CCSS App privacy policy

Last updated: 10 November 2026

CCSS App is a set of short math video lessons for Kindergarten, Grade 1 and Grade 2, available as an Android app, a Chrome extension and on the website k2mathlessons.com ("K2 Math Lessons"). It is made by EDUPOTION (Edupotion eLearning Services Pvt Ltd, India). This policy explains what the apps and the website store and send. In short: children never give us any personal information, there are no ads and no advertising or analytics SDKs, and a parent account holds only an email address, a hashed password and the lessons that were unlocked.

Children

CCSS App is designed to be used by children with a parent or teacher. Children can watch lessons without giving any information. Accounts, purchases and outside links are behind a grown-up check, and accounts are meant to be created by an adult. There is no chat, no user-generated content, no ads, no tracking and no location access. If you believe a child has created an account, contact us and we will delete it.

What stays on your device

• Watch progress: which lessons have been watched and where a video was paused.
• Sign-in (Android app): a sign-in token for the parent account, kept in the device's secure storage.
• License keys (Chrome extension and website): keys you enter, the grades they unlock and a shortened version of the purchase email. In the extension, if Chrome sync is on, Chrome syncs these to your other signed-in browsers. On the website they are kept in your browser's local storage.

Uninstalling the app or extension deletes everything it stored on the device. On the website, My lessons → Remove or clearing the site's data in your browser does the same.

The website

k2mathlessons.com sets no cookies and has no ads, advertising trackers or social media widgets. We may count page views with Cloudflare Web Analytics, which uses no cookies and doesn't follow you across other sites. When you buy on the website, Gumroad's checkout opens on the page and Gumroad's own privacy policy applies to it.

Parent accounts (Android app)

To buy lessons in the Android app, a parent creates an account with an email address and a password. We store the email address, a securely hashed version of the password (never the password itself), when the account was created, and which grades the account has unlocked. We use the email only to run the account, for example to send a password-reset code you ask for. We don't send marketing emails. We keep these until you delete the account.

Purchases

• Google Play (Android app): payment is handled entirely by Google. When you buy, the app sends us the purchase token and product, and our server asks Google whether the purchase is valid. We keep the order number and a one-way hash of the purchase token, so the purchase can be restored and refunds can be honoured. We never see card details.
• Gumroad (Chrome extension and website): payment is handled by Gumroad. When you enter a license key, our server asks Gumroad whether it is valid. As the seller we receive the order details Gumroad shares with sellers, such as your email. When you buy on the website, the page gives the checkout a random one-time code, and Gumroad sends our server the sale's license key with that code, so the page can unlock by itself. We keep that key and code for at most 24 hours, then delete them.

What is sent to our server

• Sign-in and sign-up requests (email and password, over an encrypted connection).
• When a lesson is opened, the lesson's code - plus the sign-in token or license session for paid lessons - so the server can create a video link that expires after a few hours.

Our server runs on Cloudflare. To stop password guessing, it keeps the IP address and email address of recent sign-in, sign-up and password-reset attempts for up to three days. Cloudflare may also keep short-lived technical logs such as IP addresses for security and abuse prevention.

Other companies involved

• Google Play (payments on Android), Gumroad (payments for the Chrome extension) - see their privacy policies.
• Bunny.net streams the videos. Like any video service it receives the device's IP address and browser details to deliver the video, and it counts plays and watch time for each lesson, including by country (worked out from the IP address). We see only these totals, never who watched, and IP addresses are used only to deliver videos and count plays - never to identify or contact anyone, or for advertising.
• Cloudflare hosts our server, our database and the website.

Deleting your data

You can delete your account at any time in the Android app (Grown-ups → Account → Delete account) or on our account deletion page. This deletes your email address, password hash and the list of unlocked lessons straight away. We keep only the Google Play order number and a one-way hash of the purchase token, no longer linked to any account or email address, so refunds can be honoured and the purchase can be restored to a new account later - Google Play purchases stay in your Google account. Backups of our database may keep deleted data for up to 30 days before it is gone for good. Progress and license keys on your devices can be reset on the Grown-ups page or removed by uninstalling.

What we never do

We don't sell or share personal data, we don't use it for advertising, and we don't use it for anything other than running your account, unlocking lessons and playing them.

Contact

Questions or requests about your data: email info@edupotion.com.