Privacy Notice
Last updated: 28 June 2026
This notice explains what personal data Global Maths Club collects, why we collect it, who processes it on our behalf, how long we keep it, and the rights you have. It covers this website and the Global Maths Club desktop application, together with the account system behind them.
Global Maths Club is currently in a closed, invitation-only beta. During this phase the service is offered to a small, known group for testing and feedback. As the notice shown in the app and on this site states, all data is treated as test data and may be reset at any time, so you should not yet rely on the service to store anything important.
Who is responsible for your data
The data controller for Global Maths Club is DZeta Vision, which operates the service, based in Cameroon.
For any question about this notice or about your personal data, or to exercise one of the rights described below, you can reach us at the address below.
Contact for data and privacy requests: privacy@globalmaths.club
What data we collect
We collect only the data needed to run your account and keep it secure. We do not run advertising, behavioural tracking or profiling, and we do not sell personal data. The categories below reflect what the service actually stores.
Account identity
Your email address, display name, an optional profile image, your role, and whether your email address has been verified.
Retention: For as long as your account exists; removed when the account is deleted.
Profile photo
If you choose to add a profile photo, we store the image you provide so it can be shown as your avatar. Uploads are limited to common image formats (PNG, JPEG or WebP), and before storing the image we remove embedded metadata such as location data and save it in a standard format. On the desktop app a copy is also kept on your own device so your photo shows when you are offline. This is separate from an avatar provided automatically by Google or GitHub, which is only a link and not an image we store.
Retention: Kept until you delete the photo or your account is deleted; deleting it removes the stored image from our servers and from the copy held on your device.
Password
Stored only as a cryptographic hash, never in plain text. If you sign in only with Google or GitHub, no password is stored at all.
Retention: Until you change your password, or your account is deleted.
Sign-in providers
If you choose to sign in with Google or GitHub, the tokens (and their expiry dates) and account identifiers those providers return so we can recognise you on your next visit.
Retention: Until you unlink the provider, or your account is deleted.
Sessions
Records that keep you signed in, including the IP address and the browser or device description of each session. For the admin panel, we also record the time of your last activity to enforce an idle timeout.
Retention: Until you sign out or the session expires (8 hours for the admin panel, 7 days for the desktop app).
Email verification and password reset
Short-lived entries used to confirm your email address or reset your password. Reset tokens are stored only as a hash. Verification links expire after one hour; reset links after 30 minutes and can be used only once.
Retention: Removed once they expire or are used.
Security audit log
An append-only record of security events such as sign-ins, failed sign-ins, account lockouts, password changes and resets, and role changes. Each entry notes the action, the acting account with its email and role, an IP address and browser description, and a timestamp. It never contains passwords or tokens.
Retention: Kept for a minimum of 90 days.
Crash and error diagnostics
When the website or the desktop app hits an unexpected error, a diagnostic report is created so we can detect and fix faults. It describes the error and basic technical context such as the app version and operating system. It is configured not to include personal data, and known sensitive values are removed before it is sent to our error-monitoring provider.
Retention: Kept by our error-monitoring provider only as long as needed to diagnose faults.
Who processes data for us
We rely on a small number of trusted service providers to run the platform. Each one processes data only to deliver its part of the service, and only on our instructions.
Cloudflare
Hosts this website and the admin service, delivers pages, and provides bot protection and rate limiting. It also stores the profile photos that users upload. It sees the IP address of each request.
SurrealDB Cloud
The database that stores the account and security data described above.
Sentry
Receives the crash and error diagnostics described above, from this website and the desktop app, so we can detect and fix faults. The reports are configured not to include personal data and have known sensitive values removed before they are sent. Operated by Functional Software, Inc. (trading as Sentry) in the United States, with data stored in its European (Germany) region.
Resend
Sends transactional emails such as email verification and password reset, from noreply@send.globalmaths.club. It receives the recipient address and the message content. Operated by Plus Five Five, Inc. (trading as Resend) in the United States, under a data processing agreement and the EU Standard Contractual Clauses.
