Privacy Notice

Who Operates This Website?

The data controller for this website is Maths & Physics Society.

This is the Maths & Physics Society's website for its activities in the Maynooth University community. Society branding is used with permission. University, MSU and MU Life services have their own operators and privacy notices.

For a privacy question, email [email protected].

Contact Address: Maths & Physics Society, c/o Clubs and Societies Office, First Floor, Rye Hall, Maynooth University, Maynooth, Co. Kildare, Ireland

Guest Play and Temporary Work

You can play without signing in. Guest attempts, hints, game history, Modulo scratchpad notes and candidates stay in the open page. Reading preferences and the maths keyboard setting also last only for that page. Refreshing or closing it removes this temporary work.

The standalone Question Editor keeps unsaved drafts and imported questions in the open page. Export work you want to keep, or use Cloud Workspace if you have editorial access. Account play saving does not include editor drafts.

Weekly answer checks send the entered value to our website server; hint and solution requests are also processed there. Guest weekly answers are not kept in an account or ranked score record. Signing in loads your saved account progress separately. You can choose to import guest play in Your Account; the copies are not merged automatically.

Earlier versions may have left saved work in this browser. We do not open, change, upload or delete those records automatically. Browser Data Controls lets you download, recover or clear them. Recovered work remains temporary until you explicitly save or export it. Anyone using the same browser profile may be able to access those earlier records.

Use fictional or non-personal details in questions and drafts. Guest activities do not need your name, email address, student number or membership records.

Information Sent Through the Site

You can play as a guest without uploading your progress or editor drafts. Signing in with Google loads your account progress and automatically saves your question attempts, hint and reasoning history, game guesses, results and any Modulo scratchpad notes and candidates you enter. Authorised editors can save questions through Cloud Workspace. The site has no student-number lookup, online payments, advertising or analytics.

Page and asset requests go to the website server. Sign-in and saved-practice requests go directly from your browser to Google Firebase over encrypted connections. Weekly answer checks, hints and solution requests, ranked scoring, profile settings and picture uploads, Admin review and privacy-case actions go to our website server. Admin verifies the selected cloud revision before copying it into a review record. Your Google password is handled by Google and is not sent to this website.

Export buttons create downloadable files on your device. Importing a question library reads the file you select in the browser. Neither action uploads that file. Importing guest play into your account requires an explicit account action; private editorial drafts save through their editor controls; submitting for review copies the saved revision to Admin. Signed-in play changes are saved automatically as described above. If you later send an exported file to someone, that is a separate sharing action you control. Exports may contain your drafts and history; keep them somewhere appropriate.

Your Optional Account

Google provides your account identity, which can include your name, email address and profile picture, together with a Firebase user identifier. We use the identifier to keep your saved progress separate from other members. Practice history remains private. Your website username and picture are separate choices. Google names and photos are not copied into your public profile. Public leaderboards are optional, as described below.

Signing in loads your saved progress and starts automatic saving. Earlier guest records stay separate unless you import them in Your Account. Each save replaces the previous account copy. If another session has saved a newer copy, saving pauses so you can choose which to keep; the copies are not merged. Account saving excludes question drafts, authored questions, settings and recovery files. Practice results are personal records, not verified scores.

When you sign in, Firebase keeps your sign-in in this browser so you can return without signing in again. Sign out on a shared device. Signing out removes the remembered credentials; clearing site data, browser restrictions or expired access can also require a new sign-in. If persistent storage is blocked, the site uses tab storage or page memory instead. Cloud data caching stays in page memory, so changes that have not reached the server can still be lost on refresh. Your Account shows the saving status.

In Your Account, you can download or delete saved progress and close a normal member account. Closing it removes its live practice progress, ranked results, chosen username, stored profile picture and sign-in account. The username becomes available again. A minimal deletion record, containing the account identifier and closure time, is retained without automatic expiry to prevent an old session from recreating the data. It contains no name, email or play history. Contact us if you want this security record reviewed. Editorial accounts need a separate review of their retained questions.

Saved progress remains until you replace or delete it, close the account, or ask us to remove it. The Society keeps operational recovery copies as described below. These are not a personal version history or a self-service restore. Download a copy of work you want to keep. Google states that authentication IP logs are held for a few weeks and deleted-user authentication data is removed from its live and backup systems within 180 days. See Firebase's privacy information.

