Privacy & your data

An adult account is required for family records. Each learner belongs to one household, and every learner, edition, answer key, photograph, upload status, correction, and deletion action is checked against the signed-in adult’s current household membership. Learners do not need an email address. The adult may use a nickname or family-chosen label instead of a learner’s legal name.

Passwords are stored as salted password hashes. Browser and iPhone session tokens are random; only hashes of those tokens are stored. This pilot has no public registration. Do not share an adult password with a learner.

The hosted pilot stores authorized family records in its private server data folder. Records include the learner profile, editions and separate answer keys, upload job status, grading readings, corrections, page check-ins, skill progress, pacing history, and limited operation metadata needed to prevent duplicate work.

Before a photograph is stored or sent for feedback, the server corrects its orientation, resizes it to a bounded size, converts it to an RGB JPEG, and omits EXIF, location, comments, and other source metadata. The original upload bytes are not retained in application storage. After a page is read, its normalized photograph is removed as soon as its durable learning record no longer needs the image. A page that is paused, fails before a usable reading, or needs an adult check remains available only until it is resolved or reaches the 72-hour active-storage limit. Accepted math readings and progress remain until the adult deletes the learner.

A photographed page can still contain names or other details written on the paper. Keep the camera frame focused on the math and avoid unrelated personal information.

Normalized captures use the same private mounted volume as the active database and PDFs so a queued or explicitly paused submission can survive a machine restart. Reviewed copies are removed under the rule above, and every remaining active copy is removed within 72 hours by the application’s maintenance sweep. An encrypted daily volume snapshot can retain blocks from a capture that has expired or been deleted for up to one additional day before that snapshot expires. The pilot does not promise a user-facing backup or restore service, and a recovery will not be used to restore a learner after that learner has been deleted.

The pilot is currently in capture-only mode. An authenticated photograph can be stored for the camera test, but it is not sent to a model provider. Saved pages are never dispatched merely because the service restarts or its configuration changes. Review also remains paused until the provider account’s retention and training controls have been checked and explicitly approved for learner work. After the private United States processing connection is verified and enabled, requests will use the configured United States path and will not silently fall back to a global endpoint or another provider. An authenticated adult can then explicitly finish that saved submission to request review, provided its normalized captures have not reached the 72-hour deletion limit. If a saved copy is unavailable, photograph the original paper again.

Deleting a learner here cannot override information a provider is independently required to retain.

1. The household owner starts deletion from the learner’s data page. New grading, planning, and pacing changes pause immediately.
2. The owner can cancel for three days or choose immediate permanent deletion.
3. After the deadline, the server removes the profile, normalized photographs, editions, findings, revisions, check-ins, mastery, pacing records, consent record, and upload job records during its next maintenance sweep.

A deletion audit keeps a new random audit reference, time, and record counts without worksheet content. The reference is created during deletion and is not derived from the learner label or internal learner ID. The hosted database/PDF recovery snapshots can retain blocks written before active-store deletion, including normalized photographs, for up to one additional day before expiry. A recovery will not be used to resurrect a deleted learner. Printed pages and copies downloaded or backed up outside Longhand Math remain outside the pilot’s control.

The website serves its fonts from the application itself. If an adult enables iPhone notifications, the server sends Expo the device notification token and generic status copy such as “The next paper is ready”; it does not put a learner label, photograph, answer, or math reading in that push message. This pilot contains no advertising or behavioral analytics integration. Infrastructure logs may record ordinary request metadata. Routine application messages omit learner labels, photograph content, credentials, prompts, and provider error bodies. Unexpected framework or filesystem errors may include opaque random internal record IDs; access to those operational logs is limited to the pilot operator.