# Privacy Policy · Fablematics

Source: https://fablematics.com/privacy/

CLEAR WORDS. NO MYSTERY.

# Privacy Policy

Your family’s information deserves clear explanations. Here is what Fablematics handles, why, and how a parent can ask for help.

Last updated October 16, 2026

The short version: No advertising, no sale of learner data, and no open-ended AI chat in this experience. The homepage clue runs in your browser without an account. Parents control accounts, subscriptions, and privacy requests.

## 1. Who this policy covers

Taoftware LLC operates Fablematics. This policy covers the marketing website, its interactive clue preview, and the app features described below when available. App releases and paid subscriptions may be marked “coming soon”; a description of a future feature does not mean that feature is currently collecting information. Links to store or payment-provider pages are also subject to those providers’ notices.

## 2. This website and its preview clue

The marketing website does not offer learner registration, a newsletter form, or a payment form. We do not add advertising pixels, third-party analytics, session replay, or third-party font requests to these pages. We do not use website cookies for advertising or cross-site tracking.

The playable clue and pricing selector run locally in your browser. Their selections are kept in page memory, are not sent to us, and disappear when the page is reloaded or closed. Choosing an answer does not create a learner record or account.

Cloudflare delivers the website and handles technical information needed to serve and protect it, such as an IP address, requested URL, time, browser information, and security signals. Cloudflare may process network and security logs under its applicable service terms. We do not receive the contents of your other browsing activity.

If a parent emails support, we receive the sender’s email address, the message, and any attachments they choose to provide. We use that information to respond and resolve the request. Please avoid including a child’s full name, school, location, identity documents, or unrelated sensitive information.

## 3. Information used by the app

Device-only learning. The app can store learner nicknames, grade or pathway choices, accessibility preferences, answers and attempts, clue completion, progress, and help usage in local device or browser storage. Clearing that storage may erase device-only progress. A nickname need not be a real name.

Dictionary and read aloud. Dictionary searches run locally and are not sent to us or a dictionary provider. Native apps bundle the dictionary; the web downloads one shared dictionary file and may cache it in browser storage for later use. Read aloud uses English voices reported as local by the device or browser. We do not send spoken text to a speech service or request microphone access. Voice, speed, automatic scrolling and introduction completion are remembered locally. Clearing app or browser storage removes these preferences and any cached web dictionary. The operating system manages voice installation separately.

Parent accounts. The account service handles a parent’s email, a stable account identifier, and sign-in session information. Membership can work across devices. Optional family sync, after separate parent permission, synchronizes learner nicknames, identifiers, grade, preferred story and completed discoveries. Progress records include clue and chapter identifiers, completion time, attempt count, help use and earned evidence; they do not contain the selected answers. Reading preferences and unfinished clues remain local. Signing in or buying membership alone does not enable learner uploads.

Subscriptions. Where checkout is available, the billing provider handles payment details and purchase records. RevenueCat associates subscription status, product and transaction identifiers, renewal dates, and access rights with the parent-account identifier. We use verified status to unlock the purchased content and help resolve billing problems. Full card numbers are processed by the payment provider, not stored by this marketing website.

Optional celebration exports. In app versions that offer Share a discovery, a parent or guardian can choose to create a short video or still image after a completed chapter. The file contains authored chapter artwork, its title, and abstract shapes inspired by the subject. It does not include quiz questions, answers, learner names, account identifiers, or detailed learning records. The file is created on the device and is not uploaded to us. After previewing it, the parent separately chooses whether to save it or send it to another app through the system share menu. Nothing posts automatically. The chosen service controls any later posting, audience, and retention under its own terms and privacy policy. Saving to Photos on iOS may request permission to add the selected file; Fablematics does not request permission to read the photo library for this feature.

We do not require a child’s email address, exact birth date, school, home address, contacts, precise location, photo, or voice to solve the authored clues. We do not sell learner information, use it for targeted advertising, or run third-party session replay in this experience.

## 4. Children and parent choice

Fablematics is designed for Grades 6–8 and may be used by children under 13. Parents or guardians handle commercial and account actions. This public website’s preview does not solicit child contact information or upload the child’s answers.

Guests can explore without an account, with learning saved on the device. In app build 10 and later, an adult parent or legal guardian can open Settings → Privacy & data, read the family-sync notice, and explicitly choose whether to permit this collection and use. We email the full notice and a separate eight-digit consent code to the confirmed parent account address. Entering that code records the choice and schedules another confirmation notice for the following day, including how to withdraw permission or report an unauthorized request. Sign-in codes and consent codes serve separate purposes.

