Privacy Policy

FiveThirty Learning · Last updated: 13 May 2026

1. Who We Are

FiveThirty Learning is an online mathematics learning platform for IB Higher Level Mathematics students, operated by THEFIVETHIRTY PTE LTD (UEN 202615461R), a company incorporated in Singapore.

For any privacy-related enquiries, please contact us at: hello@thefivethirty.com.

2. What Data We Collect

We collect and process the following categories of personal data:

2.1 Account Information

• Email address (provided at registration or via Google OAuth)
• Display name
• Country and timezone (collected at registration)
• Age confirmation (self-declaration that you are 16 or older)
• Authentication method (email/password or Google OAuth)

2.2 Consent Records

• Records of your consent to our Terms of Service and Privacy Policy
• Marketing communication preference (opt-in only)
• Analytics consent preference (opt-in only — controls whether usage analytics are collected)
• Timestamps and version numbers for each consent given

2.3 Learning Data

• Quiz responses (answers submitted to multiple choice, free response, and drag-and-drop questions)
• Progress status per chapter and module (completion percentage, card states)
• Review session history (timestamps, scores, cards reviewed)
• Spaced-repetition state (Leitner box levels, next review dates)
• Bookmarks
• Likes (cards you have marked as helpful)

2.4 Purchase Data

• Records of module purchases (module, date, amount, currency)
• Entitlement records (which modules you have access to and when access expires)
• Payment processor references (Stripe or HitPay transaction IDs — we do not store your card details)

2.5 Technical Data

• IP address and browser user agent (collected in server logs)
• Device type (inferred from user agent for analytics)
• Page views and navigation events (collected only when you have opted in to analytics)

2.6 Support Data

• Issue reports you submit (card feedback, bug reports)
• Email correspondence with us

3. How We Use Your Data

We use your data for the following purposes:

4. Legal Basis for Processing

Our primary legal basis for processing your personal data is:

Consent. You provide consent when you create an account and accept these terms. For marketing communications and analytics, consent is collected separately via your Settings page and can be withdrawn at any time. Analytics data is only collected when you have opted in.

Contractual necessity. Processing your account, learning, and purchase data is necessary to provide the service you have signed up for.

Legitimate interest. We process technical data (IP addresses, analytics) for platform security, fraud prevention, and service improvement. These interests do not override your rights.

5. Third-Party Services and Data Processors

We use third-party services to operate the platform. Each acts as a data processor on our behalf. The key categories are:

No sale of data. We do not sell, rent, or lease your personal data to any third party. We do not share your data with advertisers.

No AI training. Your learning data is not used to train artificial intelligence or machine learning models. Any automated personalisation (such as spaced-repetition scheduling) operates only within your own account data.

6. Data Minimisation

We collect only the data necessary to provide and improve the service:

• We do not require your real name (a display name of your choice is sufficient).
• We do not collect school name, school email, or institutional affiliation.
• We do not store payment card details (these are handled entirely by Stripe and HitPay).
• Analytics data is aggregated and not used to identify individual users.
• We do not use tracking cookies for advertising. The only cookies used are strictly necessary for authentication and security.

7. Data Protection for Young Users (Ages 16–18)

We recognise that many of our users are between 16 and 18 years old. We take additional care with their data:

• No public profiles or social features. Users cannot see other users’ identities or progress.
• Display names are chosen by the user and need not be their real name.
• Marketing communications are opt-in only and can be disabled at any time.
• We do not engage in behavioural advertising or profiling for marketing purposes.
• Parents or guardians may contact us at hello@thefivethirty.com to enquire about their child’s data.

8. Your Rights

Under Singapore’s Personal Data Protection Act (PDPA) and, where applicable, the EU General Data Protection Regulation (GDPR), you have the following rights:

• Access. You may request a copy of the personal data we hold about you.
• Correction. You may update your account information via the Settings page, or contact us to correct any inaccuracies.
• Withdrawal of consent. You may withdraw your consent for marketing communications and analytics at any time via your Settings page. When you opt out of analytics, collection of usage events stops immediately. Withdrawal of consent for data processing necessary to provide the service will require account closure.
• Deletion. You may request deletion of your account and personal data by contacting us. We will process your request within 30 days, subject to any legal obligations to retain certain records (such as purchase records for tax purposes).
• Data portability. You may request an export of your personal data in a commonly used format.

To exercise any of these rights, please contact us at hello@thefivethirty.com.

9. Data Retention

• Account data: Retained for as long as your account is active.
• Learning data: Retained for the duration of your access period, plus a maximum of one (1) year after your last module access expires, or until the end of the relevant IB examination session, whichever is earlier.
• Purchase records: Retained for seven (7) years after the transaction date, as required by Singapore tax regulations.
• Consent records: Retained for as long as the consent is active, plus three (3) years after withdrawal, for audit and compliance purposes.
• Analytics data: Aggregated and anonymised. Event-level data is retained for a maximum of twelve (12) months.
• Support correspondence: Retained for three (3) years after the last interaction.
• Server and security logs: Server logs (which may include IP address, browser user agent, and truncated account identifiers) are held by our hosting provider for a short period — up to approximately seven (7) days — and then automatically deleted. They are used solely for security, abuse prevention, and troubleshooting.

10. Security

We implement appropriate technical and organisational measures to protect your data:

• All data is transmitted over encrypted connections (HTTPS).
• Database access is restricted by role-based access controls.
• API endpoints are protected by authentication and abuse-prevention measures.
• Administrative access is restricted and does not use shared credentials.
• Payment data is handled by PCI DSS-compliant processors (Stripe, HitPay).

No system is completely secure. If you become aware of a potential security issue, please contact us immediately at hello@thefivethirty.com.

11. Cookies and Local Storage

The platform uses a minimal set of cookies and browser storage:

• Authentication cookies: Secure session cookies used to maintain your login session. These are strictly necessary and cannot be disabled.
• Security cookies: Cookies used to protect your account against common web-based attacks. Strictly necessary.

We do not use third-party advertising cookies, tracking pixels, or social media cookies. Our analytics provider uses first-party cookies for session identification only, not for cross-site tracking.

12. International Data Transfers

Some of our third-party service providers process data outside Singapore. Where data is transferred internationally, we ensure that appropriate safeguards are in place, including the service provider’s compliance with industry-standard security practices and data protection commitments.

Analytics data is processed within the European Union to minimise cross-border transfers for this category.

13. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via the email address associated with your account. The “Last updated” date at the top of this document indicates when the policy was last revised.

Continued use of the platform after changes take effect constitutes acceptance of the revised policy.

14. Contact