Privacy Policy
Last updated April 20, 2026
1. Who We Are
NumFox is operated by Carajillo Solutions LLC, a Texas limited liability company ("we," "us," or "our"). Contact: privacy@caraji.io | Carajillo Solutions LLC, 13423 Blanco Rd, San Antonio, Texas 78216
2. Information We Collect
From parents and guardians
- Email address: for authentication and transactional communications
- Name (optional): used in account settings
- Payment information: processed by Stripe, Inc. We receive a Stripe customer ID and payment metadata (last four digits, card type, billing country) but never your full card number
- IP address and browser/device information: collected automatically with each session
- Magic-link tokens: single-use, expire in 15 minutes, not stored after use
From or about children (created by parent)
- Nickname: provided by the parent; a legal name is never required
- Grade level (optional)
- Drill session records: problems attempted, answers given, timestamps, response times
- Math-fact mastery status: learning / practicing / mastered, derived from session data
- Internal child profile identifier
We do not collect from children: real names, photos, audio, video, geolocation, email addresses, or any contact information.
3. How We Collect It
Directly from you when you register, create a child profile, or use the app. Automatically via server logs and session cookies when you use the service.
4. Why We Use It
- Deliver and improve the drill service
- Generate and email the weekly mastery report to the parent
- Process subscription payments
- Authenticate your account via magic link
- Detect and prevent abuse and fraud
- Respond to support requests
5. Legal Basis for Processing
- Contractual necessity: delivering the service you subscribed to
- Legitimate interest: security, fraud prevention, service improvement
- Legal obligation: fiscal recordkeeping (Stripe invoice records retained per applicable tax law)
6. Children's Privacy: Special Notice to Parents (COPPA)
This section serves as our direct notice to parents as required by the Children's Online Privacy Protection Act (COPPA), 15 U.S.C. §6501 et seq.
What we collect from children
A parent-provided nickname, optional grade level, drill session performance data (problems, answers, timestamps, mastery status), and an internal identifier. We do not collect email addresses, real names, photos, audio, video, or geolocation from children.
How we use child data
Solely to operate the drill service and generate the parent's mastery report. We do not use child data for advertising, do not share it with third parties for marketing, and do not build behavioral profiles of children.
Who can see child data
Only the parent/guardian who created the profile, and our infrastructure subprocessors (listed in Section 7), who are contractually prohibited from using child data for any commercial purpose.
Your parental rights
- Review: request a copy of information collected about your child. Email privacy@caraji.io
- Delete: remove your child's profile and all associated data, from Dashboard → Kids, or by emailing us
- Refuse further collection: delete the profile at any time; we will stop collecting data about that child immediately
We do not condition participation on collecting more information from children than is reasonably necessary to provide the service.
To exercise parental rights, contact us at privacy@caraji.io or write to 13423 Blanco Rd, San Antonio, Texas 78216.
7. How We Share Information
We do not sell, rent, or trade personal information. We share only with the following service providers, and only to operate the service:
| Provider | Location | Purpose |
|---|---|---|
| Stripe, Inc. | United States | Payment processing |
| Honeybadger Industries LLC | United States | Application error monitoring |
| Brevo (Sendinblue SAS) | France (EU) | Transactional email (magic links, receipts, mastery reports) |
| DigitalOcean LLC | United States | Cloud hosting and database storage |
All subprocessors are contractually prohibited from using your data for any purpose beyond what is necessary to provide services to NumFox.
8. International Data Transfers
Our servers are located in the United States (DigitalOcean). If you are located in Mexico, by using NumFox you consent to the transfer of your personal data to the United States. We implement technical and contractual safeguards to protect your data during transfer and at rest.
9. Data Retention
- Active accounts: retained for the life of the account
- Deleted child profiles: permanently purged within 30 days
- Account deletion: all personal data permanently deleted within 30 days
- Stripe payment records: retained for 10 years (fiscal/tax compliance)
- Server logs: rolled after 90 days
10. Security
We use industry-standard safeguards: HTTPS/TLS encryption in transit, encrypted application credentials, session-based authentication with short-lived tokens, rate limiting, access controls, and application-level error monitoring. No security measure is absolute, and we cannot guarantee that unauthorized access will never occur. If we become aware of a breach affecting your personal data, we will notify you as required by applicable law.
11. Your Rights
For California residents (CCPA/CPRA)
You have the right to know, correct, and delete your personal information. We do not sell or share personal information for cross-context behavioral advertising. To exercise your rights, contact us at privacy@caraji.io. We will not discriminate against you for exercising your privacy rights.
For all users
We honor equivalent access, correction, and deletion rights for all users regardless of location. We will acknowledge your request within 5 business days and fulfill it within 30 days.
12. Cookies & Similar Technologies
We use only first-party functional cookies required for the service to work:
- Session cookie: maintains your logged-in state
- CSRF token: prevents cross-site request forgery attacks
We do not use advertising cookies, third-party analytics cookies, or behavioral tracking technologies.
13. Changes to This Policy
We will notify you by email at least 30 days before any material change. For minor updates (such as adding a new subprocessor), we will update this page and the "Last updated" date. Prior versions are available upon request.
14. Contact
For privacy questions or to exercise your rights:
- Email: privacy@caraji.io
- Mailing address: 13423 Blanco Rd, San Antonio, Texas 78216