Alpha privacy notice

Who we are and who this covers

Sixly is run by IvyPath LLC, doing business as Sixly (“Sixly”, “we”). This notice covers the closed alpha: an invite-only test for adult students, students 13 to 17 whose parent or guardian holds the account, parents and guardians, and, once that path opens, children under 13 whose parent gives verified consent. Sixly is for people in the United States only.

What we collect

What we never collect or keep

• Your birth month and year: we read them once to work out your age band, then drop them.
• A student's phone number, unless the student chooses codes by text with a parent's yes. A child under 13 never gives one.
• Audio: while you hold the talk button, the recording goes to Microsoft's Azure speech service to become words, and then it's gone. Sixly never stores the recording or the words you said. Students 13 to 17 can talk to the tutor only with a parent's yes, and their words go to the tutor only as a caption on their own screen. Children under 13 can't use voice.
• Questions you type to the tutor: they're used to answer you, then not kept. Students under 18 can't type questions to the tutor in the alpha.
• Photos of your work: photos aren't part of the alpha.
• IP addresses or a history of where you've been, in Sixly's database.

For review: Hosting request logs (Vercel) hold basic request details, IP addresses included, for about a day for security and debugging (COPPA research 6.3). Say so here once confirmed for the `sixly` project.

How we use it

• To run Sixly for you: show your boards, read your handwriting, check your steps, write hints, grade answers, save your progress and measure tutor time.
• To keep accounts safe and stop abuse: sign-in codes, limits on codes and requests, and one free trial per phone number and email.
• To show a parent or guardian what this notice says they can see.
• To send the emails an account needs: sign-in codes, family invites, and notices such as turning 18.
• To fix problems you report and problems we find.
• To improve Sixly's checker, only as the research section below says.

Sixly doesn't sell personal data, doesn't share it for ads, shows no ads, and sends no marketing or reminder emails or texts during the alpha. Mathpix and Claude outputs never become training data.

Phone numbers

• Account holders (adult students and parents) verify a US mobile number with a texted code when they join.
• We use the number only to confirm it's you and to give one free trial per family. We never use it for marketing unless you say yes separately, and the alpha doesn't ask.
• We keep the number while your account is open. We also keep a scrambled copy (a one-way code that can't be turned back into the number) for up to 24 months after it was last used, even after an account closes, so the same number can't start a second free trial.
• We remove the number from our sign-in system right after it's verified, so nobody can sign in to your account with a text.
• Twilio sends the texts. Twilio's terms let it use phone numbers and message details for some of its own purposes, such as preventing fraud. Message and data rates may apply.
• A child under 13 never gives a phone number. A student 13 to 17 doesn't need one: the parent's verified number covers them.
• A student 13 to 17 may choose to get sign-in codes by text on their own phone, only if the parent allows it in the parent's choices and the student says yes on a screen of their own that names Twilio. Saying no changes nothing else. We keep the number only while the choice is on and use it only for sign-in codes; turning it off, by the student or the parent, deletes it at once.

For review, needs a lawyer: D-088, 2026-10-26, item 1: the student's own phone is off until SIXLY_TEEN_PHONE_VERIFY is set, which waits for counsel's check of the screen naming Twilio (GBL 899-ff(3)) and for the sign-in page to send codes by text. The 24-month keep period for scrambled copies is proposed (plan 1.4, open question 21).

Companies that handle data for Sixly

These companies handle personal data only to run their part of Sixly, under their agreements with us. Sixly's own math checker, which decides whether a step is right, runs on Sixly's servers.

For review, needs a lawyer: New York minors need a written agreement with each processor (GBL 899-gg), and children under 13 need written assurances (16 CFR 312.8(c)); the status per vendor is in the New York research section 6.2 and the COPPA research section 7.3. Twilio is a new sub-processor (finding F-18) and joins the vendor review at integration. Cloudflare's Turnstile terms have not been reviewed.

Using work to improve Sixly

If research use is on, we use the handwriting and steps on your boards (not photos, voice or chat) to test and train Sixly's checker. Only Sixly staff who label work see it, in a locked part of our systems. We never sell it, never give it to other companies for their own use, and never use it to identify who wrote something. For students under 18 it is off unless the student says yes; for adults it is on unless they turn it off. You can turn it off any time in Settings, and ask us to delete work already used. We keep research copies until you turn it off, delete your account, or 24 months after you last used Sixly, whichever comes first.

• Adults outside New York: on when you join, with the switch shown on the sign-up screen. Turn it off any time in Settings.
• Adults in New York: off until you say yes. We ask once, after your first finished board.
• Students 13 to 17: off until the student says yes on a screen of its own, asked once after their first finished board. A parent can turn it off, never on. If a student says no, we don't ask again until January 1 of the year after next.
• Students under 18 in Vermont: not available.
• Children under 13: only if the parent ticks the separate box on the consent form.
• If your browser sends a Global Privacy Control signal, it starts off and we don't ask. You can still turn it on in Settings.
• Turning it off covers past work too: those boards leave Sixly's research data within 30 days.
• No perk, price or feature depends on your answer.

For review: Research consent 4.2g and the table in its section 1. Research datasets aren't built in the alpha (build plan section 0); a yes only marks boards. Counsel questions 1, 3 and 13 in that document still apply.

