TAPF Math privacy policy Android english

Privacy Policy for the TAPF Math App
Effective Date: June 24, 2026.
Platform: Android
TAPF Math is an app by Symphony Games (“we”, “us”, “our”).

TAPF Math uses AI technology provided by Anthropic to generate chat responses. To do so, chat content (text, formulas, and images) must be transmitted to Anthropic servers for processing. The following applies:
• The Anthropic Claude API is designed with strict privacy and data protection in mind.
• Anthropic does not use data submitted from TAPF Math to train its AI models.
• Anthropic employees will not access conversation data, except when strictly necessary for abuse detection or usage policy enforcement.
• Chat data is deleted from Anthropic servers after a maximum of 30 days. The retention period is used for abuse prevention.
• The API infrastructure is SOC 2 Type 2 compliant.
• The data is processed and stored in the United States.
• Address of the data recipient: Anthropic PBC, 530 Divisadero St., San Francisco, CA 94117, USA.
• Anthropic does not sell data or share it with third parties.
• Anthropic may perform aggregated, privacy-preserving analysis of data (Clio) to gain insights into the real-world impacts of AI systems and the usage patterns of its products while rigorously maintaining user privacy and the confidentiality of sensitive information.
• For users in the EU: Data is transferred on the following legal basis: performance of a contract (Art. 6(1)(b) GDPR). TAPF Math is explicitly used to provide mathematical guidance. Transmitting data to the Anthropic API is technically necessary to provide this service (the contract with the user).
• For users in the EU: For transfers of personal data to the United States, Anthropic relies on the EU Standard Contractual Clauses (SCCs). These clauses contractually ensure an adequate level of data protection.

TAPF Math does not associate chat content with personally identifiable information, personal names, or device identifiers.

Sometimes you may see an image (“overview image”) in the upper-right corner of the chat screen that depicts the math problem currently being discussed. This overview image is generated and cropped from the images that you upload to the app with the help of xAI Grok. The following applies:
• xAI does not use images submitted from TAPF Math to train its AI models.
• The sole purpose of sending and processing the image through xAI Grok is to generate a suitable overview image so that the user has a better overview while discussing mathematical problems. The image is not used for any other purpose.
• Image data is deleted from xAI servers after a maximum of 30 days. The retention period is used for abuse prevention.
• xAI does not sell data or share it with third parties.
• The data is processed and stored in the United States.
• X.AI LLC (USA) acts as the data controller for users located in Europe.
• Address of the data recipient: xAI Corp., 1300 Center Street, Suite 101, Deerfield Beach, FL 33442, USA.
• For users in the EU: Data is transferred on the following legal basis: performance of a contract (Art. 6(1)(b) GDPR). TAPF Math is explicitly used to provide mathematical guidance. Transmitting data to the xAI API is technically necessary to provide this service (the contract with the user).
• For users in the EU: For transfers of personal data to the United States, xAI relies on the EU Standard Contractual Clauses (SCCs). These clauses contractually ensure an adequate level of data protection.

For the technical operation of the app, the secure transmission of data, and protection against abuse, we use the Google Firebase development platform provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Chat content (text, formulas, and images) is routed through Google Firebase server functions (Firebase Functions) to the involved AI interfaces (xAI and Anthropic). During this routing process, server log data (including the user’s IP address and timestamps) is processed. Chat and image content is not stored permanently on Firebase servers. Firebase Functions are used on the legal basis of contract performance (Art. 6(1)(b) GDPR). To ensure that requests originate only from our official app and to protect against abuse, we use Firebase App Check. The use of App Check is based on our legitimate interest (Art. 6(1)(f) GDPR) in IT security and fraud prevention. Firebase Functions and Firebase App Check are certified under ISO 27001, SOC 1, SOC 2, and SOC 3. Google Ireland is our contractual partner; however, data is transferred to and processed by its parent company, Google LLC, in the United States. Google is certified under the EU-U.S. Data Privacy Framework (DPF), which legally ensures an adequate level of data protection. We use Google Firebase as a data processor, and the Standard Contractual Clauses (SCCs) for data transfers between EU and non-EU countries have been executed.

These are the details regarding the use of Firebase Functions:
Firebase Functions collects the function name, IP address, and Firebase Cloud Messaging token (FCM). Purpose: This data is required to execute the requested function and thereby provide the service. Retention period: The data is stored only temporarily in order to provide the service.

These are the details regarding the use of App Check:
App Check works together with Play Integrity (which is also provided by Google) and uses it as an attestation provider. To determine whether the app has been modified or is running on an insecure device, Play Integrity collects technical data from your device and transmits it in encrypted form to Google’s servers for verification. This data includes:
• App-provided information included in the request, including the requestHash and nonce fields.
• App metadata: package name, version number, and the digital signing certificate of our app.
• Device information, including a key attestation certificate and a device attestation token (generated by Google Play Services), as well as information about the device’s security status (e.g., whether the device has been modified, rooted, or is running in an emulator).
• Licensing data: The Google Play licensing status of the Google account signed in on the device. This indicates whether the app was legitimately downloaded or acquired through Google Play.

Purpose and Legal Basis:
The transmission and verification of this data on Google’s servers serves the detection of fraud, abuse, and security risks. This constitutes our legitimate interest in ensuring IT security and the integrity of our app services pursuant to Art. 6(1)(f) GDPR.

Apart from that, App Check itself collects:
• an integrity token from Play Integrity. Purpose: To validate app attestations and protect our backend resources against abuse.
• the so-called Firebase User Agent, consisting of:
◦ device metadata (operating system version, name, model, brand, and form factor)
◦ the application used to install our app
◦ the Firebase SDK version
The Firebase User Agent is never linked to personally identifiable information such as user identifiers or device identifiers.
Purpose: The Firebase User Agent is used internally by Google to understand platform and version adoption and thereby provide, maintain, and improve Firebase services.

All data transmissions between the app, our server services, and the AI services used are encrypted using TLS (HTTPS).

If you do not agree to the data processing and usage described here, you must stop using TAPF Math.

If you have any questions regarding this Privacy Policy, please contact us at: info[at]symphonygames.net