Privacy Policies

Last updated: June 21, 2026

This Privacy Policy applies to schools, school districts, and institutions (collectively, "Institution") that purchase and deploy Modmath Enterprise through Apple School Manager, Managed Google Play, or a direct enterprise agreement with Modmath for Students, Inc. ("Modmath," "we," "us," or "our"). It describes how we collect, use, store, and protect information in connection with the Enterprise version of our application.

If you are an individual user who downloaded Modmath directly from the App Store or Google Play, please refer to our Direct-to-Consumer Privacy Policy.

1. Scope

This policy governs data collected from:

  • School and district administrators who manage licenses through the Modmath Admin Portal.
  • Teachers and other staff who are granted access to the Modmath Admin Portal within an Institution's license.
  • Students who use the Modmath application under a license managed by an Institution. Students do not have access to the Admin Portal.

In this context, the Institution acts as the data controller for its users. Modmath acts as a data processor, processing data solely on behalf of and under the instructions of the Institution, in accordance with any applicable Data Processing Agreement ("DPA").

2. Data Processing Agreement

Modmath offers a Data Processing Agreement to all Enterprise customers. The DPA governs the terms under which Modmath processes personal data on behalf of the Institution and forms part of the agreement between Modmath and the Institution. Institutions may request a DPA by contacting us at contact@modmath.com.

3. Information We Collect

The information we collect depends on the type of user.

Administrators. When an Institution sets up a Modmath Admin account, we collect the following information from the primary organization administrator: first name, last name, email address, name of the school or district, address of the school or district, and phone number. When an administrator creates an Admin account, we also derive and store limited account-identity metadata to secure the account and support administrator account recovery: the email domain of the creating administrator, a coarse classification of whether the account is an institution or an individual, and a billing contact name and email. This metadata is used only for account security, recovery, and billing. This information is used to establish the account, manage the license, and communicate about billing and support.

Staff. When an administrator adds other staff members to the Admin Portal, we collect their first name, last name, and email address. Staff members have access to the Admin Portal to manage student seats and other functions permitted by the administrator. We do not collect additional personal information from staff beyond these fields. We never store plaintext passwords. Where an additional staff admin signs in with a password it is stored only as a salted cryptographic hash, and staff admins who sign in through their school's identity provider (Google or Apple) have no password stored with us.

Students. Students access Modmath through the application and do not have access to the Admin Portal. How a student signs in depends on how the Institution deploys the application.

For institutions using a managed device program, Modmath is distributed as a web clip to Apple devices through a mobile device management platform such as Jamf, or as a URL through Google Admin for Chromebook and Android devices. Students on managed devices sign in using their institutional Google or Apple account via OAuth. In this case, we receive the student's managed email address from the identity provider at the time of sign in.

For institutions or students accessing Modmath directly at app.modmath.com without a managed device program, students sign in using their email address. In this case, we collect that email address to authenticate the user and associate them with the correct institutional license.

In all cases, the student email address is used solely for authentication and license association. We do not collect student names, dates of birth, grades, assessment results, or any other personal information beyond the email address used to sign in. We never store plaintext passwords. Where a student signs in with a password it is stored only as a salted cryptographic hash, and students who sign in through their school's identity provider (Google or Apple) have no password stored with us.

Anonymous usage analytics. We collect anonymized, aggregated usage data from the Modmath application to understand how the product is used and to improve its functionality and performance. This data cannot be used to identify individual users. It is never linked to email addresses or any other personal information, and is never used for advertising or marketing purposes.

4. How We Use Information

Personal information collected through the Admin Portal and application is used solely to:

  • Create and manage user accounts within the Modmath Admin Portal.
  • Authenticate students and associate them with the correct institutional license.
  • Send transactional communications related to license management, account access, and product updates.
  • Respond to support requests submitted by administrators or staff.

We do not use any personal information collected in the Enterprise context for advertising, third party marketing, or any purpose unrelated to the administration of the Enterprise license.

