Privacy notice
Draft for legal review (version 2026-11-draft-4). This text has not yet been approved by a lawyer. It describes what sedifier does today.
sedifier is a free maths learning site. It has no ads, sells nothing and does not track anyone. You can use all lessons and exercises without an account: then nothing about you is kept on our servers. This notice explains what changes when you create an account.
A shorter version for children is at the end of this page.
1. Who is responsible
The controller of your personal data is [CONTROLLER: name or company, address]. Contact for anything about your data: [privacy@sedifier.com]. Legal notice: see the “Legal notice” page.
2. Without an account
- Your progress (answers, scores, review dates, your plan) is stored in your browser only (IndexedDB). We cannot see it. You can export it as a file or delete it in the parent page.
- When you answer an exercise, the site may send an anonymous count to our server: the exercise number, its version and the outcome (right, wrong, hint, skipped). No identifier, no cookie, no IP address is stored with it. It helps us find exercises that are too hard.
- No cookie is set.
3. What we keep with an account
We only keep what the service needs.
| Who | What we keep | Why |
|---|---|---|
| Everyone with an account | Email address; role (learner, parent or tutor); language; country of residence; date the account was created and last used; passkeys (a public key, a name you can choose, dates) and, if you set one, a password stored as an Argon2id hash; sessions (a random identifier stored as a hash, a coarse device type such as “iPad”, dates) | To sign you in, keep you signed in, and contact you about your account |
| Learners with their own account | The answer to “Are you N or older?” for your country (for example “FR ≥ 15”), never a birth date; nickname and avatar; curriculum, level, goal, learning plans (purpose, lessons, dates and any short note from an adult), the plan answers (branches to strengthen, practice days and minutes, a test date if you give one); learning progress (see below) | To show your plan and progress on all your devices |
| Children added by a parent | Nickname and avatar (no real name, no photo, no birth date, no school); curriculum, level, goal, the plan answers (branches to strengthen, practice days and minutes, a test date if you give one); learning progress | Same, on the child’s devices and for the parent |
| Parents | The family (who the parents and children are); for each child, the parent’s agreement: notice version, date given, date the confirmation email was sent, date withdrawn | To prove the agreement and let either parent control the child’s data |
| Tutors | The name you show to families; which learners you were invited to follow, by whom, and since when | To show you only the learners you were invited to follow |
Learning progress means: for each exercise, the date, whether the first try was right, the typical mistake detected (a code such as “M.EXP.01”), hints used and time spent; exercise set scores; saved summary cards; review dates; where you stopped in a lesson. What you type in answers is not sent to our server.
Security records: for 90 days we keep sign-in events (for example “signed in with a passkey”, “wrong code”) with the date and the network part of the IP address only (the last part is removed). They help us detect attacks.
Contact form. If you write to us with the contact form, we receive your email address, the name you give (optional), your message, its topic, the page you came from and your language. We use them only to answer you (at your request: GDPR Art. 6(1)(b); otherwise our legitimate interest in answering, Art. 6(1)(f)). The message is not stored in the sedifier database: it goes to our mailbox, and the form sends nothing to the address you give.
4. Why we use your data, and on what legal basis
- To provide the service you ask for (accounts, sync, family, tutors): performance of a contract (GDPR Art. 6(1)(b)). For a child, the contract is made with the parent, who adds the child and agrees.
- To keep the service secure (rate limits, security records, security emails): our legitimate interest in protecting accounts (GDPR Art. 6(1)(f)).
- To prove a parent’s agreement for a child: legal obligation and legitimate interest (GDPR Art. 6(1)(c) and (f)); in the United States, the Children’s Online Privacy Protection Act (COPPA).
We do not use your data for advertising, profiling for marketing, selling or training AI models. The progress view (mastery of each lesson) is only shown to you, your parents and the tutors you invited. It has no legal or similar effect on anyone.
5. Who can see it
- You, and for a child: the parents of the family (at most two).
- A tutor, only if a parent (or a learner with their own account) invites them, and only for that learner: nickname, avatar, level and progress. Never email addresses, devices or agreements. Removal takes effect at once. If the person who invited them allows it, a tutor can also propose and change plans.
- A parent a learner invited (learners with their own account): the same as a tutor.
- Our service providers, who process data only on our instructions (GDPR Art. 28):
- OVHcloud (OVH SAS, France): the server (in Gravelines, France) and the database that hold the data, and the backups, in the EU.
