Privacy Policy

1. Introduction

Tiny Equations Pte. Ltd. (“Tiny Equations”, “we”, “our”, or “us”) is committed to protecting the privacy and personal data of everyone who uses our website and web application. This Privacy Policy explains how we collect, use, disclose, store, and protect personal data in connection with:

• our website at www.tinyeqn.com (the “Website”);
• our web application at app.tinyeqn.com and its pre-release environment at staging.tinyeqn.com (together, the “Platform”); and
• the AI-assisted educational services delivered through the Platform, currently TinyMark (AI-assisted marking of submitted work) and TinyQ (AI-generated practice questions and mastery tracking).

Together, the Website, the Platform and those services are the “Services”.

This Privacy Policy applies to all users, including school and institution administrators, teachers, students, and individual users. It should be read together with our Terms of Service.

By registering for or using the Services, you acknowledge that you have read and understood this Privacy Policy. Where a user is a minor, the parent or guardian who provides consent at registration also acknowledges this Policy on behalf of the child.

This Policy is separate from the internal Data Privacy Policy that governs how Tiny Equations' own employees and contractors handle company data.

2. About Us and Our Data Protection Officer

Tiny Equations Pte. Ltd. is a company incorporated in Singapore (the “Company”). We are the data controller in respect of personal data collected through the Services.

We have designated a Data Protection Officer (DPO) as required under the Singapore Personal Data Protection Act 2012 (PDPA). Our DPO can be contacted at:

All data protection queries, access requests, correction requests, and deletion requests should be directed to the above contact.

3. Scope and Applicable Laws

This Privacy Policy is governed primarily by the Personal Data Protection Act 2012 of Singapore (PDPA). Where Tiny Equations operates through local partnerships, agencies, or joint ventures in other countries in the region, such as Malaysia, Myanmar and Indonesia (see Section 8.2), we also comply with the Personal Data Protection Act 2010 of Malaysia and other applicable data protection frameworks in those jurisdictions, to the extent required.

To the extent that users from other jurisdictions access the Services, Tiny Equations will endeavour to comply with applicable local data protection laws as relevant.

staging.tinyeqn.com is a pre-release environment used for testing and demonstration and, where we have agreed it in writing, for beta deployments and pilots with schools. It is covered by this Policy and by the same technical controls as the Platform. Except for such beta and pilot deployments, it is not intended to hold operational student records, and institutions should not submit live student data to it unless we have agreed to that in writing, for example as part of a beta or pilot deployment.

4. Personal Data We Collect

4.1 Data You Provide on the Website

You can browse www.tinyeqn.com without giving us any personal data. If you choose to contact us, we collect what you submit:

• Contact form: enquiry type, name, email address, school or organisation, role, and the content of your message. The form is protected by Google reCAPTCHA (see Section 7).
• Event and conference sign-up: where you scan a QR code at an event, the name, email address, organisation and role you choose to provide.

Enquiries are delivered to our team by email and used to reply to you and to follow up on your enquiry. We do not add you to a marketing list.

4.2 Data You Provide on the Platform

• Account registration data: name and email address. We do not collect or store your password. Authentication is performed by Google Cloud Identity Platform, which holds your credentials; our systems receive only a signed identity token confirming that you have signed in successfully. Where “Sign in with Google” is enabled for your deployment, we receive the basic profile information Google returns.
• Profile information: role (student, teacher, institution administrator), institution or school name, year or grade level, and any school-issued student or administrative number provided by you or by your institution.
• Parental or guardian data: name and contact details of the parent or guardian who provides consent for a minor's account.
• Model training preference: for individual accounts, whether you have opted out of model training or, for a minor, whether a parent or guardian has opted in (see Section 5.2).
• Submitted work (“User Data”): photographs, scans and uploaded files of handwritten or typed work; typed answers and essays; questions asked of the in-product assistant; appeals you submit against a mark; and any other content submitted in the course of using the Services.
• Teaching materials: question papers, marking schemes and rubrics uploaded by teachers, which may contain personal data where the teacher includes it.

4.3 Data We Collect Automatically

• Login activity: date, time and frequency of sign-in.
• Usage data: features accessed, assignments and submissions created, and interactions with the Services.
• Technical data: IP address, browser type and version, operating system and device identifiers, recorded in server logs.
• Cookies: as described in Section 7.

4.4 Data Generated by the Services

• AI-generated outputs: proposed marks and per-question mark allocations, written feedback, annotations positioned on an image of the submitted work, generated practice questions and their marking schemes, and assistant responses.
• Teacher decisions: score overrides, annotation edits, review comments, the record of who released a result and when, and the outcome of any appeal.
• Learning progression data: per-skill accuracy statistics derived from answered questions, assignment grades, and the mastery view built from them.
• Classroom relationships: course and classroom membership, and teacher and co-instructor assignments.
• Notification records: in-app notifications, announcements posted to a class or course, and your email-notification preference.