Your Profile and Picture

Choose a username and a built-in picture, or upload your own PNG, JPEG or WebP image in Profile Settings. Usernames are unique without regard to capitalisation. They stay linked to your existing account identifier; changing them does not change your sign-in, permissions, progress or scores. A username can normally be changed once every seven days. Contact us if a correction cannot wait.

We store your chosen username, picture selection, public-display choices, change times and moderation status on the website server in the United States. A new profile has a neutral picture and no username derived from Google. The private account preview still shows your selected profile when public display is off. Choosing Anonymous Member only changes what ordinary website visitors see; it does not make the account anonymous to the Society's administrators, Firebase or hosting providers. A distinctive score or something you share elsewhere may also allow someone to recognise you.

Picture uploads are limited to 5 MB. The server checks and processes the selected image, crops it to a small square and removes embedded metadata, including camera and location tags. We retain the processed picture, not the original photograph or filename. The picture uses the existing website storage; it is not uploaded to a new image-hosting service. Avoid uploading images containing sensitive information or other people without their permission.

Your chosen picture is public only when you join leaderboards, enable your chosen identity and the profile is approved. You and authorised moderators can view it privately while it is being reviewed. Selecting a built-in picture, removing or replacing an upload, or closing your account removes the previous uploaded picture from live profile storage. Old image links stop working; switching to anonymous display also stops unauthenticated access. The site asks browsers not to cache profile images, but cannot erase a screenshot or a copy someone has already saved.

Recovery copies can retain earlier pictures and profile details for the backup period described below. Restoring a backup requires reapplying later removals and privacy choices before public access resumes. Moderation decisions record the acting administrator, affected profile, time and reason. Contact [email protected] to report impersonation or an inappropriate picture, request a correction or challenge a decision.

Optional Ranked Challenges and Public Leaderboards

Ranked Society challenges are separate from private practice. Starting ranked play records your account identifier, chosen weekly slot and difficulty, question revision, start time, hints opened and final result. We check answers on the server. Submitted answer text is processed to check your answer but is not kept in the score records. For signed-in members, opening a new challenge in practice records that choice to prevent a later ranked attempt on the same question. Guest practice needs no account and creates no ranked record or points. Imports and existing practice results never create ranked points.

Public leaderboard participation starts off, including for existing members who previously kept it off. If you join, your rank, total points and number of completed challenges are public for the selected week. You can show your approved username and picture or appear as Anonymous Member with a neutral picture. Choosing anonymous display keeps your points and ranking. Your Google name, email, Google picture, account identifier, individual answers and private practice history are not included in public standings. Anyone can view standings and may make their own copy; we cannot remove copies another person has already made.

In Your Account, you can switch to anonymous display or leave public leaderboards altogether. Leaving removes your entry from current and historical public standings while retaining your private ranked records. Changing your username or picture does not create a new participant or change past scores. Names and pictures awaiting review, or hidden by a moderator, use a neutral presentation on standings you have joined. Society reviewers can inspect chosen profiles and ranked results, remove an inappropriate picture, reset a username, and record a reason for a decision. Their review screen does not show Google profiles or email addresses. Service administrators retain the access needed for maintenance.

We use ranked records to provide the competition you request, under Article 6(1)(b) GDPR. Publishing optional standings relies on your separate consent under Article 6(1)(a). Leaving public leaderboards withdraws that consent; choosing anonymous display withdraws permission to show your chosen username and picture while allowing your standings to remain. Moderation, rate limits and minimal closure records protect the fairness and security of the service, our legitimate interests under Article 6(1)(f). Contact us to challenge a decision, correct information, request restriction or object to this security processing.

Ranked records are stored with OVHcloud on our server in the United States, separately from private practice in Belgium. They remain while your ranked participation is active; they have no automatic expiry. Your Account lets you download your ranked records or permanently remove ranked participation and its profile, stored picture, username reservation, attempts, results and associated review records. Closing a normal account also removes them. A minimal account-ID and closure-time record is retained without automatic expiry to prevent old sessions or a reset from claiming points again. You can ask us to review that record.

