Children's Privacy Policy

ORYN Quest, Inc. ("ORYN Quest," "Company," "we," "our," or "us"), a Delaware corporation, operates the ORYN Quest platform (the "Platform"), a marketplace through which Parents and Guardians discover and book children's activities offered by independent Vendors. Because our service exists for families, we hold ourselves to a strict standard for children's information. This Children's Privacy Policy ("Policy") explains that standard, including how we approach the Children's Online Privacy Protection Act ("COPPA"), 15 U.S.C. 6501-6506, and its implementing rule.

This Policy supplements the ORYN QUEST — PRIVACY POLICY. Capitalized terms not defined here have the meanings given in the ORYN QUEST — TERMS OF USE and the ORYN QUEST — PARENT & GUARDIAN TERMS AND CONDITIONS.

ARTICLE 1 — OPERATOR IDENTITY

The operator of the Platform for purposes of COPPA is:

ORYN Quest, Inc. A Delaware corporation 1501 Lynglen Drive Glendale, CA 91206, USA Phone: +1 (818) 439-9127 Email: support@orynquest.com Website: https://orynquest.com

All inquiries under this Policy, including parental requests described in Article 7, should be directed to support@orynquest.com.

ARTICLE 2 — THE CORE RULE: CHILDREN DO NOT HAVE ACCOUNTS

2.1 Adult-Only Accounts

Accounts on the Platform may be created and held only by adults eighteen (18) years of age or older. Children — including children under thirteen (13) — never have accounts, sign-in credentials, or profiles that they control on the Platform.

2.2 No Online Collection Directly from Children

The Platform is not directed to children for data-collection purposes, and we do not knowingly collect personal information online directly from children under thirteen (13). The Platform provides no mechanism for a child to submit personal information: there is no child registration, no child messaging, no child posting, and no child data entry anywhere on the Platform, including in the play area described in Article 3.

2.3 If We Learn of Direct Collection

If we learn that personal information has been collected online directly from a child under thirteen (13) without verifiable parental consent — for example, because a child created an account misrepresenting an age — we will delete that information and terminate the account promptly.

2.4 Minors Between Thirteen and Eighteen

The account rule is not limited to children under thirteen: no person under eighteen (18) may hold an account. Teen participants in Activities are, like younger children, represented on the Platform only through profiles their Parent or Guardian creates and controls.

ARTICLE 3 — THE KID ZONE: BUILT TO COLLECT NOTHING

3.1 Zero Collection

The Platform includes a children's play area at /play and pages beneath it, including games and the ORYN Town experience (the "Kid Zone"). The Kid Zone is engineered so that no personal information is collected there (Section 3.4 describes the ordinary web-request mechanics involved in delivering any page):

• no accounts and no sign-in of any kind;
• no advertising of any kind, ever;
• no per-visitor analytics, no tracking technologies, and no behavioral profiling;
• no microphone, camera, or voice input of any kind;
• no cookie consent banner, because no non-essential cookies are used there;
• error monitoring (Sentry) is fully disabled for sessions that begin in the Kid Zone and is stopped when a session navigates into it; and
• game and town progress is stored only in the browser's local storage on the device, under five keys: "oryn-play" (game progress and badges), "oryn-play-art" (art studio creations), "oryn-town-quests" (town quest progress), "oryn-town-spot" (the last place visited in the town), and "oryn-town-sparks" (the day's collected sparks) — and none of it is ever transmitted to our servers.

One thing is sent to our servers from the Kid Zone, stated here so the list above can be read literally. ORYN Town keeps two town-wide counters for the current calendar day: how many times the town was opened, and how many sparks all visitors collected together. This is what lets the town show a child playing alone that others are playing too. These counters are plain numbers in a single shared daily record. No account, device identifier, session identifier, cookie, or IP address is stored with them; nothing is written per visitor; and nothing about them can be attributed to any person or device. They are never used for advertising, recommendations, or profiling of any kind.

3.2 No Child Data Displayed

The Kid Zone displays no child data of any kind. The ORYN Town "Main Street" experience displays Vendor business names only (with a city line on a door card). Vendor doors open ORYN Quest's own games — not Vendor websites.

3.3 The Grown-Up Gate

The only link from the Kid Zone to a Vendor page sits behind a grown-up gate that requires a deliberate press-and-hold confirmation designed for adults. Vendor placement in the Kid Zone is never paid, and nothing in the Kid Zone is an advertisement.

3.4 What Loading Any Web Page Involves

Like every page on the internet, loading a Kid Zone page means the browser sends a standard web request — which includes an IP address — to the servers that deliver the page. We use that information solely to deliver the page and keep the service secure and functioning: the "support for the internal operations" that the COPPA Rule, 16 C.F.R. 312.5(c)(7), permits without parental consent. It is not stored with any Kid Zone activity, is not combined with the town counters described in Section 3.1, and is never used to track, profile, contact, or re-identify anyone. The zero-collection commitments in this Article describe everything beyond this ordinary mechanics of the web.

