Privacy & your data

Longhand Math is a teacher-created math practice service. We use account and learning information to provide worksheets, review submitted math, show progress, and protect family accounts. We do not sell personal information or use it to target advertising.

For support, privacy questions, corrections, or deletion requests, email support@longhandmath.com. This inbox is monitored by the Longhand Math operator.

Request account deletion

Children use learner profiles managed by an adult. Learners do not need an email address or legal name. Adults control access, photo retention, and deletion. Please do not put unrelated personal information in worksheet photos or learning notes.

The optional interest list is for adults who want Longhand Math availability and launch updates. We save your email address, signup time, and the version of your consent separately from learner records. Signing up does not create a family account, start a subscription, or request any student information. Repeated signups do not create additional subscriptions.

Interest-list addresses are accessible only to the site operator. This form does not send your email to an AI provider, advertising service, or email marketing platform, and does not send an automatic confirmation email. We keep your email until you request removal or we close the list. The operator can export the list for the updates you requested or remove an address on request. You can request removal at support@longhandmath.com or reply to an update; future marketing emails will also include an unsubscribe option.

To limit automated submissions, we temporarily keep keyed, hashed network identifiers and request times. These records stop counting after one hour and are cleared on the next valid submission. The interest-list database does not store raw IP addresses. Ordinary hosting request logs and the hosted volume’s one-day backup retention are separate from this list.

An adult account is required for family records. Each learner belongs to one household, and every learner, edition, answer key, photograph, upload status, correction, and deletion action is checked against the signed-in adult’s current permissions. Learners do not need an email address. The adult may use a nickname or family-chosen label instead of a learner’s legal name.

A household owner can invite another adult into the household, or share access to an individual learner. Household membership and its role determine access across that household. For individual-learner sharing, view access includes that learner’s progress and student worksheets. Helper access also includes work photos, answer keys, uploads, and learning decisions. Neither role gives access to siblings or permission to invite others, reset or delete the learner, or change profile and privacy settings. Invitations are tied to the recipient’s email, expire after 72 hours, and can be used once. The recipient signs in with their own account. Only a hash of the invitation code is stored. The owner can cancel a pending invitation or remove shared access. Previously downloaded or printed copies remain with their recipient.

Passwords are stored as salted password hashes. Browser and mobile session tokens are random; only hashes of those tokens are stored. This pilot has no public registration. Do not share an adult password with a learner.

Claude Code access is off for every learner unless the household owner turns it on, one learner at a time, from that learner’s Settings view. While it is on, a Claude Code session the owner starts with an access token the owner created can read that learner’s profile (nickname, grade, course and pace), learning goal, including any test name and date, and school-year end; every paper and its answer key; photos of finished pages and the upload history; what Longhand read on each page, including the reading model’s raw output, the check-ins and the notes in the adult box; any corrections; progress, standards, and the plan for the next paper. Whatever a session reads becomes part of that session’s conversation with Claude, Anthropic’s AI, under the owner’s own Claude account rather than this service’s model connection. Anyone holding a token could use it the same way, so it is shown once, only a hash of it is stored, it expires within 90 days, and the owner can revoke it at any time. A token cannot upload new photos, request new AI grading, change profile settings, delete records, or reach a learner whose owner has not enabled access. If the owner also grants remapping permission, it can re-check saved answers under the current rules and re-plan an unworked paper. Turning access off stops it at once. Each switch change and each request a token makes is recorded and shown to the household; the request log is kept for 180 days or until the learner is deleted.

A separate support login can search adult account names and email addresses, suspend or reactivate logins, sign out devices, and enable beta feedback. To keep accounts tidy, it also lists the learners each adult account holds or has been shared: each learner’s nickname, grade level and course, the date they were added, how many papers were issued, and whether a deletion is scheduled. It cannot open learner worksheets, work photos, answers, results or progress, change a learner’s profile, or obtain another adult’s password. The service operator’s authorized server maintenance access is separate from this limited support login.

Enabled adult beta testers can submit app feedback as text or photographs of the dedicated beta feedback sheet. Its QR code opens an account-protected form and contains no learner identifier. These submissions are separate from learning records and never change a student’s progress or lessons. Do not include learner names, schoolwork, passwords, or other private information in feedback.

