Privacy Policy — Mathéquête

Application: Mathéquête
Android identifier: com.coresrdi.mathequete
Website: mathequete.pages.dev
Publisher: Jeff Gravel (Quebec, Canada)
Brand: CORES RDI / coresrdi
Effective date: May 15, 2026
Last updated: May 15, 2026
Previous version: May 12, 2026

1. Who we are

Mathéquête is developed by Jeff Gravel, an independent developer based in Quebec, Canada, under the CORES RDI (coresrdi) brand. This document describes the privacy practices applicable to the Mathéquête mobile application distributed on the Google Play Store under the identifier com.coresrdi.mathequete, to the Windows/Apple version, and to the website mathequete.pages.dev.

2. Target audience — children's application

Mathéquête is designed specifically for children aged 4 to 12. We strictly comply with:

• the Children's Online Privacy Protection Act (COPPA) (United States);
• the General Data Protection Regulation (GDPR) (European Union), including special provisions for minors (GDPR-K);
• Quebec's Law 25 (Act respecting the protection of personal information in the private sector);
• Google Play's Families Policy.

As a result: no targeted advertising, no advertising identifier, no behavioral analytics, no sharing with third parties for marketing purposes.

3. Data the application collects

3.1 100% local data by default

Mathéquête runs entirely locally on the device by default. Data generated by gameplay (child profiles, progression, scores, character choices, gameplay statistics) is stored in the device's internal memory. It only leaves the device in the specific opt-in cases described in §3.4 below.

3.2 Data stored locally

The application records on the device:

• child profiles created by the parent (first name only, optional);
• game progression (completed levels, captured enemies, rewards);
• preferences (language, sound, character choice, skins);
• optional school identifier (teacher name + classroom number, entered by the parent in the child's profile — see §3.4);
• purchase status and license code (verified offline using an HMAC-SHA256 cryptographic signature).

This data is encrypted locally using AES-256-CBC with HMAC-SHA256 authentication. It can be erased at any time from the "Manage Profiles" screen of the game, or by uninstalling the app.

3.3 No advertising identifier

Mathéquête does not use the Android advertising identifier (AAID / com.google.android.gms.permission.AD_ID) and does not read any persistent hardware identifier (IMEI, MAC, etc.).

3.4 Data sent over the Internet — strictly opt-in

The Internet is used by Mathéquête in three specific situations, each tied to a voluntary action by the parent, the teacher, or the student:

A) License activation (one time only, when you enter your code)

When you activate a license code purchased online, the application sends to the Mathéquête server (mathequete-api.coresrdi.workers.dev, hosted at Cloudflare):

• the license code (e.g. MQ-CONT-X7K9-RP2M-8VHD-3NQF);
• an anonymous device identifier (SHA-256 hash of a local, non-personal identifier — not the IMEI, not the phone number);
• the operating system (Windows, Android, or Apple);
• a UTC timestamp.

The server responds OK/refused and records the activation to limit the number of active devices per code (1 for an individual license or a Pack 5 code, N for a school license). You can release a device at any time from the Settings → License menu of the game, which removes the server-side record and allows reactivation on another device.

B) Periodic license verification (transparent, offline after activation)

Once activated, the license is verified offline via HMAC signature with no network call. The application contacts the server only at infrequent intervals (typically a few times per month) to:

• detect whether the license has been released from another device (transfer case);
• receive bonus island catalog updates announced by CORES RDI.

No personal data is sent during these checks, only the license code and the anonymous device identifier.

C) Teacher synchronization (fully opt-in, the parent or teacher chooses the mode)

This synchronization is disabled by default. It activates only if:

1. the parent enters a teacher name and a classroom number in the child's profile (section "School identifier"), and
2. the user chooses one of the following three synchronization modes:
   • Mode 1 — Automatic: once each time the game is opened, in the background;
   • Mode 2 — On request: a window asks for permission each time the game opens;
   • Mode 3 — Manual: no automatic synchronization, the parent or student presses a "🔄" button to trigger the send.

When a teacher synchronization is triggered, the application sends to the server:

• a global student identifier = first name + last name initial + birth year (entered by the parent, never the full name or full date);
• the teacher name and classroom number entered by the parent;
• aggregated progression statistics: number of trials completed per island, success rate per math operation (addition, subtraction, etc.), average response time, detected weak points;
• no screenshots, no voice recordings, no GPS location, no information about other apps on the device.

The teacher can view these aggregated statistics in their dashboard (Mathéquête Teacher application) to adapt their lessons. The parent can disable synchronization at any time (switch to Manual Mode 3 or remove the teacher name), which erases the school identifier on the device and stops the sends.

4. Android permissions requested

4.1 CAMERA permission (android.permission.CAMERA)

The camera permission is requested at the moment the child activates the QR scan feature (and not at application startup). It can be denied or revoked at any time from the Android settings, without preventing the rest of the game from functioning.