Learning progression data may in some cases reveal information about a student's educational needs or learning profile. We treat such data with particular care — see Section 11.

4.5 Data We Receive from Institutions and Local Partners

• From institutions: class lists and the names, email addresses, year or grade levels and school-issued numbers of teachers and students, used to provision accounts.
• From local partners (see Section 8.2): records of parental or guardian consent and student assent collected on our behalf, account provisioning details, and support requests, feedback and incident reports relayed from schools, teachers, students and parents. Local partners relay identifiable data only where reasonably necessary and covered by the relevant consent.

5. How We Use Personal Data

5.1 Providing and Operating the Services

• To create and manage your account and verify your identity.
• To provide, operate, secure and maintain the Website, Platform and Services.
• To process submitted work through TinyMark, including optical character recognition, AI-assisted marking, and the generation of feedback and annotations for a teacher to review.
• To generate practice questions and mastery statistics through TinyQ.
• To route notifications and announcements to the people they concern.
• To respond to enquiries you send us through the Website.
• To monitor for and prevent fraudulent activity, misuse and security incidents.
• To carry out quality assurance on the outputs of the Services — for example, reviewing marking accuracy — so that we can improve how the Services perform.
• To work with our local partners to onboard schools, collect and record consent, provide support, and administer pilots and subscriptions.

5.2 AI Model Training

We develop our own AI models to improve the accuracy of marking, feedback and practice questions. Whether your data may be used to train or fine-tune those models depends on the type of account it was submitted through.

Institution-linked accounts. Data submitted through an account provisioned by or linked to a school or institution is not used to train or fine-tune any model we own, unless the institution has agreed to this in a signed written agreement with us. Where it has, that agreement sets out which data may be used, and the institution is responsible for informing students and their families and obtaining any consents required (see Sections 11 and 15). For a school served through a local partner, we additionally do not use identifiable data for training unless separate, explicit consent covering that use has been obtained from each parent or guardian (and student assent where appropriate) through the partner.

Individual accounts, users aged 18 or over. If you hold an individual account and are 18 or over, we may use your Training Data (defined below) to train and fine-tune our own models. We tell you this at registration, and you can opt out at any time in your account settings.

Individual accounts, users under 18. We do not use a minor's data for model training unless their parent or guardian has opted in, either at registration or later in account settings. The parent or guardian can withdraw this at any time.

Third-party AI providers. We use third-party AI models provided by Google Cloud (Vertex AI and Document AI) to process submitted work, under Google Cloud's enterprise terms. Those terms commit Google not to use customer data to train or fine-tune its own models: the Training Restriction in the Google Cloud Service Specific Terms states that “Google will not use Customer Data to train or fine-tune any AI/ML models without Customer's prior permission or instruction.”

We have not given Google any such permission or instruction, and we will not do so without first updating this Policy and telling you. Where we train or fine-tune our own models on Google Cloud infrastructure, the data remains Customer Data under those terms and the resulting models are for our use only.

5.3 Communications

• Transactional communications: account verification, invitations, password resets and service-related notices. These are sent to all users and cannot be opted out of while your account is active.
• Service notifications: notifications about your own work — a result being released, an appeal being answered, a new assignment or an announcement in your class. These are delivered in the Platform and, unless you turn email off, by email. You may switch email notifications off at any time in your account settings; the in-app notification remains.
• Product updates: information about new features or changes to the Services. You may opt out in your account settings.

We do not send marketing emails, and we do not serve advertising of any kind.

6. Legal Bases for Processing

• Contractual necessity: processing required to provide the Services you or your institution have registered for, including account management, marking and feedback, and delivery of results.
• Consent: processing based on your freely given, specific and informed consent, including consent to the processing of submitted work outside Singapore as described in Section 10, consent given by a parent or guardian to model training on a minor's data, consent given by an institution in a signed agreement to model training, and, for minors, the consent given by a parent or guardian. Consent may be withdrawn at any time without affecting the lawfulness of prior processing.
• Deemed consent by notification: for adult individual accounts, the use of Training Data for model training as described in Section 5.2, where we have notified you of that purpose and you have not opted out.
• Legitimate interests: processing for the purposes of securing the Services, preventing fraud and misuse, and assuring the quality of the Services, where such interests are not overridden by your rights and interests.
• Legal obligation: processing required to comply with applicable laws or regulatory requirements.