Feedback includes its category, app surface, submission time, status and optional app version information. Submitted photos are normalized and stripped of source metadata. Feedback text, images and prepared review batches expire within 90 days; expiration is enforced on access and the next maintenance pass. Verified account deletion also removes that account’s feedback and affected review batches. Support account actions are recorded for account security and removed or de-identified when the associated account is deleted.

The support inbox can view product feedback and explicitly prepare selected submissions for a Codex or Claude Code review. Submitting feedback does not call an AI service. A prepared ZIP excludes structured account email fields and learner records, but freeform text and photos can still contain information a tester has included. The operator must inspect those contents before sharing the batch with a coding session. Any uploaded batch then follows the coding service account’s own retention settings. Downloaded copies outside Longhand are not removed by deleting the server copy.

Adult account records include an email address, chosen display name, salted password hash, account identifier, household memberships, invitations, and sign-in sessions. We keep account records until account deletion. Security controls use limited sign-in attempt information, including hashed email and network identifiers, to limit repeated attempts.

The hosted pilot stores authorized family records in its private server data folder. Records include the learner profile, editions and separate answer keys, upload job status, grading readings, corrections, page check-ins, skill and standards progress, parent confirmations, pacing history, and limited operation metadata needed to prevent duplicate work. Learner profiles can include a nickname, grade, course, pace, school-year end, and learning goals, including an optional test name and date.

The mobile app temporarily saves PDFs or worksheet page images in its private cache to show a preview or open the print/share menu. Preview copies are removed when the preview closes. iPhone print/share copies are removed when the menu closes. Android print/share copies are scheduled for removal after five minutes so the selected app has time to read them; if Android suspends Longhand, cleanup resumes when Longhand runs again. Both versions clear this cache at app startup and sign-out. If the app stops unexpectedly, a temporary copy can remain until the next startup or until the phone clears its cache. A PDF you choose to save or share outside the app remains in that chosen destination.

Before a photograph is saved to application storage or sent for feedback, the server corrects its orientation, resizes it to a bounded size, converts it to an RGB JPEG, and omits EXIF, location, comments, and other source metadata. Original upload bytes may pass through temporary upload buffers, but are not kept as durable application records. After a page is read, its temporary normalized photograph is removed as soon as its durable learning record no longer needs the image. A page that is paused, fails before a usable reading, or needs an adult check remains available only until it is resolved or reaches the 72-hour active-storage limit. Accepted math readings and progress remain until the adult deletes the learner.

A private photo record is kept for each learner so a worksheet and the pages of work done on it stay together. It is on unless an adult turns it off, and turning it off deletes every saved copy at once. When enabled, worksheet photos are saved for a rolling 365 days from the original capture save time. A page whose reading failed is saved too, so it can be read again rather than being removed by the 72-hour limit before anyone can retry it. Re-uploading the same image does not extend that period. These copies let a family see the work behind a standard being confirmed or reopened. They are visible only through an account authorized to access that learner, or to a Claude Code access token while the household owner has turned that access on for the learner. Only a household adult can change the portfolio setting or delete saved photos. Turning the portfolio off deletes its saved image copies immediately; individual photos can also be deleted. Deleting an image keeps the math reading and progress record, with a clear notice that the image is no longer available. Already deleted or expired photos are not recovered.

A future worksheet may include a cropped earlier attempt beside a correction or an explanation of how to start. These images come only from still-available photos in the learner's private photo record. Accounts without permission to view photos receive the same practice in a photo-free PDF. Deleting a source photo, turning off the photo record, or reaching its retention limit removes the linked photo versions from server worksheet downloads and previews; the photo-free worksheet remains available. Printed copies and PDFs already saved or shared outside Longhand cannot be recalled.

A photographed page can still contain names or other details written on the paper. Keep the camera frame focused on the math and avoid unrelated personal information.

An adult can also attach a cropped piece of work directly to a California standard after confirming private retention. These submissions are normalized to remove image metadata and saved for up to 365 days from their first save. They are labeled as unreviewed, are not sent to an AI provider by this feature, and do not automatically change progress. They can be viewed only by accounts with access to that learner, included in the learner’s export, or deleted by an adult. Turning the portfolio off or deleting the learner removes these image copies too.

