一句講晒:MathSage 係一個小朋友用嘅數學練習 app。所有學習紀錄預設只留喺你部機。我哋唔賣廣告、唔做追蹤、冇裝任何第三方分析 SDK、唔會賣你嘅資料。只有兩樣嘢會離開部機,而兩樣都由家長控制:①匿名診斷(預設關 —— 家長入去撳「我同意」先會開)同②每日 email 學習報告(要家長自己填 email 先會開)。同一個家長 email 亦會用嚟寄家長 PIN 重設碼,但只會喺家長自己撳「忘記 PIN?」嗰陣先寄(見 3.2)。
1. 邊個營運呢個 app
MathSage 由一位獨立開發者製作同營運,係一個為香港小學課程(小一至小六)設計嘅數學練習 app,喺 iPhone 同 iPad 上運行。本政策講明我哋點處理你同小朋友嘅資料。
如果你對本政策有任何疑問,請經支援頁聯絡我哋。
2. 留喺部機、唔會離開嘅資料
以下資料儲存喺你部裝置入面。現行版本(1.0)唔會將佢哋上傳去任何伺服器,我哋亦睇唔到;例外只有下面括號講明嘅情況(3.1 匿名診斷,同埋提供每日 email 報告嘅版本,見 3.2):
- 小朋友嘅名同年級(由家長自己輸入,可以用花名。例外:提供每日 email 報告嘅版本,如果家長開咗報告,名同年級會隨報告經 Google 暫存同寄去家長信箱,見 3.2)
- 所有答題紀錄:做過邊題、答咗咩、啱定錯、用咗幾耐、用過幾多次提示、難度等級(例外:如果家長開咗匿名診斷,題目編號同第一次答啱定錯會匿名傳出,見 3.1;提供每日 email 報告嘅版本,如果家長開咗報告,當日學習摘要會隨報告傳出,見 3.2)
- 手寫草稿圖(保留 3 日後自動刪走)
- 家長設定同 4 位數字家長密碼(PIN)
- 遊戲進度(寵物、領地等)
MathSage 唔使開戶口、唔使登入、冇雲端同步。你喺 app 入面刪除一個小朋友檔案,或者刪除成個 app,呢啲資料就會喺部機上永久消失,冇任何備份喺我哋度。
3. 會離開部機嘅資料(共兩條通道)
3.1 匿名診斷(預設關,要家長明確開啟)
為咗知道 app 有冇喺小朋友部機度死機、載唔到題目、或者卡住,app 可以傳出匿名嘅技術紀錄。
呢項預設係關嘅。喺家長入「家長端 → 帳戶 → 匿名診斷 → 我同意」之前,app 一件事都唔會記低,亦都唔會傳任何嘢出去 —— 連上面講嘅安裝編號都唔會產生。
| 會傳 | 唔會傳 |
|---|
• 一個隨機產生嘅安裝編號(UUID,入面冇姓名、冇 email;但同一部裝置傳出嘅紀錄都帶住同一個編號,所以我哋可以將佢哋歸埋一齊 —— 因此 Apple 私隱標籤將診斷資料列為「已連結」;刪 app 就永久消失)
• app 版本、iOS 版本、機種代號(例如 iPad13,1)
• 事件紀錄:開機、閃退、死機、畫面卡頓、題庫載入失敗、題庫更新結果、完成一組題(組數同首次答對率)
• 逐題統計:每條題嘅編號,同第一次作答係啱定錯(用嚟搵出出得唔好嘅題目;唔包小朋友個名或 email)
|
• 小朋友個名
• 家長 email
• 題目內容,同小朋友填嘅答案本身
• IDFA / IDFV 或任何廣告識別碼
• 位置、通訊錄、相片、麥克風、相機(app 完全冇要求過呢啲權限)
|
點開 / 點熄:app 內「家長端 → 帳戶 → 匿名診斷」。未表過態就會見到「我同意,開啟匿名診斷」同「唔要,多謝」兩個選擇;開咗之後隨時可以撳「關」。熄咗即刻停止記錄,連本機仲未傳出嘅紀錄都會即刻清走。
呢啲紀錄經 Google Apps Script 傳去我哋自己嘅一個 Google Sheet,只用嚟修 bug 同改善 app,唔會用嚟做廣告、唔會同任何人分享。
3.2 每日 email 學習報告(預設關,家長自己開)
現行版本(1.0)未提供每日 email 學習報告;以下內容只適用於提供呢項功能嘅版本。現行版本入面,家長 email 只會用嚟寄家長 PIN 重設碼。
家長可以喺「家長端 → 帳戶 → 每日 email 報告」填自己嘅 email。新版定時報告會喺小朋友裝置時區約晚上 9 點，將已同步摘要寄去你自己填嗰個信箱，每位小朋友一封。需要裝置先上網同步；信內顯示紀錄截止及最後同步時間。未同步唔代表冇練習。
- 報告內容:新版包括小朋友嘅名、年級、按課題及難度分開嘅練習／重溫首答表現、提示使用題數、改正及累積未改正題數，以及當日速算正式分數、答啱題數同用時。新版唔上傳逐題答案。舊版即時報告仍可能包括最多 5 條錯題同答案。
