For the school

The Times Tables Games pilot with Huntington Beach City School District, on one page, for the technology director and the privacy officer. The privacy and data page has every detail; this is the shape of it.

What this is

• A free, no-ads web app for times tables and division practice, with games, made by one person. Third-grade classes whose teachers choose to take part try it for a set time, and the maker learns what works for the children. Nothing is sold, and the pilot is not a trial of a product the district would later buy.
• The public app, at www.andrew-mceachin.com/times-tables-games/, collects nothing and needs no account. The pilot's copy, at https://mathhound.com, adds one thing: students sign in with their school Google account so their progress follows them between devices.
• The app is the same code on both. Only its settings differ.

What students do

• Open the link, tap Sign in with Google, and choose their school account. Then practice: a table at a time, a speed test, a review of weak facts, Balloon pop, Memory match, a two-player game, a walk with a cartoon dog, and printable diplomas. Each activity takes a few minutes. There are no grades, no leaderboards, and no messages between students.
• Signed out, everything works the same, and progress stays in that browser.

What is collected, and what is not

• From Google: an account number and the school's web domain. The app asks for the openid scope only. No name, email address, photo, class, or anything else in the account.
• On the server: the student's progress record (which facts were practiced and how well, the sessions, the bests, and the cartoon dog's name from a fixed list), filed under a coded key made from the account number. No name, email, school, class, or location. The server checks every save and keeps only the fields the app writes.
• The server accepts hbcsd.us accounts only. A personal Gmail or another district's account is refused.
• No cookies, ads, analytics, tracking, or sharing. Nothing is used for anything but showing a student their own progress. There is no teacher or district view in the app.
• The server keeps no request logs. The host, Cloudflare, receives the usual request details to deliver the pages, as any host does.

How long, and how it ends

• A record with no save for 90 days is deleted by a nightly job.
• On June 30, 2027, the end of the pilot, every record is deleted, the server refuses new sign-ins and saves, and the district gets written confirmation. The district can end it sooner by asking.
• A student can download or delete their own record from the app's Account screen at any time. A parent or the district asks through the school and gets an answer within 30 days.

Security, in plain words

• Everything is over HTTPS, with the usual security headers; the page refuses connections to any other site.
• The records are keyed by a one-way code, so the database alone does not say whose account a row is. Cloudflare encrypts the database at rest. The maker's accounts at Google, Cloudflare, and GitHub use two-step verification.
• A sign-in lasts 7 days and is renewed by use; signing out ends it on every device. Sign-ins and saves from one address are rate limited.
• An incident is reported to the district's named contact within 72 hours of the maker learning of it. The written security program and incident plan are available to the district on request.

What the district does

1. Approves the pilot in writing: the technology director for the app, and its student data privacy agreement (the California Student Data Privacy Agreement, or the district's own form), which the maker signs as the provider.
2. Allows the app for the participating classes in the Google Admin console: Security, Access and data control, API controls, Manage third-party app access, Configure new app, search for the OAuth client ID 677374343800-9ue5n2rp83ssgt0n2f4jsh87t3vm8bff.apps.googleusercontent.com, and allow it for the participating classes' organizational units, or the elementary schools', at the narrowest level that works (Limited). Google blocks under-18 accounts from unconfigured apps until this is done.
3. Allows https://mathhound.com and accounts.google.com on the network.
4. Sends the parent notice home (a one-page letter is provided), and tells teachers: the link, pick the dog's name from the list, sign out at the end of a turn on a shared browser.
5. Lends one test student account in one of those organizational units for a first sign-in, so the consent screen Google shows a student can be checked and shown here.

What Google shows a student

• Google's own account chooser, then its consent screen for this app, which lists the one thing asked for: to sign in. A screenshot of that screen, taken with a district test account, will be added here after the first sign-in.

What the maker asks for

• Feedback from the teachers, by email, on what the children liked, what confused them, and what broke. Nothing else. There is no survey inside the app and no data about students is collected for the purpose.

Contact

• Andrew McEachin, amceachin@gmail.com, (949) 436-9921, 250 El Camino Real, Ste 108, Tustin, CA 92780.
• Accessibility: targets WCAG 2.1 AA and partially conforms; see the accessibility statement. Security reports: /.well-known/security.txt.

Last updated October 26, 2026.