Privacy Policy

Last Updated: October 22, 2026 Effective Date: June 5, 2026

1. Introduction

MathbookLM (“MathbookLM,” “we,” “our,” “us,” or the “Company”) respects your privacy and is committed to protecting your personal data.

This Privacy Policy explains how we collect, use, disclose, store, transfer, and protect information when you access or use the MathbookLM website, web application, canvas tools, AI math assistant, account features, subscription features, and related services (collectively, the “Service”).

This Privacy Policy applies to all users. Certain jurisdiction-specific rights apply depending on where you live, including rights under the EU General Data Protection Regulation (“GDPR”), the UK GDPR where applicable, Israel’s Protection of Privacy Law, 5741-1981, the California Consumer Privacy Act as amended by the California Privacy Rights Act (“CCPA/CPRA”), and other applicable privacy laws.

2. Who We Are

For privacy-law purposes, MathbookLM is the controller of personal data collected directly through the Service, except where we process data only on behalf of another party.

Data Controller: MathbookLM Privacy Contact: privacy@mathbooklm.com Security Contact: security@mathbooklm.com Support Contact: support@mathbooklm.com Legal Contact: legal@mathbooklm.com

If MathbookLM is operated through a registered legal entity, the registered legal entity name and mailing address should be displayed in the website footer and account settings.

3. Information We Collect

3.1 Information You Provide Directly

We collect information you provide when using the Service, including:

Account information: email address, Firebase UID, Google OAuth account identifier, account creation date, account settings, subscription tier, and related profile metadata.
Canvas content: drawings, mathematical expressions, equations, diagrams, annotations, notes, uploaded files, and canvas state.
Chat and prompt content: questions, mathematical problems, LaTeX, prompts, conversations, model outputs, and feedback.
Subscription information: subscription tier, plan ID, billing status, renewal status, customer ID, transaction status, invoice references, and payment confirmation data.
Support communications: emails, bug reports, feature requests, refund requests, privacy requests, and other messages you send us.
Preference data: theme, settings, cookie choices, privacy choices, and product configuration.

3.2 Information Collected Automatically

When you use the Service, we may automatically collect:

Device data: browser type, operating system, device type, screen size, language settings, time zone, and approximate location derived from IP address.
Usage data: pages visited, features used, canvas operations, LLM request counts, timestamps, subscription events, error events, and interaction patterns.
Log data: IP address, request path, request timestamp, HTTP status, authentication status, rate-limit events, server errors, and security events.
Cookie and local storage data: essential cookies, optional analytics cookies, browser local storage, and IndexedDB data.

3.3 Information from Third Parties

We receive limited information from third-party service providers, including:

Firebase / Google OAuth: email address, authentication status, Firebase UID, token validation information, and account metadata.
Supabase: database records associated with your account, including canvas, chat, and profile records.
Google Gemini: responses generated from prompts submitted through the Service.
Lemon Squeezy: subscription status, payment confirmation, customer ID, invoice references, tax/VAT details, and billing metadata.
Cloudflare or hosting/security providers: security logs, bot mitigation signals, and network protection data.
Google Analytics / Firebase Analytics: analytics events if you consent to analytics cookies or tracking.
PostHog (EU cloud): product usage events (pages viewed, actions such as solve/explain/ask, sign-in and checkout started). Without consent these are anonymous and cookieless; if you accept analytics cookies and are signed in, they are linked to your Firebase UID, email address and subscription tier.

We do not intentionally collect sensitive personal information unless you choose to include it in your prompts, canvases, uploads, or support messages. Do not enter passwords, API keys, financial account numbers, health information, government IDs, or other sensitive data into MathbookLM.

4. How We Use Information

We use information for the following purposes:

4.1 Service Delivery

Create and authenticate accounts.
Keep users logged in.
Store, load, sync, and back up canvases.
Process AI math prompts and chat messages.
Render mathematical content and LaTeX.
Provide local and cloud-based math tools.
Manage free and paid usage limits.
Provide customer support.

4.2 AI and Mathematical Processing

Send prompts and relevant context to Google Gemini or other configured AI providers.
Generate mathematical explanations, transformations, derivations, and solutions.
Maintain short-term conversation context within active sessions.
Improve reliability, safety, and product quality.

AI-generated results may be wrong. You are responsible for verifying outputs before relying on them.

4.3 Subscription and Billing

Process subscription purchases through Lemon Squeezy.
Confirm plan status.
Apply usage limits.
Manage renewals, cancellations, refunds, failed payments, invoices, taxes, and VAT.
Prevent billing fraud and abuse.

We do not store full credit card numbers.

4.4 Security and Abuse Prevention

Verify authentication tokens.
Enforce rate limits.
Detect suspicious activity.
Prevent unauthorized access.
Investigate abuse, fraud, scraping, spam, or attacks.
Protect users, systems, and service providers.

4.5 Analytics and Product Improvement

If you consent where required, we use analytics to:

Understand feature usage.
Improve onboarding and performance.
Diagnose errors.
Measure conversion and retention.
Test product improvements.
Monitor service reliability.