- 條路點行:app → 我哋喺 Google Apps Script 上嘅一個小程式 → 用 Gmail 寄去你個 email。
- 第一次要確認:第一次用某個 email,我哋會先寄一封確認信,你撳咗入面條連結先會開始寄報告或者重設碼。咁樣就冇人可以借 MathSage 寄嘢去唔屬於佢嘅信箱。
- 會唔會存起:新版定時報告會喺 Google Apps Script 暫存收件 email 同學習摘要，供排程寄送；待寄摘要寄出後移除，未寄出最長保留 8 日（由清理排程處理）。防重複寄送嘅 HMAC 指紋及狀態保留 35 日，唔包含報告正文。寄出郵件仍可能保留喺寄件及收件信箱。防濫發計數器暫存 email 最多 6 個鐘；另保留已確認地址嘅 HMAC 指紋。舊版即時報告唔加入待寄佇列。
- 開發者自己家庭嘅答題統計:只限我哋喺伺服器設定登記咗嘅開發者自己家庭 email,定時報告排程時會另外記低一個每日小統計:年級、當日答題數、首次答啱題數,同埋速算分數同答啱題數。每位小朋友只用一個由 app 產生嘅不記名檔案編號區分,保留 21 日後自動刪除。唔會儲小朋友名、email 或者題目內容。其他家庭一律唔會記錄。
- 唔想要:喺 app 入面清空 email 欄位，會停止之後嘅摘要同步；已排程嘅摘要仍可能寄出。需要處理待寄或已儲存資料，可經支援頁聯絡我哋。
- 家長 PIN 重設碼:如果你喺 PIN 畫面撳「忘記 PIN?」揀「寄重設碼」,app 會經同一條路寄一個 6 位一次性重設碼去你填嗰個 email。信入面只有個重設碼,冇小朋友或者學習資料;個碼由 app 自己產生,我哋唔會儲存。唔撳就唔會寄。
3.3 題庫更新(冇個人資料)
App 會不時去 Cloudflare 嘅檔案儲存服務下載更新版題庫。呢個係一般網頁下載,同下載一個檔案冇分別 —— 唔會傳出任何關於你或小朋友嘅資料。同所有上網行為一樣,對方伺服器會喺技術紀錄見到你嘅 IP 地址。
3.4 訂閱同付款
現行版本(1.0)冇任何訂閱或者 App 內購買;以下內容只適用於日後提供付費功能嘅版本。
如果你訂閱付費功能,交易完全由 Apple 嘅 App 內購買處理。我哋永遠見唔到你嘅信用卡號碼、Apple ID 或者付款資料。我哋只會由 Apple 收到一個「呢部裝置有冇有效訂閱」嘅結果,用嚟解鎖功能。
4. 兒童私隱
MathSage 係專登為小朋友設計嘅。因此:
- 零廣告、零第三方追蹤。我哋冇裝 Crashlytics、Sentry、Firebase、Google Analytics 或者任何同類 SDK。App 亦冇要求 App 追蹤透明度(ATT)權限,因為我哋根本冇追蹤。
- 小朋友介面冇外鏈、冇購買。所有設定、購買、報告、外部連結一律收喺 4 位數字家長密碼閘後面。
- 我哋唔會主動向小朋友收集任何個人資料。小朋友個名係家長自己輸入,而且只留喺部機(除非家長自己開咗每日報告,寄去家長自己個信箱)。
- 小朋友做題嘅內容同答案只留喺部機,除非家長自己開咗每日報告(寄去家長自己個信箱;新版定時報告只有學習摘要,唔上傳逐題答案,舊版即時報告仍可能包括最多 5 條錯題同答案,見 3.2)。另外,如果家長開咗匿名診斷,題目編號同首答啱錯會匿名傳出(見 3.1),但唔包括題目文字同小朋友嘅答案。
5. 我哋用到嘅第三方服務
| 服務 | 用嚟做乜 | 收到咩 |
|---|
| Apple | App Store 下載、App 內購買、系統層閃退報告(MetricKit) | 付款同帳戶資料由 Apple 直接處理,我哋接觸唔到 |
| Google(Apps Script / Gmail / Sheets) | 寄家長 PIN 重設碼同 email 確認信 · 寄每日報告(只限提供呢項功能嘅版本)· 儲匿名診斷紀錄 | 你填嘅家長 email(用嚟寄信;唔會另外存一份地址清單,詳情見 6)· 提供每日報告嘅版本:小朋友名、年級同學習摘要(為寄信而暫存,最長 8 日,見 3.2)· 匿名診斷紀錄 |
| Cloudflare | 擺放題庫更新檔案 | 一般下載請求(含 IP 地址),冇個人資料 |
我哋唔會賣、唔會租、唔會用你嘅資料做廣告,亦唔會將資料交畀上表以外嘅任何人,除非法律強制要求。
6. 保留幾耐
- 部機上嘅資料:由你決定 —— 一直留到你刪除小朋友檔案或者刪走 app 為止。手寫草稿圖係例外,3 日後自動刪。
- 匿名診斷紀錄:最多保留 12 個月,之後清走。