ARTICLE 4 — CHILD INFORMATION ON THE PLATFORM

4.1 Where Child Information Comes From

Children never submit information to the Platform. Child information reaches the Platform from three sources, and each source is limited to the purposes described in Article 5:

• (a) Parent-provided information. The core child record on the Platform is information a Parent or Guardian chooses to record about their own Child, inside the Parent's own account, to use the marketplace — the profile contents described in Section 4.2 and any session reflections the Parent writes about their own Child's experience. The Parent is the source of this information, controls it, and may edit or delete it at any time. Because the Parent provides this information directly, knowingly, and voluntarily within the Parent's account, parental consent is inherent in the act of providing it; we also record the Parent's acceptance of the ORYN QUEST — PRIVACY POLICY and this Policy under the Platform's versioned consent system.

• (b) Vendor session feedback. After a session the Parent has booked, the Vendor who delivered it may record structured feedback about the Child's participation: one-to-five ratings for engagement, focus, social interaction, and confidence; strength and challenge tags; whether the Vendor recommends repeating; and an optional short note. This feedback exists for the Parent's benefit — it appears in the Parent's account as part of the Child's progress and, unless the Parent has opted out under Section 5.2, feeds the developmental insights described in Section 5.1(f). It is never public and is never used for advertising.

• (c) Booking and participation records. Operating the marketplace creates records of the Activities a Child is enrolled in — bookings, attendance, waivers, and waitlists. These records exist to run those features and, unless the Parent has opted out under Section 5.2, contribute to the recommendations and insights described in Sections 5.1(e) and 5.1(f).

4.2 What a Child Profile May Contain

At the Parent's option, a Child profile may include: the Child's name, date of birth or age, an optional gender selection ("male," "female," or "prefer not to say") used to render the Child's avatar and as one recommendation signal, a profile picture (the avatar the Platform renders from that selection, or a photograph of the Child the Parent chooses to add — Section 4.4), interests, school type, goals, behavior traits and notes, accessibility and support information (such as an autism-friendly preference, a neurodivergence indicator, sensory support needs and tags, general support needs, vision or hearing impairment indicators, and wheelchair accessibility needs), and — only for insurance-based Activities the Parent pursues — optional insurance details (provider, policy number, and group code).

4.3 Sensitivity

We treat the accessibility, support, behavior, and insurance elements of a Child profile — and Vendor session feedback about a Child — as sensitive information subject to the strict purpose limits of Article 5, regardless of whether a particular privacy law formally classifies them as sensitive.

4.4 Avatars, Photographs, Achievements, and Certificates

A Child profile's picture is chosen by the Parent: either the avatar the Platform renders from the optional gender selection, or a photograph of the Child that the Parent adds from the Parent's own photo library or device. The app requests photo-library access only when the Parent taps to add a photo, and never opens the camera. A photograph is stored in the Platform's application file storage (operated by Convex) under a long random identifier that cannot be guessed; the link is never published, though anyone holding it could open it, which is why deletion removes the file itself rather than only the reference to it. The photograph is visible to the Parent within their own account and, for a session the Parent has booked, to the Vendor delivering that session so that staff can recognise the Child at check-in (Section 6.1). It is never displayed on public pages, never appears in the Kid Zone, is never used for advertising, is never used for facial recognition or any other biometric processing, and is never used to train an AI model. It is deleted when the Parent replaces or removes it, when the Child profile is deleted, and when the Parent's account is deleted.

Where a Vendor or the Platform records that a Child completed an enrolled Activity, a completion certificate record may be associated with the enrollment in the Parent's account. These records exist for the family's own use and are subject to the same purpose limits, disclosure limits, and deletion rights as the rest of the Child profile.

ARTICLE 5 — HOW CHILD INFORMATION IS USED

5.1 Purposes

We use the child information described in Article 4 only to:

• (a) help the Parent discover, match with, and book Activities suitable for the Child, including surfacing Accommodation-compatible options;

• (b) communicate Accommodation and support needs to a Vendor in connection with a Booking;

• (c) support insurance verification for insurance-based Activities that the Parent initiates;

• (d) operate Bookings, waitlists, waivers, attendance, and completion certificates;

• (e) power recommendations for the Parent, including interest profiles computed from in-app activity signals (searches, views, bookings) and profile embeddings generated for matching — subject to the Parent's opt-out described in Section 5.2;

• (f) compute developmental insights shown only to the Parent, refreshed by a weekly computation — per-domain skill observations (social, fine motor, gross motor, cognitive, creative, confidence, focus, and communication), each with a trend, blended from Vendor session feedback and the Parent's own reflections; and behavioral signals derived from booking history (such as preferred categories, times, and days, session frequency, cancellation and repeat-vendor rates, most-visited Vendor, and category variety) — subject to the same opt-out in Section 5.2; and

• (g) comply with legal obligations and enforce our agreements, including safety obligations under the ORYN QUEST — CHILD SAFETY POLICY.

5.2 Personalization and Insights Opt-Out

Parents may opt out of behavioral activity-event collection and interest profiling at any time in account settings. The opt-out is honored end-to-end: while enabled, no new activity events are stored, no interest profiles are computed, and the assistant stops storing new personalization memories. The same opt-out covers the developmental insights described in Section 5.1(f): the weekly computation skips the Parent's Children entirely, and it deletes any skill observations and behavioral signals already stored for them. Opting out does not affect the ability to use the Platform.