Normalized captures use the same private mounted volume as the active database and PDFs so a queued or explicitly paused submission can survive a machine restart. Reviewed temporary copies are removed under the rule above; the maintenance sweep removes expired temporary copies after 72 hours. Portfolio copies, which are enabled by default, follow the separate 365-day limit and can be deleted sooner by an adult. The Fly.io volume is encrypted, with automatic snapshots configured for one day of retention. Backup blocks can therefore outlive active-store deletion until the snapshot expires. Cleanup can be delayed during a service outage. The pilot does not offer a family backup or restore service.

When enabled, AI processing can identify which worksheet a photo belongs to, review handwritten math, and identify topics in schoolwork submitted for planning. Requests include the relevant photo and, for review, problem text and computed answers or adult-review criteria. We do not deliberately add adult names or account emails to these requests. Visible names, handwriting, printed codes, and notes on the photographed paper can still be present.

Longhand prints one of those itself: most worksheet pages carry, in their header, the name label an adult chooses for the learner in Settings (a first name, an initial, a code name, or nothing), so that label is visible in the photographs sent for reading. Choose a code name or leave it empty to keep a name off the paper. And when an adult writes on the note line of the adult box, which Starting Point pages carry and older weekly papers carried too, the reading transcribes it and Longhand stores it with that page’s reading.

The configured provider is Anthropic, using its API with United States inference. For feedback, the server sends the normalized photograph and its matching computed answer key or adult-review criteria to Anthropic. A regional or provider failure stops the request; it does not fall back to another region or provider.

Anthropic deletes API requests and responses, including photographs, within 30 days of receiving or producing them. Longhand has no zero-data-retention arrangement with Anthropic, and those 30 days cannot be shortened from Longhand’s account. Requests and responses that Anthropic’s automated trust-and-safety systems flag may be kept for up to 2 years, and their trust-and-safety classification scores for up to 7 years. Data may also be kept where the law requires. These exceptions apply even to accounts with zero data retention. While it keeps them, Anthropic may access retained requests and responses for safety and security purposes; people at Anthropic see customer content only for safety review or incident response. See how long Anthropic stores API data, Anthropic’s API data retention, Anthropic’s access to retained data, and Anthropic’s access transparency.

Anthropic’s Commercial Terms, effective June 17, 2025, say Anthropic “may not train models on Customer Content from Services.” An optional Development Partner Mode would change that; Longhand keeps it off. Longhand never sends worksheet pages to Anthropic as feedback or a bug report, which Anthropic keeps for 5 years.

Requests ask for United States inference, so the model runs in the United States, and Anthropic stores commercial data there: pages are read and stored in the United States. Anthropic may still process data in other countries where it operates for internal purposes such as safety review, product support, or incident response. See where Anthropic stores data and Anthropic’s data residency controls.

Under Anthropic’s Data Processing Addendum, which is part of its Commercial Terms, Longhand is the controller of this information and Anthropic is its processor. Anthropic encrypts data at rest (AES-256) and in transit (TLS 1.2 or later), and commits to notify Longhand of a security breach within 48 hours.

Deleting a learner removes their worksheets, their saved page photographs, every reading and record taken from them, and their profile. What remains is a count of how many records were removed, under a fresh random reference that is not linked to the learner. Deleting a learner here cannot override information a provider is independently required to retain.

Deleting a learner, a saved photo, or a scanned page, or turning the photo record off, removes Longhand’s copies on the schedule this page describes. Longhand’s own retention periods do not change with the AI provider. The AI service that read a page may still keep a copy under its own policy, and Longhand cannot shorten how long any such copy is kept or delete a single page from it:

• Anthropic. Anthropic deletes the pages it reads, and its replies, within 30 days. Pages its automated safety systems flag can be kept for up to 2 years and their safety scores for up to 7 years, and the law can require longer. How long Anthropic stores API data; Anthropic API and data retention.
• OpenAI. OpenAI may keep the pages it reads in abuse-monitoring logs for up to 30 days, and legal requirements, caching, image safety review and project settings can still apply. OpenAI’s data controls.

