Privacy Policy
Effective date: 29 September 2026 · Version: 2.0 · Last updated: 3 October 2026
These documents have not yet been reviewed by a lawyer.
Who we are
Le Codex is a mathematics practice service from Atelier de Maths, operated by Atelier de Maths LLC, a Wyoming limited liability company (filing number 2026-002090203), 30 N Gould St Ste N, Sheridan, WY 82801, USA. Atelier de Maths LLC is the controller of the personal data described here: it decides why and how that data is used.
Contact for anything about your data: privacy@atelierdemaths.com. This address also reaches our data-protection contact (for Brazil, our encarregado).
Who can use Le Codex
Le Codex is for students aged 13 and over.
- Under 13: we don't accept anyone under 13. The age check happens before an account or any personal data is created, so nothing is stored about a child we turn away.
- If you are under 16, a parent or guardian must give permission before your account can be used, and we record their email address with that permission. We do not yet email them automatically. Until we do, you should tell them yourself that you have an account, and they can write to us at any time at the address below to see what we hold or to have it deleted.
- 16 and 17: students sign up themselves.
- 18 and over: students sign up themselves.
What we collect, and what we don't
We collect only what the service needs.
| Data | Why |
|---|---|
| Email address and a sign-in credential: a password, which we store only as a secure hash, or a sign-in token from a provider you choose (Google, Microsoft or Discord) | So you can sign in |
| Month and year of birth (not the day) | To apply the right age rules, including when you move from one age band to the next |
| Parent or guardian email (under-18s only) | For the consent or notice described above |
| Consent records: what was agreed, which version of our terms, and when | Legal proof |
| Learning data: questions you see, your answers, mastery and readiness estimates, practice papers and your study plan | This is what makes Le Codex teach |
| Security and technical data: sign-in session data, and short-lived server logs (IP address, browser type, time) kept to keep the service running and secure | Security and reliability |
We do not collect: your school, phone number, home address, photos, or payment card details. There's also no personality or "learning style" profile: we removed it.
The free diagnostic
The public diagnostic works anonymously. It needs no account, sets no persistent identifier, and stores nothing linked to you. Saving results means creating an account, which goes through the age check first.
Why we use your data (legal bases)
Where the GDPR, UK GDPR or Brazil's LGPD applies:
| Purpose | Legal basis |
|---|---|
| Providing Le Codex: your account, practice, estimates, papers | Contract with you. For users under 16, provided only with a parent's confirmation (GDPR Art. 8) |
| Age checks, consent records, answering your rights requests | Legal obligation |
| Keeping the service secure and preventing abuse | Legitimate interests |
| Service emails (password reset, consent requests, important changes) | Contract / legal obligation |
We never sell personal data, show adverts, build advertising profiles, or let anyone train general-purpose AI models on identifiable student data.
Automated estimates
Le Codex calculates mastery and readiness estimates automatically from your answers. They're study aids only. They have no legal effect, and no decision about you is made by them. You can ask us to explain an estimate.
Who processes data for us (sub-processors)
The current list, with each company's role and location, is on our Sub-processors page. In short:
- Supabase stores our database and handles sign-in, in Frankfurt, Germany (EU).
- Railway runs the application servers, in the Netherlands (European Union).
- Resend sends our emails from Ireland (EU). It keeps email metadata and delivery logs in the United States.
Each works under a data-processing agreement.
International transfers
Our database is in the EU. Our email provider keeps delivery records in the United States. Where data leaves the EU/EEA, UK or Brazil, we rely on the safeguards in each provider's data-processing agreement, such as the EU Standard Contractual Clauses and their UK and Brazilian equivalents, or on an adequacy decision.
How long we keep data
See the retention schedule (part D, published as its own section). In short:
- your account and learning data are kept while your account exists;
- deleted within 30 days after you delete your account or ask us to;
- deleted within 7 more days from our backups.
Your rights
Wherever you live, you can:
- access your data;
- download a copy (export);
- correct it;
- delete it;
- object to some uses;
- withdraw consent at any time.
Export and deletion are available in your account settings. For anything else, write to privacy@atelierdemaths.com. We answer within one month, or sooner where the law requires. A parent or guardian of a student under 18 can contact us about their child's data.
You can also complain to a data-protection authority, for example:
- your EU country's authority;
- the UK Information Commissioner's Office;
- Brazil's ANPD;
- the US Federal Trade Commission or your state's authority.
Security
- Passwords are hashed.
- Students can't see each other's data: this is enforced both by the application and by the database's row-level security.
- Sensitive learning data is encrypted.
- Deleting an account destroys its encryption key, so the data becomes unreadable, not just hidden.
- Administrative access needs a hardware security key, and access to personal data is logged.
- If a breach affects your data, we'll tell the relevant authorities and you, as the law requires (within 72 hours for regulators under the GDPR).
Cookies and storage
We use only what's essential to keep you signed in and secure. There are no advertising cookies, no third-party trackers and no analytics cookies. Our usage statistics are counted inside our own system, under a random number that is not your account and holds no content, no IP address and no device details. We keep each event for 13 months and then only monthly totals, and when you delete your account the number goes too, so what remains cannot be linked to you. Nothing tracks you across sites. So there's no cookie banner, because there's nothing optional to accept.
Payments
Le Codex is currently free, and we take no payment details. If paid plans open, payment will be handled by our reseller, Paddle, which acts as the seller (merchant of record). For students under 18, a parent or guardian will make any purchase. We'll update this policy before that happens.
Changes
When we change this policy we update the version and date. For important changes, we ask you (and, for under-16s, your parent or guardian) to review and accept again before continuing.
Retention schedule
| Data | Kept for | Then |
|---|---|---|
| Account and learning data | While the account exists | Deleted within 30 days of account deletion or a deletion request (encryption key destroyed) |
| Database backups | 7 days (Supabase Pro daily backups) | Rolled off automatically, so deleted data leaves backups within 7 more days |
| Declined or withdrawn consent | Account deleted immediately through the erasure path | |
| Parent or guardian email | While the student is under 18 and the account exists | Deleted with the account |
| Security audit log | Until the application server is next updated, at most 13 months | Deleted |
| Usage statistics (counted inside our own system) | 13 months, then monthly totals only | Deleted; the totals hold no link to anyone |
| Server and request logs (hosting provider) | As set by the provider | Deleted by the provider |
| Email delivery logs (Resend) | As set by the provider | Deleted by the provider |
| Aggregate usage statistics (no personal data) | Indefinitely | |
| Future: purchase records | Held by Paddle as merchant of record; our own records per tax law |
Contact
Atelier de Maths LLC, a Wyoming limited liability company (filing number 2026-002090203), 30 N Gould St Ste N, Sheridan, WY 82801, USA. privacy@atelierdemaths.com
← Back to sign upAtelier de Maths is not affiliated with or endorsed by the International Baccalaureate Organisation (IBO). All content is original and created independently for examination preparation.