- Namecheap Private Email (Namecheap, Inc., USA): our mailboxes (support, contact, privacy) and the sending of our emails (codes, confirmations, invitations). It receives the recipient’s address and the email’s text, which can include a child’s nickname (in agreement confirmations and invitations), and messages sent to us, including those from the contact form. Namecheap is a US company: Its servers are in the USA (Phoenix, Arizona). [CHECK: the safeguard for the transfer outside the EU (EU-US Data Privacy Framework certification or standard contractual clauses in Namecheap’s data processing agreement)].
- Nobody else. We never sell or rent data and never disclose children’s data to third parties. We would only share data if the law obliges us (for example a court order).
All data is stored and processed in the European Union, including for users in the United States.
6. How long we keep it (retention policy)
| Data | Kept |
|---|---|
| Account, progress, family, nickname | Until you delete it, or after 24 months without any activity (sign-in or progress synced). We warn you by email 30 days before |
| A child’s data | Until a parent removes the child, withdraws the agreement or deletes the family, or the family is inactive as above |
| Sign-in codes | 10 minutes of validity, deleted the next day |
| Sessions | 30 days after the last use, then deleted |
| Invitations and a child’s request to a parent | 7 days, deleted the next day |
| Links to removed tutors and unlinked devices | 90 days, then deleted |
| Security records (sign-in events) | 90 days |
| Proof of a withdrawn parent agreement (without the child’s nickname) | 5 years after the withdrawal |
| Backups | 30 days; deleted data disappears from backups within 30 days |
| Contact messages and our answers | Up to 12 months after the conversation ends, then deleted from the mailbox |
Deleting is immediate in our database.
7. Your rights
You can, at any time and for free:
- see and download your data: “Download my data” on your account page; “Download progress” for each child on the family page;
- correct it: nickname, avatar, level and language on the account and family pages;
- delete it: “Delete my account”, “Remove” a child, “Delete the family”; remove a device, a tutor or a follower;
- withdraw a parent’s agreement: the child’s data is then deleted;
- object to processing based on our legitimate interest, ask us to restrict processing, and port your data (the downloaded files can be imported into the app anywhere).
Parents can review their child’s data, have it deleted and refuse further collection at any time (COPPA); the other parent of the family can do the same. Write to [privacy@sedifier.com] for anything you cannot do yourself in the app. We answer within one month.
You can complain to a data protection authority: in France the CNIL (cnil.fr), in Germany the authority of your federal state, in the United States the Federal Trade Commission (ftc.gov).
8. Children
- A learner can create their own account only at or above the age of digital consent of their country: 13 in the United States, 15 in France, 16 in Germany and the rest of the EU. We ask one question (“Are you N or older?”) and keep only the answer.
- Younger learners use sedifier without an account, or a parent adds them to a family. The parent confirms being the parent or legal guardian and agrees to this notice. The next day we send the parent an email confirming the agreement, with a link to undo it (“email plus”).
- A child can ask a parent from their device (“Ask a parent”). We only send one email to the address the child types, and keep a coded fingerprint of it for 7 days to prevent repeated emails.
- We collect from children only what the lessons need: a nickname, an avatar and their progress. A child cannot write messages to anyone, and nothing a child types is published.
9. Security
Passwords are optional and stored as Argon2id hashes; passkeys are supported; sign-in codes are stored as hashes. All traffic is encrypted (HTTPS). Access to data is checked on every request. Children’s devices are linked without any password and can be unlinked by a parent. A written security programme and a data protection impact assessment are kept up to date.
10. Cookies and storage
We set one cookie, only when you sign in: __Host-sid, your session (strictly necessary; it expires 30 days after your last visit or when you sign out). Without an account, there is no cookie. The browser storage (IndexedDB) holds your progress on your device. No analytics, no advertising, no third-party content: our pages load nothing from other sites.
11. Changes
When this notice changes in a way that matters, we tell you on the site, and parents agree again before any new use of a child’s data. Each version has a number (above).
For children: your data on sedifier
Without an account, your progress stays on your device. We cannot see it.
With a family account (a parent sets it up), we keep on our server:
- your nickname and avatar (never your real name or photo);
- your level and your goal;
- your learning plans;
- your progress: which exercises you got right, the typical mistakes, your saved cards.
What you type in your answers stays on your device.
Who can see your progress? You, your parents, and a tutor only if your parent invites one. Nobody else. We never sell it and never show you ads.
Why? So you find your plan and your progress on all your devices.
You can ask your parent to change your nickname, to remove a device or a tutor, or to delete everything. It is deleted at once.
If you have not used sedifier for two years, we delete your data.
If something worries you, talk to your parent. They can write to us at [privacy@sedifier.com].