Before you confirm a deletion, Longhand names the services that read those pages, from its own records of each reading, and what each may still keep. When its records cannot name the service that read a page, it names the service Longhand was using when the page went out, or every service it has used when that date is unknown, as one that may have. Nothing extra is shown when no page was sent for reading. These provider summaries were checked on October 20, 2026.

1. The household owner starts deletion from the learner’s data page. New grading, planning, and pacing changes pause immediately.
2. The owner can cancel for three days or choose immediate permanent deletion. Both steps name the AI services that read the learner’s pages and what each may still keep (see When you delete).
3. After the deadline, the server removes the profile, normalized photographs, editions, findings, revisions, check-ins, mastery, standards confirmations, portfolio copies and settings, pacing records, consent record, and upload job records during its next maintenance sweep.

Deleting a learner does not delete the adult’s login. To remove that as well, request account deletion.

A deletion audit keeps a new random audit reference, time, and record counts without worksheet content. The reference is created during deletion and is not derived from the learner label or internal learner ID. Hosted backups follow the one-day snapshot setting described above. Printed pages and copies downloaded or backed up outside Longhand Math remain outside the pilot’s control.

The website uses necessary sign-in and form-security cookies. It serves its fonts from the application itself. We have not installed Google Analytics, Meta advertising pixels, Cloudflare Web Analytics, or another advertising or behavioral analytics integration.

The site counts visits to its public pages itself: the home page, about, this privacy page, account deletion, the interest-list pages and the blog, when no one is signed in. Family, learner and support pages, and anything seen while signed in, are never counted. For each day it keeps the number of page views per page, the domain of another site a visit came from (or a utm_source tag on the link), never the full address of that page, and an approximate number of visitors. To count a visitor once per day, the site combines the network address and the browser’s user-agent string with a random value that exists for that day only, and keeps the resulting code instead of either. When the day ends (Pacific time), that day’s codes and random value are deleted at the next visit or routine cleanup, so a visitor cannot be recognized from one day to the next, and no address or user-agent string is stored. Requests from programs, whether they identify themselves (such as search engines and link previews) or only claim to be a browser without sending what a browser sends with a page request, are only totaled. No cookie is set, no script runs in your browser for this, and nothing about any visitor is shared with anyone. Each morning a summary of these totals (views and visitors for the previous day, week and month, interest-list signup counts, the five most-viewed public pages and the domain names of the five sites most visits came from) is emailed to Longhand Math’s owner through Resend, an email delivery service. That email never contains anything about a visitor, an email address, an IP address or a link’s utm_source tag (a tag naming a well-known site, such as instagram, is counted under that site’s domain); another site appears in it only by its registered domain name, such as example.com, never by a name in front of it, so a site hosted on a shared platform, such as a blog, appears only as the platform. The site keeps its copy of each email as long as the daily totals. Daily totals are kept for 400 days.

The site footer links to Longhand Math’s own Instagram and Facebook pages. They are ordinary links: nothing from either service loads on our pages, and nothing is shared with them unless you follow a link, after which their own privacy policies apply.

The site is hosted on Fly.io, and Cloudflare manages its public domain and DNS. The hosting service handles network information such as IP addresses and request metadata to deliver and protect the site. Infrastructure operational logs are separate from learning records.

The mobile app uses Expo’s update service to check for and deliver app updates. Expo receives a random installation identifier and technical information such as operating-system and app/update versions. This is for delivering software updates; it is not an advertising identifier. See Expo’s privacy explanation and privacy policy.

If an adult enables mobile notifications in a supported build, the server sends Expo the device notification token and generic status copy such as “The next paper is ready”; it does not put a learner label, photograph, answer, or math reading in that push message. Android test build 2 does not register for push notifications.

Support and deletion-request emails are handled through our Zoho-hosted support mailbox and include whatever you choose to send. We use these messages to answer the request and verify account control. Do not email passwords, API keys, or student photos. Tell us if you also want the support correspondence removed.

Routine application messages omit learner labels, photograph content, credentials, prompts, and provider error bodies. Unexpected framework or filesystem errors may include opaque random internal record IDs; access to those operational logs is limited to the pilot operator.