7. Cookies and Similar Technologies

7.1 The Platform

The Platform sets two cookies, both strictly necessary:

• te_id_token — carries the signed identity token issued by Google Cloud Identity Platform so that your session persists between page loads. Cleared when you sign out.
• csrf_token — protects against cross-site request forgery on state-changing requests.

These are required for the Platform to function and cannot be disabled while you are signed in. The Platform does not use analytics cookies, advertising cookies, or any third-party tracking technology.

7.2 The Website

www.tinyeqn.com sets no cookies of its own and uses no analytics or advertising technology. Fonts and other assets are served from our own infrastructure rather than from a third-party font service, so simply browsing the Website sends no data to any third party.

One third-party service is loaded, and only on the pages that carry a form:

• Google reCAPTCHA — used on our contact and event sign-up forms to distinguish genuine enquiries from automated abuse. Google collects device and interaction data, including your IP address, for that purpose and may set cookies. It is subject to Google's own privacy policy.

We do not receive personal data from reCAPTCHA beyond the result of the check (whether a submission passed).

8. Data Sharing and Disclosure

8.1 Service Providers

We share personal data with the following service providers, who process it on our behalf under contract:

We do not sell personal data, and we do not share it with third parties for their own marketing or model-training purposes.

We also engage personnel through staff augmentation arrangements with companies in other countries in the region, such as Myanmar and Malaysia. These personnel work under our direction, access personal data only as needed for the work assigned to them, and are bound by written confidentiality and data protection obligations.

The Platform also uses a curriculum knowledge graph hosted within our own private network. It stores subject knowledge — skills, prerequisites and past-paper examples — and contains no personal data.

8.2 Local Partners

In some countries we work with a local partner that coordinates the deployment of the Platform to schools and institutions. A local partner acts as the first point of contact for the school, its teachers and its students' parents or guardians; collects parental or guardian consent and student assent using forms and notices we have approved; provides first-line support; relays feedback and incident reports to us; and, for paid pilots and subscriptions, invoices and collects fees from the school.

To do this, a local partner may receive or access the personal data it needs for those purposes, including the names and contact details of teachers, students and parents, consent and assent records, and support requests. Each local partner is contractually required to use personal data only for those purposes, apply data minimisation, keep it confidential, comply with the data protection laws of its country and, where applicable, of Singapore, notify us of any personal data breach within forty-eight (48) hours, and allow us to audit its consent records and data protection controls. A local partner may not subcontract this work without our written consent.

Our current local partners are:

We will update this list when we appoint a local partner in another country. Every local partner is appointed on the same data protection terms.

8.3 Institution-Linked Accounts

Where an account is provisioned by or linked to a school or institution, User Data — including submitted work, marks, feedback, progression data and appeals — will not be disclosed to any third party other than the service providers listed in Section 8.1 and, where applicable, the local partner serving that institution (Section 8.2), without the prior written consent of the relevant institution, except where required by applicable law.

Within the institution, results are visible to the teachers responsible for the relevant class or course, and to institution administrators within that institution's own scope. Staff of a local partner serving the institution may access account and support information to the extent needed for their role under Section 8.2.

8.4 Individual Accounts

User Data collected from individual accounts will not be disclosed to third parties for their own purposes, except to the service providers described in Section 8.1 and as otherwise required by law.

8.5 Legal Disclosures

We may disclose personal data to government authorities, law enforcement, or other third parties where required or permitted by applicable law, including in response to a court order or regulatory request, or to protect the rights, property, or safety of Tiny Equations, our users, or the public.

8.6 Business Transfers

In the event of a merger, acquisition, restructuring, or sale of all or substantially all of the assets of Tiny Equations, personal data held by us may be transferred to the acquiring entity, subject to equivalent data protection commitments.

9. AI-Assisted Marking and Human Review

TinyMark produces a proposed mark. What happens to that proposal depends on whether the work belongs to a class, so this section sets out the three situations separately. The difference matters: in one of them no teacher is involved at all.

9.1 Personal practice — work you upload for yourself

Any account holder can upload their own work for marking without it being attached to a class assignment. This is how the Platform works for a student who has no teacher on it, and it is also available to students who do.

• The result is shown to you immediately, because there is no classroom instructor responsible for reviewing or releasing it.
• No teacher reviews it. A mark produced this way is the output of automated processing alone.
• It is not a grade. It is not reported to any school, does not enter any assessment record, and has no academic consequence.
• Who can see it: you, and — if you are linked to a teacher on the Platform — that teacher, who can view the submissions of students linked to them. If you have no linked teacher, only you can see it.
• The appeal route in 9.2 does not apply, because an appeal is directed to a responsible teacher and there is none. If you believe a personal-practice result is wrong, you can disregard it, submit again, or contact us at support@tinyeqn.com.