5. How We Share Information

Modmath does not sell personal information. We do not share personal information with third parties except in the following limited circumstances:

  • Service providers. We use a limited set of trusted providers, each bound by confidentiality and data-protection obligations and permitted to process personal information only to provide services to us. We do not sell personal information and do not permit providers to use it for their own advertising or marketing. These providers include:
    • Amazon Web Services (AWS) - hosting, storage, and transactional email (Amazon SES); data stored in the AWS US East region.
    • Stripe, Inc. - payment processing for Enterprise license purchases via the Admin Portal (billing contact name/email, billing address, phone, payment method; customer/subscription identifiers). No full card numbers stored.
    • MailerLite - handling inquiries from our Enterprise contact / distribution form (name, email, school or district).
    • Cloudflare, Inc. (Turnstile) - bot/abuse prevention on the Enterprise contact form (IP address and browser characteristics).
    • Apple and Google - single sign-on for administrators, staff, and students.
    • Mixpanel - anonymous, device-level product analytics in the Admin Portal only (not the student experience); not linked to a named individual.
  • Legal obligations. We may disclose information if required to do so by law or in response to a valid legal process, such as a court order or government request.
  • Business transfers. In the event of a merger, acquisition, or sale of assets, personal information may be transferred as part of that transaction. We will notify affected Institutions in advance of any such transfer.

Anonymous usage analytics may be shared with or processed by analytics service providers in aggregated, non-identifiable form.

6. FERPA Compliance

Modmath is committed to compliance with the Family Educational Rights and Privacy Act ("FERPA"). We do not collect education records as defined by FERPA beyond what is described in Section 3. To the extent that an Institution provides or makes accessible any education records in connection with the use of Modmath Enterprise, Modmath agrees to:

  • Use such records only for the purpose of providing the contracted services to the Institution.
  • Not disclose education records to any third party without the Institution's prior written consent, except as permitted by FERPA.
  • Return or destroy education records upon termination of the agreement, as directed by the Institution.

7. COPPA Compliance

The Children's Online Privacy Protection Act ("COPPA") applies to the online collection of personal information from children under 13. In the Enterprise context, the only personal information we collect from students is the email address used to sign in, as described in Section 3. We do not collect any additional personal information from students, including those under 13.

Schools and districts that deploy Modmath Enterprise under a valid license agreement are acting in a school official capacity and take responsibility for ensuring that deployment is consistent with applicable parental consent requirements under COPPA and applicable state laws.

8. GDPR and International Users

If your Institution is located in the European Union, European Economic Area, United Kingdom, or Switzerland, the General Data Protection Regulation ("GDPR") or equivalent legislation may apply to the processing of personal data.

In this context:

  • The Institution is the data controller for personal data relating to its administrators, staff, and students.
  • Modmath is the data processor, processing personal data only on documented instructions from the Institution.
  • Our legal basis for processing administrator and staff personal information is the performance of a contract between Modmath and the Institution.

Personal data is stored and processed in the United States on Amazon Web Services infrastructure located in the AWS US East region. Where required, Modmath will implement appropriate safeguards for cross-border data transfers, such as standard contractual clauses. Please contact us to request a copy of applicable transfer mechanisms.

Administrators and staff whose personal data we process have the right to access, rectify, erase, restrict, or object to the processing of their data, and the right to data portability. To exercise these rights, please contact your Institution administrator or reach us directly at contact@modmath.com.

9. Data Retention

We retain administrator and staff personal information for as long as the Institution's license is active and for a reasonable period thereafter to fulfill legal and contractual obligations. Upon termination of the license agreement, Institutions may request deletion of their data by contacting us at contact@modmath.com.

A student's sign-in email address may be retained beyond the end of a single license as part of the student's durable account identity, so the student can be re-added to a license without losing their work; we delete it on the Institution's request or after a defined period of inactivity.

10. Data Security

Modmath maintains reasonable and appropriate technical and organizational measures to protect personal data against unauthorized access, disclosure, alteration, or destruction. These measures include encrypted data storage, access controls, and secure transmission protocols.

While we take data security seriously, no method of transmission over the internet or electronic storage is completely secure. In the event of a data breach affecting personal information, we will notify affected Institutions in accordance with applicable law.

11. Children's Privacy

Modmath Enterprise is designed for use in educational settings and may be used by students under the age of 13. As described in Section 3, the only personal information we collect from students is the email address used to sign in. We do not collect any other personal information from students. Please refer to Section 7 for our COPPA compliance commitments.

12. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will notify Institutions by email or through the Admin Portal prior to the changes taking effect. Continued use of Modmath Enterprise following notification constitutes acceptance of the updated policy.

13. Contact Us

If you have questions about this Privacy Policy, our data practices, or to request a Data Processing Agreement, please contact us at:

Modmath for Students, Inc.
contact@modmath.com

Coming Soon