Our information security program
Program adopted: November 8, 2026. Next yearly review: by November 8, 2027.
This page summarizes the written information security program we keep under the Children's Online Privacy Protection Act Rule. The full program is an internal document; this summary leaves out details that would help an attacker.
Who is responsible
Hausbound, LLC, the operator of Zoorithmetic, is responsible for the program. Questions about it go to support@zoorithmetic.com.
What we protect
- Parent email addresses and sign-in records.
- Consent records.
- Child profiles (nickname, avatar, grade band and Practice Range) and practice data.
- Purchase records.
We never collect a child's real name, birth date, photo, voice, location or email address.
Our safeguards
- Only our own server can reach the database, and every request is checked to make sure it comes from a parent in that family before anything is read or changed.
- The database also refuses direct access from anywhere else, as a second line of defense.
- Our keys and passwords are kept apart from our code and are never stored with it.
- Scheduled jobs, health checks and delivery notices refuse to run when their secret is missing, instead of running unchecked.
- There is no advertising, analytics, tracking or crash-reporting code from another company in the app or on this website. Email about a child goes only to a parent who has confirmed their address and given consent.
- Backups are encrypted by our database host and age out within 30 days.
- A daily job deletes information on the schedule in our privacy policy, and each part of that job reports that it ran.
- An hourly monitor emails us about any problem it finds, and a second, separate check makes sure the monitor itself keeps running.
- When a parent deletes information, we check that it was deleted. When two parents share an account, deleting the whole account waits for both, as our privacy policy explains.
If something goes wrong
If we suspect a breach, we change the affected keys and passwords, review our hosting and database logs, tell affected parents and the Federal Trade Commission as the law requires, and record what happened and what we changed in the program.
Yearly review
We review the program at least once a year and before each major release, and we update this summary when the program changes. Our privacy policy explains what we collect, why, and how long we keep it.