Because no person checks it, personal-practice marking should be treated as a study aid rather than an authoritative assessment.

9.2 Work you submit to an assignment your teacher created

• A teacher reviews the result. They can change any individual question score, edit or remove any annotation, and add comments.
• Results are private until released. The marked submission is not visible to you until a teacher explicitly releases it. Until then no mark is shown, and a withheld mark is recorded as absent rather than as zero.
• You can challenge a released mark. An appeal can be raised against the result as a whole or against individual questions, with a comment on each. Appeals are routed to the responsible teacher and tracked to a resolution. A teacher may open or close appeals for a given assignment; where they have closed them, existing appeals remain open and manageable.

9.3 Work your teacher uploads on your behalf

A teacher may scan a whole class's written work as a single document and upload it themselves, in which case you submit nothing.

• The teacher confirms who each page belongs to before anything is marked. The Platform proposes which pages belong to which student, using the identification written on the page, and the teacher checks and corrects those matches. No marking starts until they confirm.
• After that it is identical to 9.2: the result is private until the teacher releases it, the teacher can override any score or annotation, and the same appeal rights apply once it is released.

9.4 In all three cases

The system flags its own uncertainty. Where automated marking is low-confidence, or the evidence on the page is ambiguous, the result is marked as needing manual review rather than presented as a confident mark.

Where an institution uses the Platform, responsibility for how released marks are used in the institution's own assessment and reporting remains with the institution.

10. International Data Transfers

Application personal data — accounts, classes, assignments, submitted work, marks and feedback — is stored and processed on Google Cloud infrastructure in Singapore (asia-southeast1).

The following processing takes place outside Singapore:

• AI processing. Submitted work and text derived from it are sent to Google's Vertex AI service for marking, feedback and question generation and, where permitted under Section 5.2, for training and fine-tuning our own models, on Google's global Vertex AI endpoint rather than a Singapore-only endpoint.
• Optical character recognition. Images of submitted work are sent to Google Document AI for text and layout extraction. The Document AI processor is currently located in the United States.
• Authentication. Google Cloud Identity Platform is a global service and is not confined to a single region.
• Email delivery. Transactional, notification and enquiry email is delivered through Resend, whose processing region for our account is Tokyo, Japan (ap-northeast-1).
• Website services. Firebase App Hosting and Google reCAPTCHA operate on Google's global infrastructure and receive technical data, including IP addresses, from visitors to the Website.
• Local partners. Where a school is served by a local partner, personal data is exchanged between us in Singapore and the partner in its country — for example, consent records and support requests sent to us, and account information the partner accesses to provide support. These transfers are made in accordance with the PDPA and the cross-border transfer requirements of the partner's country, including the Malaysia PDPA.
• Authorised personnel outside Singapore. Some of our staff and contractors, including personnel engaged through staff augmentation arrangements, work from other countries in the region, such as Myanmar and Malaysia. Where their role requires it — for example, manually de-identifying Training Data, providing support, or maintaining the Platform — they may remotely access personal data held in Singapore, including identifiable submitted work. Access is restricted to authorised personnel and is subject to written confidentiality and data protection obligations.

In practical terms, the data that leaves Singapore is the content of work submitted for marking — the image of the page and the text extracted from it — together with the account identifiers needed to sign in, the email addresses needed to deliver notifications, and the information local partners need for their role, de-identified Training Data used to train our models where permitted under Section 5.2, and data accessed remotely by our authorised personnel outside Singapore. Otherwise, marks, feedback, class records and all other application data are stored in Singapore.

This reflects our current configuration, which we have set deliberately. We keep it under review and will update this Policy if it changes. If your institution requires AI and OCR processing to be confined to a particular region, please contact our Data Protection Officer to discuss it before submitting data to the Platform.

By using the Services and accepting this Privacy Policy, you consent to your personal data being transferred to and processed in these locations for these purposes. We take steps to ensure that such transfers are made in accordance with applicable data protection laws and that appropriate safeguards are in place, including standard contractual clauses or equivalent protections where required.

11. Learning Data and Educational Needs

The Services analyse student responses to generate per-skill accuracy statistics and, where TinyQ is enabled, to select appropriate practice questions. While the Services do not screen for or diagnose special educational needs, a student's pattern of responses and progression could in some cases be indicative of a particular learning profile.

Tiny Equations does not use this data to label or categorise students, or to make determinations about special educational needs. It is used to present progress to the student and their teacher, and to select suitable practice. Learning progression data is not included in Training Data.