The service checks current permission before accepting learner uploads. Earlier beta accounts do not inherit permission; older apps must be updated or the parent can use the current web app to complete this step. The record includes the notice version, verification method, grant and withdrawal times, and confirmation-email reference. Refusing or withdrawing permission leaves local learning and membership available. We use synchronized learner information only for family learning and restoration, and our processors act on our behalf, without independent advertising or other use. We do not condition participation on providing more information than is reasonably necessary for the activity.

Parents may ask what child information is held, review or correct it, refuse further covered collection or use, and request deletion. Use Withdraw sync permission in Privacy & data to stop future sync across devices. Existing cloud records, including earlier beta records, remain available for authenticated export and deletion. Withdrawing does not delete those records or cancel membership. Contact the operator listed below. If you believe a child has sent us personal information without appropriate permission, tell us so we can investigate and address it.

The current authored clue and helper experience does not provide open-ended AI chat or send a learner’s answers to a third-party AI model. Any future feature that shares child information with an AI provider will need a separate, clear explanation and the permissions required for that feature before sharing begins.

## 5. Who helps operate Fablematics

Information is shared only as needed for a requested service, security, support, compliance with legal obligations, or another purpose explained to the parent with any required permission.

- Cloudflare: website hosting, content delivery, and network security.
- Supabase: parent authentication, account storage, privacy requests and membership and permission records, plus learner profiles and completed discoveries when family sync is authorized.
- Resend: delivery of parent sign-in and permission emails, including the recipient address, temporary code, privacy notice and delayed confirmation. Learner names and discoveries are not included in these emails.
- RevenueCat, when subscriptions are enabled: subscription status, billing management, and purchased-access verification using a parent-account identifier.
- Stripe, for web purchases: payment processing, payment-related fraud prevention, and transaction information.
- Apple, Google, or Samsung, when their store purchases are available: app distribution, payments, and store purchase records under their respective terms.
- Support email services: delivery and storage of messages voluntarily sent to us.

Opening a store or checkout link sends your browser to that service. We may also disclose relevant information when legally required or reasonably necessary to protect people, the service, or legal rights. We do not give these providers permission through this policy to use learner information for unrelated advertising.

## 6. Storage and retention

Native celebration exports are temporarily stored in a dedicated app cache. On the next export, matching cached exports older than 24 hours are removed; the operating system may clear its cache earlier. Copies a parent saves to Files, Photos, or another service remain there until removed through that destination. Clearing Fablematics does not remove those separately saved or shared copies.

Website preview selections exist only until the page is closed or reloaded. Local app progress remains on the device until it is cleared, replaced, or deleted. We cannot remotely recover or erase a device-only record that has not been uploaded.

We keep synchronized learner profiles and discoveries to save, restore, and display your family's learning across devices. They expire after 365 days without family-sync use, or 30 days after you withdraw sync permission, and are removed by the next daily cleanup. Opening the app with current sync permission renews the inactivity period; merely signing in, paying, or requesting an unconfirmed consent code does not. Removing a synchronized learner erases their progress and profile details immediately; a minimal record of the removed identifier prevents an offline device from restoring them until the same family retention deadline. Connected devices apply that removal on their next successful sync. On a verified deletion request, active account records and cloud learning records are removed from our application database, pending consent confirmation emails are canceled, and RevenueCat customer deletion is requested. After an inactivity or withdrawal cleanup, the old sync permission is invalid. New permission lets devices upload their remaining local copies again, so remove unwanted copies on each device before granting it.

Consent event history is kept for up to 365 days to handle permission questions and privacy requests. The current permission record remains while that permission is in use; expiry or account deletion removes it. Unconfirmed consent requests are removed within two days of their ten-minute code expiry. Parent accounts and current membership records remain available for account access and purchase management until account deletion; our raw billing-event history is limited to 365 days. These records do not contain learner profiles or discoveries. Support requests are used to resolve the inquiry and are removed within 90 days after closure; unnecessary child details are removed sooner.

