Effective date: 17 September 2026
This policy covers the MATHION app and service ("MATHION", "we", "us"). This policy explains what personal data the MATHION iOS app and its backend services collect, why, and how you can control it.
Contact for privacy questions: support@mathionedu.com.
| Data | Why we collect it | Source |
|---|---|---|
| First name, last name, email address | Create and identify your account, send account-related email | Sign-up form |
| Password | Authenticate you. Passwords are managed by Amazon Cognito (see §4); MATHION's own database does not store your password. | Sign-up / login |
| Subscription plan | Determine which features and session limits apply to your account | Account / billing |
| Questions and answers you save (math problems and their solutions) | Keep your solved-problem history available in the app | Camera capture / typed input, saved via the Q&A feature |
| Photos of math problems you capture with the camera | Recognise the problem (OCR) and generate a step-by-step solution | Device camera |
| Login attempts: IP address, device type, browser/user-agent string, timestamp, success/failure | Detect new-device logins (email alert), lock the account after repeated failed attempts, and general account security | Recorded automatically on every sign-in attempt |
| One-time passcodes (OTP) for password reset and account deletion | Verify it is really you before resetting a password or deleting an account. Stored only as a bcrypt hash, and expire (5 minutes) | Generated by the backend, sent by email |
| Device identifier (identifierForVendor) and a security/device-attestation token (Apple DeviceCheck) | Basic abuse and fraud prevention on API requests | iOS device |
When you use the camera to capture a math problem, the photo is uploaded to MATHION's OCR service to convert it to text. The recognised equation (and, for the AI-solved-with-explanation feature, the equation text) is then sent to MATHION's backend, which relays it to OpenAI's API to generate a step-by-step solution. The app itself holds no OpenAI credential — the request is brokered entirely by the MATHION backend, and only the equation text or the OCR-hosted image URL is sent, not the raw photo file, in the solve request. The resulting question and answer are then saved to your account's Q&A history if you choose to keep them.
MATHION does not sell your personal data. We use the following service providers ("processors") to operate the app; each only receives the data it needs to perform its function:
| Processor | Purpose | Data involved |
|---|---|---|
| Amazon Web Services (AWS) — Lambda, API Gateway, RDS/MySQL, S3 (ap-south-1, Mumbai) | Hosts the backend application, database, and file storage | All account and app data described in §2 |
| Amazon Cognito (AWS) | Authentication: stores and verifies your password, issues sign-in tokens | Email address, password (Cognito-managed), account status |
| Amazon SES (AWS) — email delivery provider | Sends transactional email: account activation, password reset OTP, new-device login alerts, account-lockout notices, account-deletion OTP and confirmation, subscription-change notices | Email address, name, content of the relevant transactional message |
| OpenAI | Generates the step-by-step solution text for a math problem | The equation text (and, for image-based solving, a URL to the OCR-processed image) — not your name, email, or account identifiers |
| Apple (DeviceCheck) | Device-attestation signal used for basic bot/abuse prevention | Anonymous per-device attestation token generated by iOS |
We do not use third-party analytics or crash-reporting SDKs, and we do not use Google Firebase / push notifications in the current build of the app (a Firebase configuration file exists in the project, but Firebase is not initialized and no analytics or push notification calls are made). Before September 2026, transactional email was delivered by SendGrid (Twilio).
We do not send marketing email and we do not sell or rent your personal data to third parties.
MATHION's servers and database run on AWS in the ap-south-1 (Mumbai, India) region. If you use the app from outside India, your data is transferred to and processed in India. OpenAI and Amazon SES may process data in other regions/countries as part of delivering their services.
Account data (profile, saved questions and answers, subscription plan) is kept for as long as your account exists. Sign-in attempt records (email address entered, IP address, device type, user agent, timestamp, result) support the account-security features in §8. Records linked to your account are deleted together with your account. Records of attempts that match no account (for example, a mistyped email address) are not linked to a user and are kept for security purposes; you can ask us to delete them. OTP codes for password reset and account deletion expire five minutes after being issued and are marked used once redeemed.
You can request account deletion from within the app (Settings). We send a one-time passcode to your registered email to confirm the request; once confirmed, your account, saved questions and answers, login-attempt history, and password-reset/deletion tokens are permanently deleted from our database, and your Amazon Cognito identity is removed. We then send a final confirmation email. This action cannot be undone. See Delete your account for step-by-step instructions.
Passwords are managed by Amazon Cognito, not stored in plaintext by MATHION. Password-reset and account-deletion OTP codes are stored only as bcrypt hashes and expire after five minutes. Repeated failed sign-in attempts lock the account and trigger a password-reset email. New-device or new-location sign-ins trigger an email alert. Our database is encrypted at rest, and the app talks to our servers over HTTPS.
MATHION is designed to be used by students, some of whom may be under the age of majority in their country. If you are below the age at which you can consent to data processing where you live, a parent or guardian should create the account or give consent. If you believe a child's data was provided to us without that consent, contact us and we will delete it. We do not knowingly collect more personal data from a student than is described in this policy, and we do not use student data for advertising.
Depending on where you live, you may have rights to access, correct, or delete your personal data, or to object to certain processing. You can exercise these rights by using the in-app account-deletion flow described in §7, or by contacting support@mathionedu.com.
We may update this policy as the app changes. Material changes will be reflected by updating the effective date above.