4.6 Legal Compliance

We may process data to:

Comply with law.
Respond to valid legal process.
Enforce our Terms of Service.
Protect rights, property, and safety.
Maintain tax, accounting, billing, and compliance records.

5. Legal Bases for Processing

For users in the EU, EEA, UK, Israel, and similar jurisdictions, we rely on the following legal bases:

| Processing Activity | Legal Basis | | ----------------------------------- | ------------------------------------------------------ | | Account creation and authentication | Contract; consent where required | | Canvas storage and synchronization | Contract | | AI prompt processing | Contract; consent where required; legitimate interests | | Subscription billing | Contract; legal obligation | | Tax and accounting records | Legal obligation | | Rate limiting and abuse prevention | Legitimate interests | | Security monitoring | Legitimate interests; legal obligation | | Analytics cookies | Consent | | Support communications | Contract; legitimate interests | | Legal requests and disputes | Legal obligation; legitimate interests |

Where processing is based on consent, you may withdraw consent at any time. Withdrawal does not affect processing already completed before withdrawal.

6. Data Storage and Processing Locations

MathbookLM uses third-party infrastructure and processors. Data may be stored or processed in the United States, Israel, the European Economic Area, or other locations where our providers operate.

6.1 Main Storage Locations

| Data Category | Storage / Processor | | ---------------------------------------------- | ------------------------------------------------------- | | Account authentication | Firebase / Google | | Canvases, chats, profiles, subscription status | Supabase Postgres | | Billing and payment records | Lemon Squeezy | | AI prompts and responses | Google Gemini or configured AI provider | | Local canvas state and preferences | Browser IndexedDB / local storage | | Logs and security events | Hosting, server, Cloudflare, or observability providers | | Analytics events | PostHog (EU); Google Analytics / Firebase Analytics, if enabled |

6.2 Local Browser Storage

MathbookLM may store certain data locally in your browser, including:

Canvas drafts.
Drawing state.
Unsynced local changes.
Chat history cache.
User preferences.
Theme and settings.
Cookie consent choices.

Local browser data may be deleted if you clear browser storage, use private browsing, change devices, uninstall your browser, or delete IndexedDB/local storage.

6.3 International Transfers

Where required, we use appropriate safeguards for international data transfers, such as Standard Contractual Clauses, data processing agreements, adequacy mechanisms, or other lawful transfer mechanisms.

By using the Service, you understand that your data may be processed outside your country of residence, including by US-based providers.

7. Third-Party Providers

We use the following third-party providers:

| Provider | Purpose | Data Processed | | ------------------------------------- | ---------------------------------- | ------------------------------------------- | | Firebase / Google | Authentication and OAuth | email, UID, auth metadata | | Supabase | Database and storage | canvases, chats, profiles, account data | | Google Gemini | AI processing | prompts, context, generated responses | | Lemon Squeezy | Payments and subscriptions | billing data, subscription status, invoices | | Cloudflare / hosting providers | Security, hosting, DDoS protection | IP address, request logs, security signals | | Google Analytics / Firebase Analytics | Optional analytics | usage events, device/browser data | | PostHog (EU cloud) | Product analytics | usage events, device/browser data, IP address; UID and email after consent |

Third-party services process data under their own terms and privacy policies. We do not control their independent processing where they act as separate controllers.

8. Disclosure of Information

We do not sell personal data.

We may disclose information:

To service providers that help operate the Service.
To payment processors for billing and tax compliance.
To AI providers to process prompts and generate responses.
To security providers to prevent abuse.
To professional advisers such as lawyers, accountants, and auditors.
To law enforcement, courts, regulators, or government authorities when legally required.
In connection with a merger, acquisition, financing, reorganization, sale of assets, or similar transaction.
With your consent or direction.

We may share aggregated or de-identified information that does not reasonably identify you.

9. Cookies, Analytics, and Tracking

We use cookies and similar technologies as described in our Cookie Policy.

9.1 Essential Cookies

Essential cookies are required for login, authentication, security, fraud prevention, payment checkout, and core service functions. These cannot be disabled through MathbookLM settings.

9.2 Analytics Cookies

Analytics cookies are optional where consent is required. In the EU, EEA, UK, Israel, and other consent-based jurisdictions, analytics cookies are not set unless you accept them. Without consent, PostHog analytics run in cookieless mode and count visits anonymously.

You may disable analytics in Settings → Privacy.

9.3 Do Not Track and Global Privacy Signals

Where legally required and technically feasible, we honor browser-level privacy signals such as Global Privacy Control for opt-out requests related to sale/sharing or targeted advertising. MathbookLM does not sell personal data.

10. Data Retention

We retain personal data only as long as reasonably necessary for the purposes described in this Privacy Policy, unless a longer period is required by law.

| Data Category | Retention Period | | --------------------------------- | --------------------------------------------------------------------- | | Active account data | While account is active | | Canvas and chat data | While account is active; deleted or anonymized after account deletion | | Deleted canvas data | Up to 30 days in backups or soft-delete systems | | Local IndexedDB data | Until cleared by user/browser or replaced by app logic | | Subscription status | Subscription duration plus legal retention period | | Payment, invoice, and tax records | Up to 7 years or longer if required by law | | Server logs | Typically up to 30 days unless needed for security/legal reasons | | Security logs | Up to 12 months where needed for abuse prevention | | Analytics data | Up to 13 months where analytics are enabled | | Support messages | Up to 3 years after resolution | | Legal records | As long as needed for claims, disputes, or legal obligations |

If you delete your account, we will delete or anonymize account data within a reasonable period, generally within 30 days, except where retention is required for legal, tax, billing, security, fraud-prevention, or dispute purposes.

