Privacy
policy.

What we collect

• Enrollment data: name, WhatsApp number, email, district, school, stream/batch, guardian contact for under-18 students.
• Account data: authentication identifiers (email / Google profile via Firebase Auth) and a unique user ID (UID).
• Academic data: diagnostic results, tute completion, mock exam scores, attendance and progress notes.
• Usage data: LMS lecture views, app crash logs, and basic device/locale information.
• Payment references: transaction IDs and amounts — card details never touch our servers (handled by the payment provider).

Why we use it

Your data is used solely to run the classes: to place you in a batch, deliver and mark materials, track progress, send schedule and fee notifications, and improve the teaching product. We do not sell student data, and we do not use academic records for advertising. Progress summaries for under-18 students are shared with the registered guardian as part of the service.

Firebase Authentication & infrastructure

MathDOC X uses Google Firebase for authentication (Firebase Auth), application data (Cloud Firestore), and file delivery (Firebase Storage / Hosting). When you sign in, Firebase processes your credentials under the Google Firebase privacy terms. We store only the UID and profile fields needed for the service in our own Firestore collections. Account deletion removes the Firebase Auth record; see the deletion page for the full flow.

Who we share it with

• Service providers: Google Firebase (auth/data/hosting), payment providers, WhatsApp/email delivery — each only to the extent needed to operate the service.
• Guardians: progress data of under-18 students, as a core feature.
• Legal obligations: where required by Sri Lankan law or a valid legal order.
• We never share identifiable student data with advertisers or data brokers.

Retention

Active-student data is retained for the duration of enrollment. After your final exam cycle, academic records (scores, attendance) are kept for up to 3 years for certificate verification and cohort analytics, then anonymised or deleted. Enquiry records are deleted after 12 months of inactivity. Account deletion requests are processed as described in Section 06 and on the deletion page.

Your rights

• Access: request a copy of the personal data we hold about you.
• Correction: ask us to fix inaccurate details at any time.
• Deletion: permanently delete your account via the deletion page or by email.
• Objection: opt out of non-essential communications (schedule and fee notices are essential).

Exercise any right by writing to privacy@mathdocx.lk. We respond within 30 days. For students under 18, requests may be made by the registered guardian.

Students under 18

Most A/L students are minors. Enrollment of under-18 students requires guardian consent, collected at registration. We limit minor data collection to what the service strictly needs, never target advertising at minors, and route all progress communication through the registered guardian.

Security & local storage

Data is transmitted over TLS and stored in Firebase with Google's infrastructure security. Access is restricted to the teaching and coordination team on a need-to-know basis. The website and app use browser/app local storage only for session persistence (e.g. keeping you signed in, remembering the pending deletion email) — no third-party tracking cookies are used on this site. No system is perfectly secure; report suspected incidents to privacy@mathdocx.lk immediately.

Changes & contact

We may update this Policy; the current version is always on this page with its revision date, and material changes are notified to enrolled students by email or WhatsApp. Data controller: MathDOC, Colombo, Sri Lanka — operated by Rajika Wimalarathne. Contact: privacy@mathdocx.lk or +94 71 000 0000.