Privacy and data

For the Times Tables Games pilot with Huntington Beach City School District. This is the pilot's own copy of the app, at https://mathhound.com; the public app has a page of its own, and the printable worksheets another.

The following covers data and privacy in more detail. It is written for parents, teachers, and the district's technology and privacy staff, and every statement on it is checked against the app's code before the page is published.

What the app is

• A web page (HTML, CSS, and JavaScript) that asks times tables and division questions and keeps score in the browser.
• A small server keeps each signed-in student's progress record: a Cloudflare Worker with a Cloudflare D1 database. On the pilot, the page and the server share one address, https://mathhound.com.
• It is made and run by one person, Andrew McEachin (the site owner), not a company. Contact details are at the end of this page.
• The code that runs in the browser can be read there, as on any website. The full source code, including the server, can be shared with the district.
• The district's agreement governs the pilot. Where this page and the agreement differ, the agreement wins.

Signing in with a school Google account

• Signing in is only for keeping progress across devices. Every activity works the same without it.
• Students sign in with their Huntington Beach City School District Google account (hbcsd.us). The server accepts no other account: Google's sign-in tells it the account's web domain, and any account outside hbcsd.us is refused with a message saying to use the school account. Nothing about the refused account is kept.
• It uses Google's standard sign-in (OAuth 2.0, the authorization code flow with PKCE) and asks only for the openid scope. Google gives the app an account number and the account's domain, and nothing about the person: not the name, email address, photo, contacts, files, Drive, Classroom, or anything else in the account.
• The server takes part in each sign-in: it trades Google's one-time code (with the app's own secret) for the account number, checks the domain, turns the number into a coded key (a keyed hash), keeps only the key, and discards everything else Google sent. The app keeps no Google passwords or Google tokens; the server gives the browser its own sign-in token instead.
• That token is good for 7 days. Each successful save renews it, so a device in use stays signed in and one that falls out of use lets go. Signing out ends it on every device at once, not only in that browser.
• Google's Workspace for Education privacy notice covers what Google itself does during sign-in with a school account.
• Google shows its account list at every sign-in, so each student can choose their own account. Signing out of this app does not sign the browser out of Google.
• The district's Google administrator controls whether school accounts can sign in to this app at all, through the Admin console (see For the district below).

Shared devices

• On devices where each student signs in to the device with their own account, each student has their own browser and their own progress, and none of the rest of this section comes up.
• On a browser that several students share: at sign-in, the progress already in that browser is added to the account, including play by anyone who used it signed out. The one exception: if the browser's last sign-in belonged to a different student (and has run out), that progress is set aside on the device for them, comes back when they sign in there again, and is dropped after 30 days. It is never added to the new account.
• While signed in, anyone using that browser is signed in as that student, and their answers are saved to that student's account. Sign out on the Account screen at the end of each turn. Signing out clears the progress and the sign-in from that browser (the progress stays in the account); the tables and settings last chosen stay.

What the server keeps for a signed-in student

• The progress record, the same one the browser keeps (listed under What is stored on the device below), filed under the coded key, with the time of the last save and a version number for safe saving.
• That record includes the cartoon dog's name and coat from the park game. The name is picked from a fixed list of dog names; nothing can be typed there. The name typed onto a printed diploma certificate is never saved.
• Nothing else: no name, email address, school, domain, grade, class, or location. The server checks this itself on every save: inside the record it keeps only the fields the app writes, each as a number, a yes or no, or a word from a fixed list, with sizes capped, and throws away anything else a browser sends. Nothing typed by a person can reach a row.
• It is used only to show the student their own progress on their own devices. It is not shared, sold, used for advertising or analytics, or used to build a profile of the student. There is no teacher or district view in the app.
• Only the site owner (through the Cloudflare account that runs the server) and Cloudflare, as the host, can read the stored records. The server gives a record only to a browser signed in to that same account. The app does not add its own encryption to the record; Cloudflare encrypts the database at rest and every connection uses HTTPS.
• The browser sends the record at sign-in, when the page opens, when an activity ends, about 20 seconds after other changes, when the page is hidden or closed with a change waiting, and when the connection comes back after a failed save. It gets the merged record back each time. Nothing is sent while signed out or after a sign-in has run out.
• The database is held by Cloudflare in its western North America region. Cloudflare, like any host, receives the standard details of each request (such as IP address and browser type) to deliver it, and counts requests for billing; see the Cloudflare privacy policy. The site owner keeps no request logs: the server's logging is switched off in its settings. To limit misuse, the server counts sign-ins and saves from each address for one minute at a time (120 sign-ins and 600 saves a minute) and keeps nothing past the minute.