Where accounts are institution-linked, the institution is responsible for ensuring that appropriate disclosures and consents are in place with students and their families regarding the collection and use of learning progression data and, where it has agreed to model training, the use of Training Data, in accordance with the institution's own obligations under applicable law.

We treat learning progression data with a heightened level of care and do not share it with third parties except as described in Section 8.

12. Data Retention

13. Your Rights

• Access: you may request a copy of the personal data we hold about you.
• Correction: you may request that we correct inaccurate or incomplete personal data.
• Deletion: you may request deletion of your personal data, subject to legal retention obligations and the periods described in Section 12. Deletion does not extend to de-identified Training Data already included in a training dataset (see Section 5.2).
• Withdrawal of consent: where processing is based on consent, you may withdraw it at any time. Withdrawal does not affect processing carried out before withdrawal, and may mean we can no longer provide some or all of the Services.
• Model training: if you hold an individual account, you may opt out of model training at any time in your account settings; for a minor, the parent or guardian may withdraw their opt-in at any time. Opting out does not affect your access to the Services.
• Communication preferences: you may switch off email notifications and product updates in your account settings at any time.

To exercise any of these rights, contact our Data Protection Officer at support@tinyeqn.com. We will endeavour to respond within thirty (30) calendar days, and may require verification of your identity first.

If you are a minor, requests should be made by your parent or legal guardian. Where your account was provisioned by an institution, we may need to direct your request to that institution, and will tell you if we do. If your school is served by a local partner, you may also make requests, including withdrawing consent, through that partner, who will pass them to us.

14. Data Security

We host our Services using Google Cloud Platform. Security is therefore shared between us: we manage and protect the data you put into the Platform, while Google Cloud is responsible for the physical and structural security of the underlying infrastructure. You can read more about how those security boundaries work at the Google Cloud Trust Center.

On our side of that boundary, Tiny Equations implements technical and organisational measures appropriate to the risk, including:

• Authentication through Google Cloud Identity Platform; we do not hold user passwords.
• Encryption of data in transit and at rest.
• A private database reachable only from our own application network, and private file storage with public access blocked at the bucket level.
• Access to uploaded work through short-lived, single-object authorisations issued only after the request has been authorised; files are never publicly addressable.
• Role-, class- and ownership-based access control applied server-side on every request.
• Manual de-identification of Training Data by a limited number of authorised staff or contractors before it enters a training dataset, and restricted access to training datasets.
• Rate limiting on password reset and other sensitive endpoints.
• Structured request logging with per-request identifiers, and dedicated security and audit log retention.

No method of transmission over the internet or electronic storage is completely secure. We cannot guarantee absolute security, except to the extent required by applicable law.

In the event of a personal data breach that is notifiable under applicable law, we will take appropriate steps in accordance with our legal obligations, including notifying affected individuals and the relevant regulatory authority where required.

15. Minors and Parental Consent

The Services are used by primary and secondary school students. Where an individual user is under 18 years of age, a parent or legal guardian is required to provide consent at the point of registration. The consent process asks the parent or guardian to provide their name and contact details and to confirm consent on behalf of the child, including consent to the collection and use of the child's personal data as described in this Policy and to the processing described in Section 10. The parent or guardian is also asked, as a separate and optional choice, whether the child's Training Data may be used for model training. This choice is off unless they select it.

We do not serve advertising to any user, and we do not profile users for advertising purposes.

Parents and guardians may exercise data rights on behalf of a minor at any time by contacting support@tinyeqn.com.

For institution-linked accounts, student accounts are provisioned in coordination with the relevant institution. Where a school is served by a local partner, the partner collects parental or guardian consent, and student assent where appropriate, on our behalf using forms and notices we have approved, and keeps records of that consent. Otherwise, it is the responsibility of the institution to ensure that all required parental or guardian consents are in place before student data is submitted to the Platform, including any consent required for model training where the institution has agreed to it.

16. Changes to This Privacy Policy

Tiny Equations reserves the right to update or amend this Privacy Policy at any time. Where changes are material, we will provide not less than seven (7) calendar days' advance notice by posting the updated Policy and, where reasonably practicable, by notifying registered users by email.

The date of the most recent update is reflected at the top of this document. Your continued use of the Services after the effective date of any updated Policy constitutes your acknowledgement of the changes.

17. Contact Us

If you have any questions, concerns, or complaints about this Privacy Policy or our data handling practices, or if you wish to exercise any of your rights under applicable data protection law, please contact:

We will endeavour to respond to all enquiries within thirty (30) calendar days of receipt.