Google and GitHub
Optional sign-in providers, used only if you choose to sign in with one of them, in which case they confirm your identity to us.
Have I Been Pwned
During a password reset, checks whether a chosen password has appeared in a known data breach. Only the first five characters of a one-way SHA-1 hash of the password are sent, never the password itself.
Where your data is processed
Our service providers operate internationally and are based outside Cameroon, primarily in the United States and Europe. This means the personal data described above is transferred to, and processed in, countries other than the one you live in. For users in the European Economic Area, this includes transfers outside the EEA.
We rely on established providers that offer standard data-protection terms for international transfers. Formal transfer agreements covering every provider are part of the data-protection work we are still completing for the closed beta. If you have a question about where your data goes, you can reach us at the address below.
Why we are allowed to use your data
For users in the European Union and in regions with similar laws, we rely on the following legal bases under the General Data Protection Regulation (GDPR).
- Creating and running your account, signing you in, and managing your password.
- Legal basis: Performance of a contract: providing the service you asked for.
- Confirming your email address.
- Legal basis: Your consent, given when you sign up and ask us to verify your address.
- Keeping the service secure: the audit log, account lockouts, security alerts, and ending sessions when needed.
- Legal basis: Our legitimate interest in protecting the service and its users from abuse.
- Remembering your language choice.
- Legal basis: A functional preference that does not require consent (see Cookies below).
Cookies
This website sets a single cookie, named gmc-locale. It stores only your language choice (en or fr) so the site shows you the right language when you return. It holds no identifier, is never used for tracking, advertising or analytics, and is not shared with anyone.
Because it is a functional preference that you set yourself with the FR / EN toggle, it does not require consent under EU rules. You can clear it at any time through your browser settings.
How your data is protected
We treat security as a priority. Passwords are stored only as cryptographic hashes and never in plain text. Connections to the site and service use HTTPS. Sign-in relies on signed tokens, repeated failed sign-in attempts progressively lock an account to slow down guessing, and security events are written to an append-only audit log. We describe only measures the service actually uses, and we do not claim certifications we do not hold.
Closed beta and your data
Global Maths Club is in a closed beta. During this phase the service and its data are not final: accounts and stored data may be reset as part of testing, and a full reset is planned before the first general release. Please do not store anything you cannot afford to lose. Where we reasonably can, we will give invited beta users notice through the service before a planned reset.
Younger users
Global Maths Club is built for a community of mathematics learners that includes minors. During the closed beta we invite only a small, known group. Full mechanics for parental involvement, and for younger users to exercise their data rights, are part of the data-protection work we are still building and are not yet provided in the app. If you are a parent or guardian, or a young user, and have any question or request about personal data, please contact us at the address below and we will handle it directly.
Your rights
If you are in the European Union, or in a region with similar laws, you have the right to ask for a copy of the personal data we hold about you, to have it corrected, to ask us to delete it, to object to or restrict certain uses, and to receive it in a portable form.
You also have the right to lodge a complaint with your data protection authority (for example, the CNIL in France) if you believe we have not respected your rights.
During the closed beta these requests are handled manually rather than through self-service tools: full automated data export, erasure and consent-management features are not yet built and are planned for a later stage. To exercise any of these rights, contact us at the address below and we will act on your request. Where our security audit log must keep a minimal record of an event for a limited period, we will tell you if that affects a deletion request.
We aim to follow the principles of the GDPR. We do not claim formal certification, or that every mechanism the regulation envisages is already in place; this notice describes the current, honest state of the closed beta.
Changes to this notice
We may update this notice as the service grows, for example when a new feature or provider is added. The date at the top shows when it was last changed. Material changes will be reflected here and, where appropriate, signalled in the service.
Contact
For any privacy question, or to exercise a right described above, contact DZeta Vision, the operator of Global Maths Club, at: