Privacy policy

Last updated: 14 September 2026

CalcuBoss is a mental maths app for children aged 6 to 11. It was designed to work without collecting personal data. This page explains, in plain language, what is stored, where, and how to delete it.

1. Who is responsible?

CalcuBoss is published on a non-professional basis (see the legal notice). For any question about this policy or your data, write to contact@calcuboss.com.

2. What CalcuBoss does not use

• No account, email address or phone number is requested.
• No advertising.
• No cookies, so there is no consent banner.
• No analytics, statistics or tracking tools, and no advertising pixels.
• No scripts, fonts or images loaded from other websites: everything is served by calcuboss.com.
• No selling, renting or sharing of data.

3. Data stored on the device

So that children can pick up where they left off, CalcuBoss stores the following in the browser’s local storage (localStorage, under the key calcuboss):

• profiles: the first name or nickname chosen by the child, avatar, grade and theme;
• stars, points, trophies and day streaks;
• answer statistics: facts mastered or to review, response times and play time;
• app settings (language, voice, sounds…) and, if you turn it on, the family sync code.

Reading handwriting on the whiteboard (✍️ button) happens entirely on the device: no drawing is sent or kept.

This data stays on the device: it is not sent to any server unless you turn on the sync feature described below. We have no access to it.

In the Parents’ area you can export progress to a file at any time, import it on another device, reset a profile or delete it.

Clearing the site’s browsing data (or uninstalling the app) permanently deletes this information, so export progress first.

To work offline, the browser also keeps a copy of the app’s files (text, images, code). This cache contains no personal data.

4. Family-code sync (optional)

By default, nothing is sent. If a parent turns on sync in the Parents’ area to use progress on several devices:

• progress is encrypted on the device before anything is sent, using AES-GCM with a key derived from the family code (PBKDF2);
• the server only stores this encrypted blob, a random identifier derived from the code (SHA-256 hash) and the times it was created and last updated;
• the server cannot read names or progress;
• the encrypted data is stored with Cloudflare (Cloudflare D1 database), with a “Western Europe” location hint;
• the encrypted copy is kept for as long as you use sync, and you can delete it from the server at any time in the Parents’ area;
• if the family code is lost, synced data cannot be recovered, neither by you nor by us.

Keep the family code to yourself: anyone who knows it can load the synced progress on another device.

Legal basis: performance of the service you request by turning on sync (Article 6(1)(b) GDPR).

5. Reading aloud

Questions and instructions are read by the speech-synthesis voices of the device or browser (the browser’s “Web Speech” feature). CalcuBoss itself sends no text to any server, but some voices are online services:

• Microsoft Edge “Natural” or “Online” voices: the text being read (for example “7 times 8”) is processed by Microsoft;
• Google voices in Chrome: the text being read is processed by Google;
• voices installed on the device (iPad, iPhone, many Android voices, offline Windows or macOS voices): everything happens on the device.

In CalcuBoss settings you can pick a different voice or turn off automatic reading of questions.

6. Answering out loud

The “answer out loud” option is off by default. If you turn it on, the browser asks for permission to use the microphone, then uses its own speech recognition:

• in Chrome and Edge, the audio may be sent to Google or Microsoft for transcription;
• in Safari, transcription is handled by Apple, on the device or on Apple’s servers depending on the model.

CalcuBoss records no audio: only the recognised number is used to check the answer, and it is then discarded.

7. Hosting

The website and app are hosted and delivered by:

Like any host, Cloudflare processes technical connection data (IP address, browser type, pages requested) to deliver the site and protect it against attacks. CalcuBoss does not use this data to measure audiences or identify visitors. Legal basis: legitimate interest in providing a reliable and secure website (Article 6(1)(f) GDPR).

As Cloudflare is a US company, data may be processed outside the European Union. Cloudflare is certified under the EU–U.S. Data Privacy Framework and relies on the European Commission’s Standard Contractual Clauses. See Cloudflare’s privacy policy.

8. Children

CalcuBoss is designed for children aged 6 to 11 and requires no personal data. We recommend that parents help the child choose a nickname rather than their real first name. The Parents’ area is protected by a question meant for adults.

9. Your rights

The General Data Protection Regulation (GDPR) gives you the rights of access, rectification, erasure, restriction, objection and portability. Since CalcuBoss holds no data that identifies you, apart from the optional encrypted copy, these rights are mostly exercised directly on the device:

• access and portability: export progress from the Parents’ area;
• rectification: change the nickname, avatar or grade in the settings;
• erasure: delete a profile in the Parents’ area, or clear the site’s data in the browser;
• synced copy: delete it from the server in the Parents’ area.

Without the family code we can neither find nor read synced data: that is what protects it. For any question or request, write to contact@calcuboss.com.

You can also lodge a complaint with the French data protection authority, the CNIL: www.cnil.fr.

10. Changes

If this policy changes, for example when a new feature is added, this page will be updated along with the date above.