Privacy policy

Effective 12 October 2026

Nmimes is a maths learning app for pupils and their parents. This policy explains what we collect, why, who helps us run the app, how long we keep things, and how a parent can have everything deleted. It covers the Nmimes app for Android and iOS, offered in Tunisia.

1. Who we are

Nmimes is run by Eya Ben Nessib, in Tunisia, who decides how your data is used (the "controller").

Contact for anything in this policy: contact@nmimes.com.

2. Who the app is for

Nmimes is made for pupils in 7th, 8th and 9th grade (about 12 to 15 years old) and for their parents. A child cannot create an account. A parent creates their own account first, then an account for each child.

3. What we collect

From a parent

First name, last name and email address
A 4-digit PIN, which we only store in scrambled (hashed) form

About a child, entered by the parent

First name, a username and school grade
An interest, if the parent picks one
A 4-digit access code, stored only in hashed form

While a child uses the app

Learning progress: lessons, quizzes, challenge results, points, badges, streaks, topics practised and answers given
The avatar chosen in the app (a drawing, never a photo)
Homework photos taken with Snap, and the exercise text and solution the AI produced from them
Questions asked to the AI tutor
Messages, photos and voice notes sent in study rooms (if the parent allows them; see section 9)
Reports the child makes about a message or an AI answer

From the phone

A notification token, when notifications are on
The app language
Technical data that Google's ad software collects on its own (section 8)

We do not collect phone numbers, precise location, contacts, or the device's advertising ID.

4. Parental consent

Only a parent can create accounts. The parent confirms their email address with a code we send to it, sets a PIN, and then creates each child's account with a username and access code. By doing this the parent consents, on the child's behalf, to the processing described here. The parent can see the child's progress, turn study rooms and notifications on or off, and delete the child's account at any time.

5. Why we use it

To create and secure accounts
To save progress and show points and badges
To read a homework photo and explain the exercise
To answer questions in the AI tutor
To deliver study-room messages to the other members
To send reminders, when a parent turns notifications on
To show the ads that keep the app free (section 8)
To keep the app safe: review reports, stop abuse, fix problems

We do not sell data, and we do not use children's data to build advertising profiles.

6. Artificial intelligence

Homework photos are sent to Anthropic (the Claude model) to read the exercise and write the explanation. We do not keep the photo afterwards, only the text of the exercise and the explanation. Under Anthropic's standard API terms, what we send is not used to train its models and is deleted within 30 days.
Tutor questions go to AgentFlow, our own AI tutor service, which runs on Microsoft Azure in France (France Central region). It receives the question and an account number, not the child's name, keeps the conversation for 7 days so the tutor can follow it, and does not use it to train any model.
AI answers can be wrong. Every answer has a "Report this answer" button, and we review every report (section 9).
Photos stored before 12 October 2026 are deleted automatically within 30 days of being taken. A parent can delete them sooner from the child's profile, and they are deleted with the account.

7. Who else receives data

These services work for us, under contract, and only receive what they need:

Supabase: hosts our database, sign-in and file storage, in Paris, France (EU).
Microsoft Azure: hosts our AI tutor service in France (EU).
Cloudflare: serves these web pages and our website.
Anthropic: reads homework photos, as described in section 6.
Google Firebase Cloud Messaging: delivers notifications to the phone.
Google AdMob and Google's consent tool: show ads (section 8).
Google ML Kit: the document scanner, which runs on the phone; the picture stays on the phone until the child sends it.

We may also disclose data when the law requires it, or to protect someone from serious harm.

8. Advertising

Nmimes is free and shows ads from Google AdMob. Every ad request tells Google that the app is directed to children and that the user is under the age of consent. Ads are never personalised, only ads rated G (general audience) are allowed, and the app does not ask for permission to read the device's advertising ID. Google's ad software still collects some technical data on its own, such as the IP address, device details and how an ad was viewed or tapped, to deliver ads and prevent fraud: see policies.google.com/technologies/partner-sites. When a child watches an ad for a reward, we pass Google a one-time random code so Google can confirm the ad was watched; it contains nothing that identifies the child.

9. What other children can see

Leaderboard: other children of the same grade see a child's username and points. Not the first name, not the grade.
Matches: the child they play against sees their first name and avatar.
Study rooms: children who share a room code can chat and, if the parent allows it, send photos and voice notes. Everyone in the room sees what is sent. Children are reminded not to share personal information, can report any message or member, and can block a member. A parent can turn study rooms, or just photos and voice notes, off for each child. A person at Nmimes reads every report: within 24 hours when a child may be at risk, when personal information was shared, or for bullying; within 72 hours otherwise.

10. How long we keep data

Accounts, progress and AI results: until the account is deleted.
Homework photos: at most 30 days.
AI tutor conversations: 7 days.
Study rooms: deleted, with their messages, photos and voice notes, 48 hours after the last message.
Reports: 90 days after they are reviewed.
Notification tokens: until sign-out or deletion.
Technical logs kept by our hosting provider (which can include IP addresses): 1 day.
Backups: our current hosting plan keeps no automatic backups. Before a change to the database we may make a one-off safety copy, which we delete within 30 days.

11. Deletion and your rights

A parent can delete the whole family's account, or one child's account, in the app: Settings → Delete account, or Edit child → Delete this child's account. Deletion is immediate and removes everything listed in section 3. Without the app, see how to request deletion.

A parent can also ask us for a copy of the data we hold, have it corrected, object to its use, or withdraw consent, by writing to contact@nmimes.com. We answer within 30 days. You may also complain to Tunisia's personal data protection authority, the Instance Nationale de Protection des Données Personnelles (INPDP).

12. Security

Data is encrypted in transit (HTTPS). PINs and access codes are stored only as hashes. Database rules make sure each family can only reach its own data, and files are private and served through short-lived links. Children's local session data is not included in phone backups. These pages use no cookies and no analytics.

13. Law that applies

Nmimes is offered in Tunisia and follows Tunisia's Organic Law No. 2004-63 of 27 July 2004 on the protection of personal data. Our hosting is in the European Union (Paris and France Central).

14. Changes

If we change this policy, we update the date above and tell parents in the app before the change applies.