What parents see

When a student 13 to 17 joins, Sixly shows them these two lists, word for word.

What your parent can see

• The questions you practice and how they went
• The steps the checker caught, with a replay of your board
• When and how long you practice, and the sessions left on your plan
• Your goals and settings, and your answer about research use, which they can turn off

What your parent never sees

• The tutor's hints to you
• What you type to the tutor

A parent sees a teen's research choice and can turn it off. For a child under 13, a parent can see everything Sixly collects from the child, including the hints shown and any reports, as federal law requires. When a student turns 18, a linked parent keeps their view until the student removes them in Settings.

For review: TD-112, with the under-13 exception from COPPA 312.6 (finding F-27). The lists are W2's ALPHA_PARENT_VIEW, the words students see when they join.

Students 13 to 17

• The parent or guardian holds the account and agrees to the terms. The student agrees to the student rules.
• A student can't practice until the parent allows the account.
• AI hints and handwriting reading each need the parent's yes. Without them the student still types steps, gets them checked, and gets Sixly's own written hints.
• The student, not the parent, decides about research use, practice reminders and news from Sixly. The alpha sends no reminders or news to anyone.
• Sixly emails a student only the family invite they asked for.
• Students under 18 can't type questions to the tutor in the alpha.

Children under 13

A child under 13 can join only through a parent, and only after the parent gives verified consent: the parent signs the consent form in the app, signs the printed form by hand, and sends a photo or scan of it, which Sixly checks automatically (a person checks it if a check fails). Nothing is collected from the child before that. Before any material change for a child (a new company, voice, handwriting reading, or a new company running Sixly), the parent gets a new notice and the change stays off until the parent consents again. Children never give an email or a phone number, their handwriting is never sent to Mathpix, and AI hints need the parent's separate yes. The children's privacy notice has the details and how long each kind of data is kept. This path isn't open yet.

New York

• For students under 18 in New York, Sixly uses their data only for what's needed to provide Sixly, unless the student says yes to something more (research use, reminders or news). The choice to say no is shown first and is the most prominent. Saying no changes nothing else, and we don't ask again until January 1 of the year after next.
• Handwriting reading isn't available yet for students under 18 who live in New York, signed up from New York, or are using Sixly from New York at the time. A New York law needs a signed agreement with the company that reads handwriting, and it isn't signed yet. These students type their steps, and Sixly checks them.
• Adults in New York are asked before their work is used for research.
• When a New York student turns 18, we tell them that some of the law's protections no longer apply.

For review, needs a lawyer: Child Data Protection Act (GBL 899-ee to 899-mm). The Mathpix hold now keys on the home state, the sign-up state and the state each request comes from (New York research R-26; D-088, 2026-10-26). The other New York rules still key on the home state. Whether New York adult students are covered users (Q1) is open.

Vermont

For students under 18 in Vermont, research use isn't available, and the app shows a line on every page that says their parent can see their practice in Sixly.

For review, needs a lawyer: Vermont's Kids Code from January 1, 2027 (research consent section 5; open question 5 on whether Vermont minors join the alpha).

When a student turns 18

• On the first day of the month after their 18th birthday month, the student's account starts following the rules for adults. We tell them by email and in the app.
• Their choices stay as they set them, including whether Sixly may use work from before that day for research.
• A linked parent can still see their practice until the student removes them in Settings.
• For New York students, the notice also says that some protections of New York's Child Data Protection Act no longer apply.

How long we keep it

For review, needs a lawyer: Periods marked proposed are not decided (build plan 1.4, 1.12, open questions 10 and 21). Under-13 periods are in the children's notice and need counsel (COPPA 312.10). The 3-year keep period for consent records after an account closes is the retention policy's proposal (section 5.2, R-3; consent review Q11): a minimal record in its own table with no names, no scans and no work.

Seeing, getting and deleting your data

• See it: your boards and progress are in the app. A parent sees what the parent section above says.
• Delete it: an adult student can use “Delete my practice work” or “Close my account” in Settings. A parent can delete a student's practice work or close the student's account from that student's page in the parent view. Deleting practice work removes boards, readings, checks, answers and sessions.
• Get a copy: email privacy@sixly.ai from the account's email address and we'll send a copy of your data within 30 days.
• Change your mind: turn research use off in Settings; a parent can withdraw permission for a student in the parent view, which pauses the student's practice.
• Ask anything else: email privacy@sixly.ai. We may ask you to write from the account's email, so we know it's you.

For review: There is no in-app export in the alpha; copies are by email request (proposed). Deleting an account keeps only the scrambled free-trial copies, a count of what was deleted, and the short consent records described above.

Keeping it safe

• Data is encrypted when it travels and when it's stored.
• Database rules let each family read only its own rows, and Sixly's servers do the writing.
• Staff need two-step sign-in, and staff actions on accounts are logged.
• Sixly's logs hold no student work, no names and no phone numbers.

For review: Supabase and Vercel encrypt data at rest on their side; confirm the wording against the written security program (docs/legal/security-program-draft.md, 16 CFR 312.8(b)).

Changes to this notice

Each change gets a new version number. We'll tell account holders by email and in the app before a change takes effect, and we'll ask again before using data in a new way.

Contact

Email privacy@sixly.ai with any question about your data.