Resend retains parent emails and delivery logs for 30 days, with backups for a further seven days. We do not put learner names, answers, or discoveries in those emails. Our current Supabase plan exposes one day of API/database logs; that console window is not a guarantee that all internal security logs have been erased. Supabase documents up to seven daily recovery backups for Free projects, which are not available for us to download. We do not enable application request logging, advertising pixels, or session replay on our Cloudflare website. Hosting providers may separately retain limited network and security records for service protection under their published terms.

Deletion removes active application data; it does not immediately overwrite every provider backup. Backups remain restricted to recovery, and we must reapply deletions before restoring service. Payment providers may keep their own transaction, fraud-prevention, tax, or legally required records. We do not retain learner records for those payment purposes. If a privacy request concerns a provider-held copy, contact us so we can coordinate the request.

## Parent feedback, pilot requests and campaign counts

On our parent information page, you may open an email draft to share parent feedback, request pilot coordination or ask for a one-time app availability update. Nothing is sent until you send the email yourself. We use the parent email and request only for the purpose you selected. A parent account, purchase, support request or pilot request does not subscribe you to an ongoing newsletter. Reply “stop” to end optional contact. Do not send a child’s identifying details or answers. We delete parent-feedback contact details within 90 days after the conversation ends, pilot contact details within 90 days after the pilot ends, and app-update requests within 30 days after the requested update, or when you withdraw. We retain a minimal email suppression record while we send marketing so that we do not contact you again by mistake.

Our parent page counts aggregate page views, demo video starts and clicks on its free-sample, App Store, plans and email links. The record contains only a UTC day, a fixed public campaign code, an action and a count. We do not store IP addresses, device or account identifiers, full URLs, referrers, emails or learner activity in these counts. No analytics cookies, browser storage, advertising pixels or cross-site tracking are used by this counter. Counts are not linked to purchases or families and are removed after 90 days. We honor browser Do Not Track and Global Privacy Control opt-outs for this counter. Hosting providers may process network data for delivery and security as described above. The learning app has no marketing counter.

App Store links may include a public campaign label, such as “organic-founder,” and our developer identifier so Apple can report aggregate campaign results. These labels identify a broad promotional source, not a person, family or device. We leave the website’s links untagged when Do Not Track or Global Privacy Control is enabled, and do not attach learner information. Apple handles App Store activity under its own privacy policy; its campaign reports use minimum reporting thresholds.

## 7. Access, correction, export, and deletion

A parent can delete an account or request an export in Settings → Privacy & data, using a fresh email code or by entering their current parent password. Our [account deletion page](https://fablematics.com/delete-account/) provides the same route from a browser without installing the app. A parent or guardian can also use our [support page](https://fablematics.com/support/) to request access to, correction of, export of, or deletion of family data, or to withdraw a permission. Tell us whether the request concerns a single learner or the whole family account. We may verify your authority before sharing or deleting account information. Please do not send a child’s identity documents in the initial request.

You can clear device-only app progress through the available local reset controls or your device/browser storage settings. Deleting app data or an account does not automatically cancel a paid subscription; use the original billing provider to stop renewals.

Depending on your location, you may have additional rights to object to or limit processing, withdraw consent, or raise a concern with a supervisory authority. Contact us to exercise applicable rights. We do not treat a privacy request as a reason to discriminate against a family. Blocking or deleting information needed for a specific feature may mean that feature can no longer operate.

Because this website does not perform cross-site advertising tracking or sell personal information, it does not change its behavior in response to a Do Not Track browser signal. We do not use Global Privacy Control signals as permission to collect more information.

## 8. Security and processing location

We use access controls and supported service-provider security features appropriate to the information being handled. No internet service or device is completely risk-free. Parents should protect their sign-in methods and avoid sharing an unlocked parent session with others.

Fablematics is operated from the United States. Our service providers may process information in the United States and other countries where they operate, with the safeguards required for the relevant service and applicable law. This website does not promise that all information remains within one country.

## 9. Changes to this policy

We will update the date above when this policy changes. For material changes involving family information, we will provide notice appropriate to the change and obtain additional parental permission where required before applying a new use. We will not treat a policy update as blanket permission for new child-data collection or advertising.

## 10. Contact the operator

Taoftware LLC handles Fablematics support and parent privacy inquiries.

Taoftware LLC
Fablematics support and privacy
[fablematics@taoftware.com](mailto:fablematics@taoftware.com)21520 Yorba Linda Boulevard
Ste G #3007
Yorba Linda, CA 92887
United States

+1 (310) 751-0519