- 家長 email:寄 PIN 重設碼或者確認信嗰陣用,唔會另外存一份地址清單。防濫發計數器會暫存 email 最多 6 個鐘;已確認嘅地址只保留一個 HMAC 指紋(由 email 計出嚟嘅亂碼,倒推唔返個 email),用嚟記住「呢個地址確認咗」。寄出咗嘅信可能留喺我哋寄件信箱同你嘅收件信箱。想刪,可經支援頁聯絡我哋。
- 每日報告(只限提供呢項功能嘅版本;現行版本 1.0 冇):待寄摘要(包括小朋友名同年級)寄出後移除,未寄出最長保留 8 日;防重複寄送嘅 HMAC 指紋及狀態保留 35 日,唔包含報告正文(見 3.2)。寄出咗嘅信件之後就住喺你自己個信箱,由你話事。
7. 家長有咩控制權
- 停止匿名診斷:家長端 → 帳戶 → 匿名診斷 → 關(如果你之前開過)。連本機未傳嘅紀錄都會即刻清走。
- 停止 email 報告:清空 email 欄位。
- 刪除一個小朋友嘅全部資料:家長端 → 帳戶 → 刪除該檔案。如果部機只得一個檔案,請刪除 MathSage(見下一項)。會永久剷走佢嘅答題資料庫、遊戲存檔、設定同草稿。
- 刪除全部資料:喺裝置上刪除 MathSage。
- 查閱資料:你隨時喺「家長端 → 答題明細」睇齊所有紀錄,亦可以匯出一份文字檔帶走。
- 已經傳出咗嘅匿名診斷紀錄入面冇姓名、冇 email,所以我哋冇辦法喺入面認返邊條係你嘅。
8. 資料安全
所有離開部機嘅傳輸都行 HTTPS 加密。家長密碼(PIN)嘅設計目的係擋住小朋友,唔係擋黑客 —— 佢只係存喺 app 自己嘅設定入面,請唔好當佢係保險箱。
9. 政策更新
如果我哋改咗呢份政策,會喺呢一頁更新內容同日期。重大改動(例如新增一條會傳出資料嘅通道)我哋會喺 app 內同時通知家長。
10. 聯絡我哋
對私隱有疑問、想行使上述任何權利,請電郵 support@wisesagecreations.com,或者經支援頁聯絡我哋。
Privacy Policy (English)
Effective 14 October 2026 · Version 1.7. This English text is a translation of the Chinese version above; if the two ever differ, the Chinese version governs.
In one line: MathSage is a maths practice app for children. All learning data stays on your device by default. We show no ads, do no tracking, embed no third-party analytics SDKs, and never sell your data. Only two things ever leave the device, and a parent controls both: (1) anonymous diagnostics (off by default — a parent must tap “I agree” to turn it on) and (2) the daily email progress report (off until a parent enters their own email address). The same parent email is also used to send a parent PIN reset code, but only when a parent taps “Forgot PIN?” (see 3.2).
1. Who runs this app
MathSage is built and operated by an independent developer. It is a maths practice app for the Hong Kong primary curriculum (Primary 1–6), running on iPhone and iPad. This policy explains how we handle your and your child's information. Questions? Reach us through the support page.
