Children's Privacy Policy

ORYN Quest, Inc. ("ORYN Quest," "Company," "we," "our," or "us"), a Delaware corporation, operates the ORYN Quest platform (the "Platform"), a marketplace through which Parents and Guardians discover and book children's activities offered by independent Vendors. Because our service exists for families, we hold ourselves to a strict standard for children's information. This Children's Privacy Policy ("Policy") explains that standard, including how we approach the Children's Online Privacy Protection Act ("COPPA"), 15 U.S.C. 6501-6506, and its implementing rule.

This Policy supplements the ORYN QUEST — PRIVACY POLICY. Capitalized terms not defined here have the meanings given in the ORYN QUEST — TERMS OF USE and the ORYN QUEST — PARENT & GUARDIAN TERMS AND CONDITIONS.

ARTICLE 1 — OPERATOR IDENTITY

The operator of the Platform for purposes of COPPA is:

ORYN Quest, Inc. A Delaware corporation Email: support@orynquest.com Website: https://orynquest.com

All inquiries under this Policy, including parental requests described in Article 7, should be directed to support@orynquest.com.

ARTICLE 2 — THE CORE RULE: CHILDREN DO NOT HAVE ACCOUNTS

2.1 Adult-Only Accounts

Accounts on the Platform may be created and held only by adults eighteen (18) years of age or older. Children — including children under thirteen (13) — never have accounts, sign-in credentials, or profiles that they control on the Platform.

2.2 No Online Collection Directly from Children

The Platform is not directed to children for data-collection purposes, and we do not knowingly collect personal information online directly from children under thirteen (13). The Platform provides no mechanism for a child to submit personal information: there is no child registration, no child messaging, no child posting, and no child data entry anywhere on the Platform, including in the play area described in Article 3.

2.3 If We Learn of Direct Collection

If we learn that personal information has been collected online directly from a child under thirteen (13) without verifiable parental consent — for example, because a child created an account misrepresenting an age — we will delete that information and terminate the account promptly.

2.4 Minors Between Thirteen and Eighteen

The account rule is not limited to children under thirteen: no person under eighteen (18) may hold an account. Teen participants in Activities are, like younger children, represented on the Platform only through profiles their Parent or Guardian creates and controls.

ARTICLE 3 — THE KID ZONE: BUILT TO COLLECT NOTHING

3.1 Zero Collection

The Platform includes a children's play area at /play and pages beneath it, including games and the ORYN Town experience (the "Kid Zone"). The Kid Zone is engineered so that no personal information is collected there:

• no accounts and no sign-in of any kind;
• no advertising of any kind, ever;
• no per-visitor analytics, no tracking technologies, and no behavioral profiling;
• no microphone, camera, or voice input of any kind;
• no cookie consent banner, because no non-essential cookies are used there;
• error monitoring (Sentry) is fully disabled for sessions that begin in the Kid Zone and is stopped when a session navigates into it; and
• game progress is stored only in the browser's local storage on the device (keys "oryn-play" and "oryn-play-art") and is never transmitted to our servers.

One thing is sent to our servers from the Kid Zone, stated here so the list above can be read literally. ORYN Town keeps two town-wide counters for the current calendar day: how many times the town was opened, and how many sparks all visitors collected together. This is what lets the town show a child playing alone that others are playing too. These counters are plain numbers in a single shared daily record. No account, device identifier, session identifier, cookie, or IP address is stored with them; nothing is written per visitor; and nothing about them can be attributed to any person or device. They are never used for advertising, recommendations, or profiling of any kind.

3.2 No Child Data Displayed

The Kid Zone displays no child data of any kind. The ORYN Town "Main Street" experience displays Vendor business names only (with a city line on a door card). Vendor doors open ORYN Quest's own games — not Vendor websites.

3.3 The Grown-Up Gate

The only link from the Kid Zone to a Vendor page sits behind a grown-up gate that requires a deliberate press-and-hold confirmation designed for adults. Vendor placement in the Kid Zone is never paid, and nothing in the Kid Zone is an advertisement.

ARTICLE 4 — CHILD PROFILE INFORMATION IS PROVIDED BY PARENTS

4.1 How Child Information Reaches the Platform

The only child information on the Platform is information a Parent or Guardian chooses to record about their own Child, inside the Parent's own account, to use the marketplace. The Parent is the source of this information, controls it, and may edit or delete it at any time. Because the Parent provides this information directly, knowingly, and voluntarily within the Parent's account, parental consent is inherent in the act of providing it; we also record the Parent's acceptance of the ORYN QUEST — PRIVACY POLICY and this Policy under the Platform's versioned consent system.

4.2 What a Child Profile May Contain

At the Parent's option, a Child profile may include: the Child's name, date of birth or age, an avatar, interests, school type, goals, behavior traits and notes, accessibility and support information (such as an autism-friendly preference, a neurodivergence indicator, sensory support needs and tags, general support needs, vision or hearing impairment indicators, and wheelchair accessibility needs), and — only for insurance-based Activities the Parent pursues — optional insurance details (provider, policy number, and group code).

4.3 Sensitivity

We treat the accessibility, support, behavior, and insurance elements of a Child profile as sensitive information subject to the strict purpose limits of Article 5, regardless of whether a particular privacy law formally classifies them as sensitive.

4.4 Avatars, Achievements, and Certificates

A Child profile's avatar is selected by the Parent. Where a Vendor or the Platform records that a Child completed an enrolled Activity, a completion certificate record may be associated with the enrollment in the Parent's account. These records exist for the family's own use and are subject to the same purpose limits, disclosure limits, and deletion rights as the rest of the Child profile.