How long it is kept, and how to delete it

• A record with no save for 90 days is deleted by a nightly job. On June 30, 2027, the end of the pilot, the same job deletes every record, and from that date the server refuses new sign-ins and saves, so nothing can come back; the site owner confirms the deletion to the district in writing. The district can end the pilot sooner by asking.
• A student can delete their own record at any time: on a browser signed in to the account, open the Account screen from the "Account" link at the bottom of the app and choose "Delete my account", then "Yes, delete it". The record is removed from the server at once, and any other browser still signed in to that account is asked to sign in again. The progress on the device stays on the device until it is cleared.
• A student can also see exactly what the server holds: "Download my progress" on the same screen saves the record as a file on the device. Nothing is sent anywhere.
• A parent, or the district, can ask to see or delete a student's record through the school. The server keeps no names or email addresses, so a record cannot be found from them; the district sends the student's Google account id (which its Google Admin console shows), the site owner finds the record from that, by the same coded key, and answers in writing within 30 days with the file or the confirmation of deletion.
• After a deletion, the server keeps the coded key and the time of deletion for about a week, as long as a sign-in can last, so that a browser still holding the old sign-in cannot save into the account again; the nightly job then clears it. A sign-out is remembered the same way. Cloudflare's own backups of the database are gone within 30 days.

What is stored on the device

• Progress is saved in the browser's local storage under ttg.progress.v1: for each fact (such as 4 × 7 or 28 ÷ 4; times tables and division facts are kept apart), how many times it was asked, how many times it was right (a pair found in Memory match counts as both), the current run of right answers, the fastest right answer, the latest time, and when it was last asked; plus a summary of each of the last 50 sessions (practice, speed test, review, a learn check, a diploma, a round of Balloon pop, a memory match, a two-player game (only the answers of the player picked to save), or a walk to the park, the tables, how many were asked, how many were right, the average time, and when), which tables have passed the learn check (the range used and when), the best speed test run for each combination of tables and settings (how many right, how many asked, the average time, and when) and the best Balloon pop round with the stopwatch on for each combination of tables and settings (the time, how many right, how many asked, and when), and which diplomas are earned (when, the range tested, whether mixed order was on, and the time taken). The dog game adds the dog's record: its name and coat, when they were last chosen, how many walks in all, how many times each street was walked, when it was last walked, and the best stars there, which dog friends were met, how many bones were found, and, for each challenge on the map finished at least once (the empty lot, where the dog's house is built, and Splash Pond, where the dog swims with its friends), how many times and when last, and for the house the look picked (the wall color, the roof color, and what goes on top); a walk's session summary also names the street, a challenge's names the challenge, and a Balloon pop round's names its speed (Calm, Steady, or Quick) and, with the stopwatch on, how long the round took. A session of division says so, and the Learn ticks, the speed test bests, and the diplomas are kept for times tables and for division separately. This whole record, and nothing more, is what the server keeps for a signed-in student.
• The dog's name is picked from a fixed list of dog names; there is no way to type one. It is never put in a link.
• The tables last chosen are saved under ttg.tables, and the settings (times tables or division, the multiply-by range (the answers, in division), the mixed order switch, whether answers are typed or chosen, the speed test length and cap, the Balloon pop speed and stopwatch switch, and the Less motion switch that the dog game, Balloon pop, and two players share) under ttg.settings.v1. These two are never sent to the server, and signing out does not clear them.
• Once a student signs in, ttg.account.v1 holds the server's sign-in token (which carries the account's coded key and when it was issued and runs out), when it runs out, and the time of the last save. Signing out removes it. Until it runs out, anyone using that browser is signed in with it.
• Progress set aside for a student whose sign-in ran out in that browser (see Shared devices) is kept under ttg.aside.v1, by coded key with the time it was set aside, until that student signs in there again, or for 30 days, or until the browser's data is cleared. It is never sent anywhere while it is set aside.
• During sign-in, for the moment the browser is away at Google, a one-time check value is kept in the tab's session storage under ttg.signin and removed on the way back. For five seconds after Start in Balloon pop, the tab's session storage holds that round's address under ttg.balloon.arm, so a page that reloads in that moment keeps the round; it holds nothing about the student.
• The pilot's copy of the app keeps no offline copy of its files (the public app does): every visit loads the current files, so a change reaches every student at once.
• The chart screen has a "Clear progress on this device" button that removes this app's progress and settings from that browser, and nothing else. Clearing the browser's site data for https://mathhound.com also removes them, and the sign-in with them.
• No cookies are set.