2. Data that stays on the device
The following is stored on your device. The current version (1.0) never uploads it to any server, and we cannot see it; the only exceptions are the ones noted in brackets below (anonymous diagnostics in 3.1, and versions that offer the daily email report, see 3.2):
- Your child's name and grade (entered by you; a nickname is fine. Exception: in versions that offer the daily email report, if a parent turns it on, the name and grade travel with the report, are held temporarily by Google and are sent to the parent's inbox; see 3.2)
- All practice records: which questions, the answers given, right or wrong, time taken, hints used, difficulty level (exception: if a parent turns on anonymous diagnostics, question IDs and whether the first try was right or wrong are sent anonymously, see 3.1; in versions that offer the daily email report, if a parent turns it on, the day's learning summary is sent with the report, see 3.2)
- Handwritten scratch images (automatically deleted after 3 days)
- Parent settings and the 4-digit parent PIN
- Game progress (pets, homestead, and so on)
MathSage requires no account, no sign-in, and has no cloud sync. Deleting a child profile in the app, or deleting the app, permanently removes this data from the device. We hold no backup of it.
3. Data that leaves the device (two channels)
3.1 Anonymous diagnostics (off by default; a parent must turn it on)
So that we can tell when the app crashes, freezes or fails to load questions on a child's device, the app can send anonymous technical records.
This is off by default. Until a parent goes to Parent area → Account → Anonymous diagnostics and taps “I agree”, the app records nothing and sends nothing — not even the install identifier described above is generated.
| Sent | Never sent |
|---|
• A randomly generated install identifier (a UUID that contains no name or email; records from the same device carry the same identifier, so we can group them together — which is why Apple’s privacy label lists diagnostics as “linked”; gone for good when the app is deleted)
• App version, iOS version, device model code (e.g. iPad13,1)
• Events: launch, crash, hang, UI stall, question-pack load failure, content-update result, group completed (count and first-attempt accuracy)
• Per-question statistics: each question's ID and whether the first attempt was right or wrong (used to spot badly written questions; does not include your child's name or email)
|
• Your child's name
• The parent email address
• Question content, or the answers your child typed
• IDFA / IDFV or any advertising identifier
• Location, contacts, photos, microphone, camera (the app never requests these permissions)
|
To turn on or off: Parent area → Account → Anonymous diagnostics. Before any choice is made you will see “I agree — turn on diagnostics” and “No thanks”; once on, you can switch it off at any time. Recording stops immediately, and any records still queued on the device are deleted right away.
These records travel via Google Apps Script into a Google Sheet that we control. They are used only to fix bugs and improve the app, never for advertising, and are not shared.
3.2 Daily email progress report (off by default; parent opt-in)
The current version (1.0) does not offer the daily email report; this section applies only to versions that do. In the current version the parent email is used only to send the parent PIN reset code.
A parent may enter their own email address under Parent area → Account → Daily email report. With scheduled reports, synced summaries are emailed to that address only around 9 pm in the child's device time zone, one per child. The device must first sync online. Each report shows its cutoff and last sync time; missing synced data does not mean no practice.
- Contents: The scheduled version includes the child's name, grade, practice and review first-try results by topic and level, counts of first attempts using hints, corrected and outstanding mistake counts, and the daily official speed-maths score, correct count and duration. Individual answers are not uploaded by this version. Older immediate reports may still contain up to 5 missed questions and answers.
- Path: app → a small program of ours on Google Apps Script → sent to your inbox via Gmail.
- Confirmation first: the first time an address is used, we send a confirmation email; reports and reset codes start only after you open its link. This stops anyone from using MathSage to send mail to an inbox that isn’t theirs.
- Is it stored? Scheduled reports temporarily store the recipient address and learning summary in Google Apps Script. Queued content is removed after delivery, or after at most 8 days by the cleanup schedule. HMAC delivery fingerprints and status are retained for 35 days without the report text. Sent messages may remain in the sender and recipient mailboxes. An anti-abuse counter caches the address for up to 6 hours; an address-confirmation HMAC is also retained. Older immediate reports are not queued.
- Developer's own family tally: For the developer's own family email addresses only, as registered in our server settings, a small daily tally is recorded when a scheduled report is queued: grade, number of questions answered, number right on the first try, and the speed-maths score and correct count. Each child is identified only by an anonymous profile ID generated by the app, and the tally is deleted automatically after 21 days. No child's name, email address or question content is stored. Nothing is recorded for any other family.
- To stop: clear the email field to stop future snapshot syncs. Already queued reports may still be delivered. Contact us through the support page for help with queued or stored data.
