Privacy Policy

This page is a draft. It is being reviewed before FactFlight opens to families.

The Short Version

Kids use FactFlight with a nickname. We never ask for a kid’s full name, email, photo or location.
A grown-up (a parent, guardian or teacher) makes the account and gives a first name, last name and email.
No ads, no trackers, and we never sell or rent anyone’s information.
You can delete your account and everything in it at any time, from inside FactFlight.

Who FactFlight Is For

FactFlight is math fact practice for kids in the elementary grades. Accounts belong to grown-ups aged 18 or over. Kids don’t have accounts of their own: they practice inside a grown-up’s account.

What We Collect

From Grown-Ups

First name, last name and email address.
For teachers and schools, a school or class name.
Whether you are a parent, a teacher or a school, and your time zone (to send reports in the evening).
A password, if you choose to set one. We store a scrambled form that can’t be turned back into the password.
Your 4-digit parent code, stored the same way.
If you add a passkey, its public key. Your fingerprint or face never leaves your device.
If you sign in with Google, Apple, Clever or ClassLink, the ID that service gives us for you, with your name and email.
Email addresses you type in to invite another parent, to send a kid’s report, or to invite parents to a class. We use them only to send those emails, and each one has a link to stop them.

About Kids

A nickname that the grown-up chooses.
A grade, if the grown-up chooses to give one.
Practice settings, such as which sections and numbers to work on, and which learning support options are on. We save only whether an option is on, never a reason or a diagnosis.
Every quiz and practice answer, with whether it was right and how long it took. This is what the reports, awards and certificates are made from.

A full name typed onto a certificate stays in your browser while the certificate is open. It is never sent to us or saved.

Payments

Paid plans are paid for by card through Stripe. Card details go straight to Stripe and never touch our servers. We keep the Stripe customer and subscription IDs and whether the plan is running.

Kept Automatically

One cookie that keeps you signed in, and short-lived cookies while you are signing in. No advertising or tracking cookies.
Choices such as larger text or muting read aloud are saved on the device itself.
To stop abuse of sign-in, a scrambled form of the network address that asked for a sign-in link or got a password wrong, kept for up to a day.
Our hosting provider keeps ordinary server logs (such as the time and address of a request) for a short time, to keep the service running and secure.

What We Don’t Do

We don’t show ads.
We don’t use analytics or tracking tools from other companies, and pages load nothing from other companies’ sites.
We don’t sell, rent or trade personal information.
We don’t build profiles of kids for anything other than their own practice and reports.
Kids can’t post, chat or share anything with other people.

How We Use It

To run the daily quiz and practice, and to choose which facts a kid needs next.
To show reports, awards and certificates to the grown-ups in charge.
To sign you in and keep the account safe.
To send emails you asked for (sign-in links, progress reports, invites) and emails about your account (payment, deletion, a plan we stopped because nobody was practicing).
To take payment for Paid plans.

Who Can See It

The grown-up who owns the account.
Parents that the account owner invites to follow a kid. They can only view.
The teacher of a class that a parent chooses to join a kid to. The teacher sees that kid’s progress and can change practice settings. The parent can leave the class at any time.
Companies that run parts of the service for us (listed below). They may only use the information to do that job.
Authorities, only when the law requires it.

Companies That Help Us Run FactFlight

Hosting and database provider: stores everything listed on this page, on our behalf.
Email delivery provider: gets the email address and the content of each email we send.
Stripe (payments): gets the account owner’s name, email and card details, and how many kids are on a Paid plan. It gets nothing else about kids.
Google, Apple, Clever or ClassLink (only if you choose to sign in with one): learns that you signed in to FactFlight. We send them nothing about kids.

None of them may sell the information or use it for advertising. We don’t use artificial intelligence on kids’ information, and we don’t give it to anyone to train AI.

Children’s Privacy

FactFlight is used by children under 13, so we follow the U.S. Children’s Online Privacy Protection Act (COPPA). A kid can only use FactFlight after a parent, guardian or teacher has made an account and added them. We collect from kids only what the practice needs: a nickname and their answers. A parent or guardian can at any time:

See everything we hold about their kid, in the kid’s report.
Download a progress file from Parents & Teachers.
Delete a kid, or the whole account, which removes the information for good.
Tell us to stop collecting, by deleting the kid or writing to us.

The Children’s Privacy Notice explains this step by step.

Schools and Teachers

When a teacher or school uses FactFlight with students, the school stays in charge of the students’ information, and we use it only to provide FactFlight to that school, in line with the Family Educational Rights and Privacy Act (FERPA). Teachers add students by nickname. Parents who join their kid to a class keep the kid in their own account. A school can ask us to delete its information at any time. See Schools and Student Information.

How Long We Keep It

Account and practice information: until you delete the kid or the account.
Sign-in links and codes: they stop working within minutes and are removed within days.
Backups: copies made to protect against loss are replaced on a rolling schedule after deletion.

Where Information Is Kept

FactFlight is run from the United States and information is stored there. If you use FactFlight from another country, your information is sent to the United States.

Your Choices

Change your name, password, passkeys and report emails in Parents & Teachers.
Stop report emails with the link at the bottom of each one.
Delete your account from Parents & Teachers → Delete Account. It can’t be undone.
Ask us for a copy of your information, or ask us anything else about it.

Your Rights Under State Privacy Laws

California and some other U.S. states give residents extra rights over their personal information. We give the same rights to everyone, wherever you live:

To know what we hold about you and your kids, and to get a copy.
To have it corrected or deleted.
Not to be treated differently for using these rights.

We don’t sell personal information, and we don’t share it for advertising, so there is nothing to opt out of. To use a right, write to us from the email address on your account. Someone you authorize in writing can ask for you. If we say no to a request, you can ask us to look again.

Security

FactFlight is served over an encrypted connection. Passwords and parent codes are stored scrambled, sign-in links work once, and each family’s information is kept apart from every other family’s. No system is perfect; if something ever goes wrong that affects your information, we will tell you.

Changes

If we change this policy in a way that matters, we will email account owners before the change takes effect.

Contact

Write to us at support@factflight.com. We answer within a few days, and always within 30 days.