Daily database backups are kept in a protected server directory. Backups older than seven days are removed after the next successful daily backup check. A failed or delayed check can extend that period until the service is restored. Restoration requires reapplying subsequent deletions before reopening competition. These backups contain chosen profiles and pictures, ranked records, protected question answers, Admin review history and privacy-case records, and are restricted to service administrators. Separate encrypted recovery copies are held on an owner-managed computer. These also include private Firebase progress, editorial drafts, team-access records and Google account identifiers, but not Google passwords. They use the same seven-day replacement policy. A computer that is offline cannot make its scheduled copy; backup status is checked in Admin. Restoring older data requires checking later profile changes, picture removals, anonymity and leaderboard choices, account removals, withdrawn questions and revoked access before public use.

For access, correction, removal, a scoring dispute or any privacy concern, contact [email protected]. Do not send passwords or identity documents. The leaderboards are for friendly Society competition. They offer no prizes and do not make academic decisions.

Editorial Work

Authorised editors can save private questions in Cloud Workspace. Drafts may include unfinished text, answers, hints, worked solutions, contributor and source details, permission notes, owner identifiers, revisions and save times. These drafts are stored in Firestore in Belgium. Ordinary members and guests cannot read them.

Setters use Admin to prepare and submit their questions. Assigned reviewers record decisions, and publishers choose when and where approved revisions appear. Owners manage access and can handle these tasks. The review copy, decision notes, source permissions, approving account identifier, revision, publication times and action history are stored on the website server in the United States. The current owner may review their own work; this does not mean an independent reviewer has checked it.

• Private preview: Cloud Workspace previews are restricted to authorised preview accounts.
• Public practice: an approved question, its hints, answer and solution become available to visitors at its opening time. Private review and permission notes are excluded.
• Ranked challenge: the server controls access to answers, hints and solutions under the ranked-attempt rules. Previously shared questions remain practice.

For ranked publication, a small record in Belgium links the question, saved revision and owner account, with the time it was reserved for ranked play. It contains no answer text and keeps the same question from being shared through the preview system, including if publication fails. This record has no automatic expiry.

The app session and question cache stay in memory. Unsaved editor work is lost on refresh or close; use the cloud editor controls to save drafts. Editorial records have no automatic expiry. Withdrawal stops further public or preview access through that publication, but retains drafts, revisions and review history. Browser clearing does not remove them. Contact [email protected] to arrange a review or removal of editorial data. We keep the information needed to prepare, attribute and manage Society questions, and to account for publication decisions, under our legitimate interests in running the service (Article 6(1)(f) GDPR).

Team Access

Joining the editorial team requires an invitation for your verified Google email address. The site records the invitation, its expiry, your account identifier, assigned roles, access changes and the account that made each change. Invitations expire within seven days and can be used once. Owners manage these records; other team members receive the access needed for their assigned work. These records are stored in Firestore in Belgium and have no automatic expiry. They support the operation and security of the Society website under our legitimate interests (Article 6(1)(f) GDPR). Contact [email protected] to ask about access or retention.

Privacy Requests and Admin Records

If you contact us about your data, we use your contact details and the information needed to handle the request. The restricted Admin case record holds a reference, request type, receipt date, response target, assigned handler, verification note, status, outcome and review date. It does not import our mailbox or store attachments. Case updates and editorial actions record the acting account and time. Owners and assigned privacy handlers can use the relevant case controls. Other team roles do not receive access to privacy correspondence.

We process rights requests to meet our data-protection obligations under Article 6(1)(c) GDPR. Necessary security and handling records also support our legitimate interests in protecting the service and accounting for decisions. Case and action records are stored on the US website server and have no automatic expiry. A case review date records when retained information should be checked; it does not delete the record automatically. Contact us to request review or removal. Please send only information relevant to your request, and do not send passwords or identity documents unless we agree that they are needed.

Hosting and Technical Logs

Hosting Provider: OVHcloud for the website; Google Firebase for sign-in and saved account data.

Hosting Location: Website, chosen profiles and pictures, ranked competition, Admin review and privacy-case records: United States. Saved practice progress, private editorial drafts and team-access records: Belgium. Firebase Authentication: United States. Encrypted recovery copies are also held on an owner-managed computer.

Routine website access logging is disabled. Web-server error diagnostics can contain an IP address, requested address, time and error details. Application and certificate-renewal logs record operational events. Google processes sign-in identifiers, IP addresses and browser information for authentication and abuse prevention.

Purpose: Deliver the website, investigate failures, keep connections encrypted and prevent misuse.