- Parent PIN reset code: if you tap “Forgot PIN?” on the PIN screen and choose to email a code, the app sends a one-time 6-digit reset code to the address you entered, by the same route. The email contains only the code — no child or learning data. The app generates the code itself and we do not store it. Nothing is sent unless you tap it.
3.3 Question-bank updates (no personal data)
The app occasionally downloads updated question packs from Cloudflare file storage. This is an ordinary file download and carries no information about you or your child. As with any web request, the serving host sees your IP address in its technical logs.
3.4 Subscriptions and payment
The current version (1.0) has no subscriptions or in-app purchases; this section applies only to future versions that offer paid features.
If you subscribe, the transaction is handled entirely by Apple's In-App Purchase system. We never see your card number, Apple ID or payment details. All we receive from Apple is whether the device holds a valid subscription, which is what unlocks the paid features.
4. Children's privacy
- No ads and no third-party tracking. We embed no Crashlytics, Sentry, Firebase, Google Analytics or comparable SDK. The app never asks for App Tracking Transparency permission because there is nothing to track.
- The child-facing interface has no outbound links and no purchases. Settings, purchases, reports and external links all sit behind the 4-digit parent gate.
- We do not knowingly collect personal information from children. The child's name is entered by a parent and stays on the device, unless the parent has turned on the daily report that goes to the parent's own inbox.
- The questions a child answers, and their answers, stay on the device, unless the parent has turned on the daily report (which goes to the parent's own inbox; the scheduled version carries a learning summary only and uploads no individual answers, while older immediate reports may still contain up to 5 missed questions and answers; see 3.2). Separately, if a parent turns on anonymous diagnostics, question IDs and first-try right/wrong are sent anonymously (see 3.1), never the question text or the child's answers.
5. Third-party services we use
| Service | Used for | What it receives |
|---|
| Apple | App Store distribution, In-App Purchase, system-level crash diagnostics (MetricKit) | Payment and account data are handled by Apple directly; we have no access to them |
| Google (Apps Script / Gmail / Sheets) | Sending parent PIN reset codes and email confirmations · sending the daily report (only in versions that offer it) · storing anonymous diagnostics | The parent email you entered (used to send the message; we keep no separate list of addresses, see 6) · in versions with the daily report: the child's name, grade and learning summary (stored temporarily to send the message, for at most 8 days; see 3.2) · anonymous diagnostic records |
| Cloudflare | Hosting question-pack update files | Ordinary download requests including IP address; no personal data |
We do not sell, rent, or advertise against your data, and we share it with no one beyond the table above except where the law compels us to.
6. How long we keep things
- On-device data: for as long as you keep it — until you delete the profile or the app. Handwritten scratch images are the exception and are deleted after 3 days.
- Anonymous diagnostics: retained for at most 12 months, then deleted.
- Parent email: used when sending a PIN reset code or a confirmation email; we keep no separate list of addresses. An anti-abuse counter holds the address for up to 6 hours. For a confirmed address we keep only an HMAC fingerprint (a scrambled code computed from the address that cannot be turned back into it) to remember that it was confirmed. Sent messages may remain in our sending mailbox and in your inbox. To have them deleted, contact us through the support page.
- Daily reports (only in versions that offer them; the current version 1.0 does not): queued summaries, including the child's name and grade, are removed after delivery, or after at most 8 days if undelivered; HMAC delivery fingerprints and status are kept for 35 days without the report text (see 3.2). Once sent, the message lives in your own mailbox under your control.
7. Parental controls
- Stop diagnostics: Parent area → Account → Anonymous diagnostics → off (if you turned it on). Queued local records are wiped immediately.
- Stop email reports: clear the email field.
- Delete one child's data: Parent area → Account → delete that profile. If the device has only one profile, delete MathSage instead (see the next item). Their practice database, game save, settings and scratch images are permanently removed.
- Delete everything: delete MathSage from the device.
- Access your data: everything is visible under Parent area → Practice details, and can be exported as a text file.
- Diagnostics already sent contain no name or email, so we cannot single out your records from them.
8. Security
Everything that leaves the device travels over HTTPS. The parent PIN is designed to keep a child out, not an attacker — it is stored in the app's own settings, so please do not treat it as a vault.
9. Changes to this policy
If we change this policy we will update this page and its date. For material changes — for example a new channel that sends data off the device — we will also notify parents inside the app.
10. Contact
For privacy questions or to exercise any of the rights above, please email support@wisesagecreations.com or reach us through the support page.