4.2 INTERNET ACCESS permission (android.permission.INTERNET)

The application requests Internet permission for four strictly limited uses:

1. Google Play Billing purchase validation (Android in-app purchases);
2. License activation with the Mathéquête server at Cloudflare (see §3.4-A);
3. Periodic license verification + catalog updates (see §3.4-B);
4. Teacher synchronization — opt-in only (see §3.4-C).

No other network communication is performed by Mathéquête. If you block Internet access to the app in Android settings, the game remains fully functional after a first activation — only teacher synchronizations and catalog updates are disabled.

5. Purchases — Stripe and Google Play Billing

Mathéquête offers two purchase channels depending on your platform:

5.1 Purchases on the website mathequete.pages.dev (PC, or Android via browser)

Payments are processed by Stripe Inc. (United States). When you purchase:

• you enter your payment information directly on the Stripe Checkout site — Mathéquête / CORES RDI never sees your credit card number;
• Stripe only forwards us your email address (to send the license code) and your name (optional, for the receipt);
• Quebec taxes (GST 5%, QST 9.975%) are calculated and collected automatically by Stripe Tax.

Stripe privacy policy: stripe.com/privacy.

Once payment is confirmed, your license code is sent by email via Resend (transactional email service based in the United States). Policy: resend.com/legal/privacy-policy.

5.2 Android in-app purchases (Google Play Billing)

For purchases made from the Android application:

• transactions are managed exclusively by Google Play Billing;
• we never see payment information;
• in accordance with the Play Families policy, any purchase must be authorized by a parent via Google Play parental controls.

6. Sharing with third parties

We do not sell, rent, or share any user data for marketing purposes. The third parties technically involved in the operation of Mathéquête are:

No third-party analytics SDK (Google Analytics, Firebase Analytics, Facebook SDK, Unity Ads, AdMob, etc.) is integrated into the application.

7. Security

Data stored locally on the device is encrypted (AES-256-CBC + HMAC-SHA256). All network communication performed by the application is protected by TLS / HTTPS. License codes are cryptographically signed (HMAC-SHA256 with a 256-bit secret key held only by CORES RDI), which allows their offline verification without a network call.

The Cloudflare Workers activation server is hosted on Cloudflare's infrastructure, certified ISO 27001 / SOC 2. The D1 database is geographically replicated and encrypted at rest.

8. User and parent rights

In accordance with GDPR, Quebec's Law 25, and COPPA, you (and the parent/legal guardian of a child user) have the following rights:

• Right of access: all in-game data is visible in the "Manage Profiles" screen. To obtain a copy of data stored server-side (license activations, synchronized teacher statistics), write to coresrdi@gmail.com.
• Right of rectification: profiles, first names, school identifiers, and preferences can be modified at any time in the game.
• Right of erasure: delete a profile in "Manage Profiles", uninstall the application, or send a written request to coresrdi@gmail.com to erase server-side statistics.
• Right to portability: on request, we export your data in machine format (JSON or CSV).
• Right to object: teacher synchronization is opt-in and can be disabled at any time. No data is ever used for advertising profiling.
• Right to withdraw consent: for teacher synchronization, select "Mode 3 — Manual" and stop triggering the send manually, or remove the teacher name in the child's profile.

To exercise these rights or ask any privacy-related question:

9. Data retention

Locally (on the device): as long as the application is installed. Automatic erasure upon uninstallation or profile deletion.

Server-side at Cloudflare:

• License activations: kept as long as the license is valid (lifetime for individual/Pack 5, 12 months for school licenses).
• Synchronized teacher statistics: kept for 1 school year (10 months) then automatically archived and anonymized.
• Stripe purchase data (invoices): kept for 7 years in accordance with Revenu Québec / CRA accounting obligations.
• Emails sent via Resend: kept 30 days for audit, then erased.

10. International transfers

Mathéquête uses services hosted outside Canada for some functions:

• Cloudflare operates a global network of datacenters. Mathéquête server data may transit through or be processed in datacenters located in the United States, Europe, or elsewhere. Cloudflare adheres to the EU Standard Contractual Clauses (SCC) and the EU-US Data Privacy Framework for transfers outside the EU.
• Stripe processes payments in the United States. Stripe adheres to the same legal frameworks (SCC, DPF).
• Resend sends emails from the United States.

In accordance with GDPR article 46 and Quebec's Law 25, these transfers rely on contractual guarantees (Standard Contractual Clauses) that impose a level of protection equivalent to European / Quebec law.

11. Modifications to this policy

Any substantial change (for example the addition of a new category of collected data) will be signaled by:

• an update of the "Last updated" date at the top of the document;
• an email to the address associated with your Stripe license, if applicable;
• an announcement on the website mathequete.pages.dev.

The complete history of modifications is public on our GitHub repository coresrdi/mathequete-privacy.

12. Applicable law

This policy is governed by the laws of the Province of Quebec, Canada. Any dispute relating to this policy will be subject to the jurisdiction of the competent courts of Quebec.