Network requests

• All requests go to https://mathhound.com over HTTPS: the page itself, one stylesheet, five scripts, up to four font files (each fetched when text first needs it), and, once signed in, the saves described above. During sign-in the browser visits Google's sign-in page at accounts.google.com and comes back.
• No other third-party services are used: no font services, content delivery networks, analytics, or ads. The fonts (Andika and Atkinson Hyperlegible, both under the SIL Open Font License) are served from this address.
• The page's security policy tells the browser to refuse any connection to another site, and the server sends the usual security headers (HTTPS only, no framing, no content sniffing, no referrer).
• The app plays no sound and never uses the microphone or camera.

Hosting

• The pilot's page and server run on Cloudflare Workers, with the records in Cloudflare D1, both services of Cloudflare, Inc. Cloudflare is the pilot's one subprocessor besides Google for sign-in.
• Like any web host, Cloudflare's servers receive the standard details of each request (such as IP address and browser type) to deliver the pages and count requests. See the Cloudflare privacy policy. The server's own request logging is switched off, so the site owner gets no visitor logs or analytics.
• Google's sign-in return (the one-time code) comes to this same address, not to any other host.

For the district

• Allow https://mathhound.com and Google sign-in (accounts.google.com) on the network. The pilot's address will not change during the pilot; the district gets 30 days' notice before any change to it.
• On Google Workspace for Education, Google blocks students designated as under 18 from an app their administrator has not configured, unless the domain allows apps that ask only for basic sign-in information (this app asks for less than that). To allow it for the participating classes: Admin console, Security, Access and data control, API controls, Manage third-party app access, Configure new app, then search for the OAuth client ID 677374343800-9ue5n2rp83ssgt0n2f4jsh87t3vm8bff.apps.googleusercontent.com, and allow it for the participating classes' organizational units, or the elementary schools' if that is simpler, at the narrowest level that works (Limited, since the app asks for no Google data). It requests only the openid scope.
• Allowing the app in the Admin console controls whether students' school accounts can sign in. The consent for the pilot is the district's written approval, under its agreement, for a tool used only for the school's purposes; Google asks the administrator to confirm that the school has obtained any parental consent the law requires. The server accepts only hbcsd.us accounts, so a family account cannot be used here.
• The district's student data privacy agreement (the California Student Data Privacy Agreement, or the district's own form) is signed before any student signs in, and its terms govern: the records belong to the district, are used only for the pilot, are not disclosed, and are deleted at the end; a security incident is reported to the district's named contact within 72 hours of the site owner learning of it; the district can have records returned or deleted on request.
• Teachers should tell students to pick the dog's name from the list (there is no other way) and, on a shared browser, to sign out at the end of a turn.
• The app works as a plain link. It needs no rostering or LTI integration. Sign-in with Clever is not available.
• It works in current web browsers on computers, tablets, and phones. See the accessibility statement for what works with a keyboard and a screen reader, and how to report a problem.
• Printing a certificate uses the device's own print dialog. Nothing about printing goes to this site.
• A security problem can be reported to the addresses below, also listed at /.well-known/security.txt.

Changes and contact

• If what the app collects, or how it is used, is going to change, this page will be updated before the change goes live, the date below will change, and the district's named contact will be told 30 days ahead. The app keeps no email addresses, so it cannot tell families directly; the school can.
• Questions, a request to see or delete a student's saved progress, or a security problem to report: amceachin@gmail.com, or call (949) 436-9921. You will get a reply within five school days, and an answer to a review or deletion request within 30 days.
• By mail: Andrew McEachin, 250 El Camino Real, Ste 108, Tustin, CA 92780.

Last updated October 26, 2026. This copy of the page is for the pilot at https://mathhound.com.