts, a school may be the controller and NumDojo may be its processor for the school's educational instructions. The exact role depends on the activity and written agreement.

Privacy questions and rights requests can be sent to support@numdojo.com.

2. Information we use

  • Account: email for self-registered adults and teens, username, optional name, password hash, age group, verification state, and security settings.
  • Managed learners: username supplied or generated by the authorised adult, or a school identifier; configured display name; optional first and last name; age group; account origin; and authorised family, school, class, and teacher relationships. A personal child email and full date of birth are not required.
  • Learning: lessons, answers, accuracy, timing, progress, review schedules, assignments, XP, badges, battles, tournaments, and teacher-authorised educational notes where supported.
  • Subscriptions: plan, status, billing interval, transaction references, and limited billing records. Stripe receives payment details; NumDojo does not store full card numbers.
  • Technical and safety: IP address, browser and device details, sign-in and security logs, audit records, abuse reports, blocks, and content needed to investigate a report.
  • Preferences: cookie choice, accessibility settings, notifications, family controls, and optional communication choices.
  • Acquisition source: a controlled label for the NumDojo page or campaign that led to registration. It does not contain a search query or full referring URL.
  • Contact enquiries: the message is delivered to support by email. The product database records only a PII-free delivery aggregate, not the enquiry text or contact details.
  • Speed-test feedback: when you choose to send feedback after the public mental maths test, we store only controlled choices about whether the result felt right, the practice goal, the result band, and the page source. We do not store the test answers, name, email, free text, or raw campaign parameters with that response.

3. Why we use it and our legal bases

  • Contract: to provide an account, learning service, subscription, and requested support.
  • Consent: for separately selected Google Analytics, OpenAI Ads measurement, marketing, and optional notifications where consent is required.
  • Legitimate interests: to secure the service, prevent fraud and cheating, operate limited product measurement, and improve the service, after balancing those interests against user rights.
  • Legal obligation: for tax, accounting, safeguarding, consumer, and regulatory duties.
  • School instructions: where NumDojo acts as a processor, the school determines the lawful basis and NumDojo processes learner data under the written terms and documented instructions.

We do not use learner data for behavioural advertising or sell personal information.

4. Children and age-appropriate defaults

Children under 13 cannot self-register. A parent, guardian, or authorised school may contact NumDojo to ask whether an approved managed route can be offered, but contacting us does not create an account or confirm availability. If NumDojo provisions an approved managed profile, Google Analytics and OpenAI Ads measurement stay disabled, free-text messaging stays unavailable, and paid subscriptions require an adult account. Competition views use the profile's configured display name or Learner when none is set, so an authorised adult or school should choose a nickname that is not the child's real or full name. Read the Children's Privacy Notice for details.

5. Providers and disclosures

We disclose only what is needed to operate the service to these provider categories:

  • Hostinger: server hosting and transactional email infrastructure.
  • Stripe: checkout, subscriptions, receipts, fraud controls, and billing portal.
  • Google Analytics: optional site analytics only after it is separately selected and the user signs in to an account recorded as adult. It remains disabled for signed-out visitors and signed-in minors.
  • OpenAI Ads measurement: optional conversion measurement, if enabled for an approved campaign, only after it is separately selected and the user signs in to an account recorded as adult. We send hashed matching data and limited browser context, not raw email addresses, and opt events out of future user-level personalisation. OpenAI's current measurement documentation does not state the duration of its attribution cookies, so this measurement remains disabled pending retention review.
  • Google, Facebook, and GitHub: only when an eligible user chooses that sign-in provider.
  • Browser push services: only after a user opts into a supported reminder on their device.

We may also disclose information where law requires it, to respond to a valid legal request, or to protect a person from serious harm.

6. International transfers

Some providers may process information outside the United Kingdom. Where UK data protection law requires a transfer safeguard, the applicable mechanism may be an adequacy regulation, the UK International Data Transfer Agreement or Addendum, or another lawful mechanism. Provider destinations, contracts, and transfer assessments remain part of NumDojo's formal legal review programme.

You can ask whether your information is transferred outside the United Kingdom, which safeguard applies, and request available details or a copy of that safeguard. Email support@numdojo.com or use the support contact form.

7. Retention

Active account and learning records are kept while the account is used and the information is needed to provide requested features. When an account is deleted, NumDojo anonymises the core user record so required database references remain valid and removes linked authentication, notification, leaderboard, and profile data where supported.

Retention for billing, audit, security, and support records depends on why the record is still needed. The criteria include applicable tax and accounting duties, safeguarding or regulatory duties, an active security or fraud investigation, a live dispute or rights request, and the establishment, exercise, or defence of legal claims. Information should be deleted or anonymised when it is no longer needed for its stated purpose and no other applicable duty requires it.

Legacy under-13 accounts that were created by a child and do not have verified parent consent cannot sign in or use learning features. We preserve existing learning history while an authorised adult or school relationship, rights request, or erasure request is verified. Abandoned records with no sign-in or learning activity will be handled under a documented retention procedure once it is approved; no fixed deletion schedule is currently claimed.

A full category-by-category retention schedule is under formal review. We will not claim a fixed deletion period for a category until the product or operating procedure enforces it.

8. Your choices and rights

Depending on the law that applies, you may ask for access, correction, deletion, restriction, portability, or objection, and may withdraw consent. A parent or guardian can make requests for an authorised linked learner. For school-controlled data, NumDojo may refer the request to the school.

Withdraw optional measurement consent

Open , switch Google Analytics or OpenAI Ads measurement off, then save your preferences. This stops future optional measurement for that choice. NumDojo also tries to remove the related first-party measurement cookies from this browser. Withdrawing consent does not affect processing already carried out lawfully before that change. OpenAI Ads measurement remains disabled while its attribution-cookie duration and related retention handling are unverified.

Object to processing based on legitimate interests

Tell us which use of your information you object to and why, including any reasons connected with your situation. We will consider the objection and stop that processing unless there are compelling legitimate grounds that override your interests, rights, and freedoms, or the processing is needed for legal claims. An objection to direct marketing is different: we must stop using your information for that purpose.

Access, export, and other requests

Signed-in users can use Account Settings to export available account data or request account deletion. For a full access request, correction, restriction, objection, transfer-safeguard information, or another privacy request, email support@numdojo.com or use the support contact form. We may need proportionate information to verify identity and authority.

UK users can also complain to the Information Commissioner's Office at ico.org.uk.

9. Security and automated decisions

NumDojo uses password hashing, short-lived access tokens, session revocation, role and tenant checks, audit records, rate limiting, and encrypted HTTPS transport. No online service can promise absolute security. Learning recommendations, rankings, and anti-abuse signals do not make decisions that produce legal or similarly significant effects without human involvement.

10. Changes

We will update the date and provide an appropriate notice before a material change takes effect. The Legal and Safety Centre links the current notices and reporting routes.