11. Your Privacy Rights

Depending on your location, you may have the right to:

Access personal data we hold about you.
Receive a copy of your data.
Correct inaccurate data.
Delete personal data.
Restrict processing.
Object to processing.
Withdraw consent.
Port your data in a machine-readable format.
Opt out of analytics or certain tracking.
Opt out of sale or sharing where applicable.
Limit use of sensitive personal information where applicable.
Lodge a complaint with a supervisory authority.

You can exercise available rights by emailing privacy@mathbooklm.com.

We may need to verify your identity before fulfilling a request. We will respond within the period required by applicable law.

12. California Privacy Notice

California residents may have rights under the CCPA/CPRA, including:

Right to know what personal information we collect, use, disclose, sell, or share.
Right to access personal information.
Right to delete personal information, subject to exceptions.
Right to correct inaccurate personal information.
Right to opt out of sale or sharing of personal information.
Right to limit use and disclosure of sensitive personal information, where applicable.
Right not to be discriminated against for exercising privacy rights.

MathbookLM does not sell personal information for money. We also do not knowingly sell or share personal information of users under 16.

If analytics or advertising tools are configured in a way that qualifies as “sharing” under California law, you may opt out through Settings → Privacy, cookie controls, or Global Privacy Control where supported.

Categories Collected

In the past 12 months, we may have collected:

Identifiers, such as email address, IP address, Firebase UID, and customer ID.
Commercial information, such as subscription plan and billing status.
Internet or network activity, such as usage logs and analytics events.
Geolocation approximation from IP address.
User-generated content, such as canvases, chats, prompts, and files.
Inferences from usage data for analytics and product improvement.

Sources

We collect data from you, your browser/device, Firebase/Google, Supabase, Lemon Squeezy, analytics tools, hosting/security providers, and AI providers.

Purposes

We use data for service delivery, billing, AI processing, authentication, support, analytics, security, fraud prevention, and legal compliance.

Disclosures

We disclose data to service providers and processors as described in this Privacy Policy.

13. EU, EEA, UK, and Israel Rights

Users in the EU, EEA, UK, Israel, and similar jurisdictions may exercise applicable rights under data protection law.

You may contact your local data protection authority. EU residents may contact their national supervisory authority. Israeli residents may contact the Israel Privacy Protection Authority.

Where required, we will request consent for non-essential cookies and analytics before activating them.

14. Children’s Privacy

MathbookLM is not intended for children under 13.

Users under the age of majority must have permission from a parent or legal guardian. Where a higher age of digital consent applies, you must meet that age or have valid parental consent.

We do not knowingly collect personal data from children under 13 or from children below the applicable age of digital consent without required consent. If we learn that such data has been collected, we will delete it.

Parents or guardians may contact privacy@mathbooklm.com to request deletion.

15. Security

We use reasonable technical and organizational safeguards, including:

HTTPS/TLS encryption in transit.
Managed database security.
Authentication through Firebase.
Access controls.
Server-side secret management.
Rate limiting.
Abuse monitoring.
Payment processing through PCI-compliant providers.
Least-privilege access where feasible.
Backups and recovery procedures.

No system is completely secure. You are responsible for maintaining account security, protecting your devices, and avoiding submission of sensitive secrets into the Service.

16. AI Processing Notice

When you use AI features, your prompts, mathematical expressions, canvas context, uploaded content, and related metadata may be sent to Google Gemini or another configured AI provider.

Do not submit confidential, regulated, or sensitive information unless you are comfortable with third-party AI processing.

AI outputs may be inaccurate, incomplete, or unsuitable for high-stakes use. Always verify results independently.

17. Account Deletion and Data Export

You may export supported account data through Settings → Privacy or Settings → Account, where available.

You may request deletion by using the in-app delete account feature or emailing privacy@mathbooklm.com.

Deletion may not remove:

Payment and tax records we must retain.
Security logs needed to prevent fraud or abuse.
Records required for legal claims or compliance.
Data already anonymized or aggregated.
Data stored by third-party providers under their own retention rules.

18. Marketing Communications

We may send service-related emails, such as account, security, billing, and policy notices.

We will send promotional emails only where legally permitted. You may unsubscribe from marketing emails, but you may still receive transactional or legal notices.

19. Changes to This Privacy Policy

We may update this Privacy Policy from time to time.

For material changes, we will provide notice by email, in-app notice, website notice, or another appropriate method. Where required by law, we will request consent.

The “Last Updated” date shows when this Privacy Policy was last revised.

20. Contact

Privacy requests: privacy@mathbooklm.com Security reports: security@mathbooklm.com Legal notices: legal@mathbooklm.com Support: support@mathbooklm.com