ARTICLE 5 — HOW CHILD PROFILE INFORMATION IS USED

5.1 Purposes

We use Child profile information only to:

• (a) help the Parent discover, match with, and book Activities suitable for the Child, including surfacing Accommodation-compatible options;

• (b) communicate Accommodation and support needs to a Vendor in connection with a Booking;

• (c) support insurance verification for insurance-based Activities that the Parent initiates;

• (d) operate Bookings, waitlists, waivers, attendance, and completion certificates;

• (e) power recommendations for the Parent, including interest profiles computed from in-app activity signals (searches, views, bookings) and profile embeddings generated for matching — subject to the Parent's opt-out described in Section 5.2; and

• (f) comply with legal obligations and enforce our agreements, including safety obligations under the ORYN QUEST — CHILD SAFETY POLICY.

5.2 Recommendations Opt-Out

Parents may opt out of behavioral activity-event collection and interest profiling at any time in account settings. The opt-out is honored end-to-end: while enabled, no new activity events are stored, no interest profiles are computed, and the assistant stops storing new personalization memories. Opting out does not affect the ability to use the Platform.

5.3 No Advertising Uses — Ever

We never use child information for advertising. We never engage in behavioral or targeted advertising directed at children, and we never will. We do not sell child information, and we do not share it for cross-context behavioral advertising.

5.4 No Diagnosis

AI features that draw on profile information produce activity recommendations and assistance only. They do not produce medical, psychological, developmental, or educational diagnoses, and nothing on the Platform should be treated as such. See the ORYN QUEST — AI FEATURES TERMS.

ARTICLE 6 — DISCLOSURE LIMITS FOR CHILD INFORMATION

6.1 Vendors

A Vendor receives only the child information reasonably necessary to deliver an Activity the Parent has booked: the Child's name and age, relevant participation details, and the Accommodation and support information the Parent has provided. For insurance-based Activities, the insurance details the Parent submits are shared with the relevant Vendor and reviewing administrators solely for verification. Vendors are contractually required to use child information only to deliver the booked Activity.

6.2 Service Providers

Child profile information is stored and processed by the infrastructure and AI service providers that operate the Platform on our behalf (identified in the ORYN QUEST — PRIVACY POLICY), under contractual limits restricting use to providing services to us.

6.3 The Public and the Kid Zone

Child profile information is never displayed on public pages by the Platform, never appears in the Kid Zone or on Main Street, and never appears in share cards or referral pages generated by the Platform.

6.4 Legal and Safety Disclosures

We may disclose child information where required or permitted by law, including to protect the safety of a child consistent with the ORYN QUEST — CHILD SAFETY POLICY (for example, cooperating with law enforcement or child protective agencies).

6.5 No Other Disclosures

We do not disclose child information to third parties for their own marketing or independent use.

ARTICLE 7 — PARENTAL RIGHTS AND CONTROLS

7.1 Review and Correction

A Parent may review and update Child profile information at any time through account settings.

7.2 Deletion

A Parent may delete a Child profile at any time through account settings, and may request deletion of the account and all associated personal information — including all Child profiles — through the instructions at https://orynquest.com/legal/data-deletion, through in-app settings, or by emailing support@orynquest.com from the email address on the account. Legal and safety retention carve-outs are described in the ORYN QUEST — DATA RETENTION POLICY.

7.3 Refusal of Further Collection

Because all child information is Parent-provided, a Parent may stop further collection at any time by not providing further information, enabling the personalization opt-out (Section 5.2), removing Child profiles, or closing the account.

7.4 No Conditioning

We do not condition a child's ability to enjoy the Kid Zone on the disclosure of any information — the Kid Zone collects nothing and requires no account. Parents provide only the profile information they choose in order to use marketplace features.

7.5 Verification

We honor requests concerning child information when made from the Parent's account or verified account email. We may take reasonable steps to confirm that the person making a request is the account-holding Parent or Guardian before acting.

7.6 Timing

We act on verified parental requests promptly and within any timeframe required by applicable law, and we will tell the Parent if any portion of the requested information must be retained under a legal or safety carve-out and why.

ARTICLE 8 — SCHOOL OFFICIALS

The Platform is a consumer service used directly by Parents and Guardians. We do not operate in or through schools, and we do not rely on any school-official consent mechanism under COPPA. If that ever changes, this Policy will be updated first.

ARTICLE 9 — RETENTION AND SECURITY

9.1 Child profile information is retained while the Parent's account is active and the profile exists, and is deleted on request as described in Article 7, subject to the legal and safety carve-outs in the ORYN QUEST — DATA RETENTION POLICY.

9.2 We protect child information with the same safeguards described in the ORYN QUEST — PRIVACY POLICY, including role-based access separation and purpose-limited sharing. We do not retain child information longer than reasonably necessary for the purposes described in this Policy.

ARTICLE 10 — RELATED POLICIES AND CHANGES

10.1 This Policy works together with the ORYN QUEST — PRIVACY POLICY, the ORYN QUEST — CHILD SAFETY POLICY, the ORYN QUEST — COOKIE POLICY, and the ORYN QUEST — DATA RETENTION POLICY.

10.2 We may update this Policy from time to time. When we do, we will revise the "Last Updated" date and version above. Material changes will be presented for review and re-acceptance through the Platform's versioned consent system, and we may provide additional notice by email or through the Platform. We will not materially weaken the Kid Zone commitments in Article 3 without prominent advance notice to Parents.

ARTICLE 11 — CONTACT

Parents and Guardians may contact us with any question or request concerning children's information:

ORYN Quest, Inc. Email: support@orynquest.com Website: https://orynquest.com

Please include "CHILDREN'S PRIVACY" in the subject line so we can prioritize your request.

END OF CHILDREN'S PRIVACY POLICY