Retention: Scheduled checks rotate MathsPhys web-server and renewal-service logs daily when non-empty, or when they exceed 1 MiB at a check, retaining four older rotations. Application logs use four rotations and a 5 MiB threshold. Certbot keeps four backup diagnostic logs separately. These thresholds are checked on the schedule, not on every write; current files can remain between rotations. Google authentication IP logs are retained for a few weeks under its published policy.

Purposes and Legal Bases

We use information to run the activity you choose, show feedback, save account progress and manage Society questions. Temporary guest work stays in the open page. Sign-in storage is used to provide and remember the account service you request.

Account information and saved progress are processed to provide that service under Article 6(1)(b) GDPR. Minimal deletion records help prevent closed accounts being recreated by old sessions, our legitimate interest under Article 6(1)(f). Optional public leaderboard visibility remains a separate consent choice. We use support correspondence to respond to your request.

Technical Processing: Our legitimate interests in operating and securing this small Society service (Article 6(1)(f) GDPR). Routine access logs are disabled and diagnostic access is restricted to administrators. You can contact us to object or discuss your circumstances.

Sharing and International Transfers

No advertising or analytics partners receive puzzle progress or drafts through this application. Its maths rendering, keyboard assets and checking tools are served with the site.

Hosting and Other Processors: OVHcloud hosts the website, including chosen profiles and processed profile pictures. Google Firebase Authentication manages sign-in; Cloud Firestore stores account progress and restricted editorial records. Neither advertising nor analytics is enabled by this application. Provider administration and security processing are described in their privacy and data-processing terms.

Website hosting and Firebase Authentication involve processing in the United States. The Firestore database is located in Belgium; that does not keep every provider operation within the EEA. Google publishes EU-US Data Privacy Framework and contractual safeguards. OVHcloud publishes its data-processing terms and transfer safeguards. Contact [email protected] for questions about these arrangements.

Provider Information

Read the Firebase data-processing terms, Google Cloud data-processing terms and OVHcloud data-protection information for provider safeguards and responsibilities.

How Long Information Is Kept

Temporary guest work, unsaved editor work and interface preferences end when the page is reloaded or closed. Account progress and saved editorial records follow the retention arrangements described above.

Earlier browser records remain until you clear them, clear browser site data or the browser removes them. This version does not update those records. Remembered sign-in ends when you sign out, close the account, clear site data or access is revoked or expires. Browser restrictions can also remove it. The storage inventory gives more detail.

Browser clearing cannot remove downloaded files, records in another browser or data on another device. Manage saved account progress separately in Your Account.

Hosting Backup Retention: The application keeps one current account-progress copy. Daily encrypted recovery copies include account progress, Google account identifiers, editorial and access records, and the website database. They are held on an owner-managed computer, separately from protected server database backups. Copies older than seven days are removed after a successful replacement; a failed or missed run can extend retention. Recovery requires reapplying later removals and access restrictions before reopening the service. Your downloaded exports remain until you delete them. Source release bundles contain application code, not member account progress. Google describes removal of deleted authentication data from live and backup systems within 180 days.

Your Rights

Where personal data is processed, and depending on the circumstances and legal basis, rights may include access, correction, erasure, restriction, objection and portability. Where consent is relied on, you may withdraw it without changing the lawfulness of earlier processing.

We cannot retrieve earlier records held only in your browser. Use Browser Data Controls to download, recover or clear them. Your Account has separate controls for saved account data. You can also contact us to exercise your rights; the website controls do not replace them.

We normally respond within one calendar month of receiving a request. If its complexity or the number of requests makes an extension necessary, we will explain the reason within that first month. The extension can be up to two further months. We may ask for proportionate information to confirm your identity; please do not send identity documents unless we agree that they are needed.

For a privacy question, email [email protected].

You can read about your information rights on the Data Protection Commission website.

Questions and Complaints

You may raise a concern or lodge a complaint with Ireland's Data Protection Commission. You can also email [email protected] with questions about this website.

Younger Visitors

The activities are intended for the university community, but do not require an age or date of birth. The private editorial workspace is restricted to authorised accounts. Services directed at children would need a separate privacy review before being introduced.

External Links and Changes

Following an external link takes you to another website with its own practices. This includes MU Life. This notice will be reviewed if the site's features or hosting change; the date above records its most recent review.