5.3 No Advertising Uses — Ever

We never use child information for advertising. We never engage in behavioral or targeted advertising directed at children, and we never will. We do not sell child information, and we do not share it for cross-context behavioral advertising.

5.4 No Diagnosis

AI features that draw on profile or session information — including the developmental insights described in Section 5.1(f) — produce activity recommendations, progress observations, and assistance only. They do not produce medical, psychological, developmental, or educational diagnoses, and nothing on the Platform should be treated as such. See the ORYN QUEST — AI FEATURES TERMS.

ARTICLE 6 — DISCLOSURE LIMITS FOR CHILD INFORMATION

6.1 Vendors

A Vendor receives only the child information reasonably necessary to deliver an Activity the Parent has booked — the Child's name, age and profile picture (the avatar or the Parent-added photograph, Section 4.4, so staff can recognise the Child at check-in), relevant participation details, and the Accommodation and support information the Parent has provided — and, where the Parent has placed the Child on the waitlist for one of the Vendor's sessions, only the child information reasonably necessary to administer that waitlist: the Child's first name, together with the Parent's name and the entry's position and status in line. For insurance-based Activities, the insurance details the Parent submits are shared with the relevant Vendor and reviewing administrators solely for verification. Session feedback described in Section 4.1(b) is authored by the Vendor and remains visible to that Vendor; if the Child profile is deleted, the feedback is de-identified as described in Section 7.2. Vendors are contractually required to use child information only to deliver the booked Activity and to administer the session roster or waitlist it relates to.

6.2 Service Providers

Child information is stored and processed by the infrastructure and AI service providers that operate the Platform on our behalf (identified in the ORYN QUEST — PRIVACY POLICY), under contractual limits restricting use to providing services to us.

6.3 The Public and the Kid Zone

Child information is never displayed on public pages by the Platform, never appears in the Kid Zone or on Main Street, and never appears in share cards or referral pages generated by the Platform.

6.4 Legal and Safety Disclosures

We may disclose child information where required or permitted by law, including to protect the safety of a child consistent with the ORYN QUEST — CHILD SAFETY POLICY (for example, cooperating with law enforcement or child protective agencies).

6.5 No Other Disclosures

We do not disclose child information to third parties for their own marketing or independent use.

ARTICLE 7 — PARENTAL RIGHTS AND CONTROLS

7.1 Review and Correction

A Parent may review and update Child profile information at any time through account settings.

7.2 Deletion

A Parent may delete a Child profile at any time through account settings, and may request deletion of the account and all associated personal information — including all Child profiles — immediately through Account → Delete account in the app or on the website, through the instructions at https://orynquest.com/legal/data-deletion, or by emailing support@orynquest.com (from the email address on the account where possible; a Parent who signed in with Apple using Hide My Email may instead confirm the request from inside the account or by replying to our confirmation sent to the relay address). Deleting a Child profile also permanently deletes any photograph of the Child from file storage, deletes the Parent's session reflections and all stored developmental insights for that Child, and strips Vendor session feedback of both the link to the Child and any free-text note, so the remaining ratings no longer identify the Child. Legal and safety retention carve-outs are described in the ORYN QUEST — DATA RETENTION POLICY.

7.3 Refusal of Further Collection

A Parent may stop further collection at any time: by not providing further profile information, by enabling the opt-out in Section 5.2 (which also deletes stored developmental insights), by removing Child profiles, or by closing the account. Vendor session feedback is created only for sessions the Parent books, so it stops when the Parent stops booking; feedback and records already created are removed or de-identified as described in Section 7.2.

7.4 No Conditioning

We do not condition a child's ability to enjoy the Kid Zone on the disclosure of any information — the Kid Zone collects nothing and requires no account. Parents provide only the profile information they choose in order to use marketplace features.

7.5 Verification

We honor requests concerning child information when made from the Parent's account or verified account email. We may take reasonable steps to confirm that the person making a request is the account-holding Parent or Guardian before acting.

7.6 Timing

We act on verified parental requests promptly and within any timeframe required by applicable law, and we will tell the Parent if any portion of the requested information must be retained under a legal or safety carve-out and why.

ARTICLE 8 — SCHOOL OFFICIALS

The Platform is a consumer service used directly by Parents and Guardians. We do not operate in or through schools, and we do not rely on any school-official consent mechanism under COPPA. If that ever changes, this Policy will be updated first.

ARTICLE 9 — RETENTION AND SECURITY

9.1 Child information described in this Policy is retained while the Parent's account is active and the related profile exists, and is deleted or de-identified on request as described in Article 7, subject to the legal and safety carve-outs in the ORYN QUEST — DATA RETENTION POLICY.

9.2 We protect child information with the same safeguards described in the ORYN QUEST — PRIVACY POLICY, including role-based access separation and purpose-limited sharing. We do not retain child information longer than reasonably necessary for the purposes described in this Policy.

ARTICLE 10 — RELATED POLICIES AND CHANGES

10.1 This Policy works together with the ORYN QUEST — PRIVACY POLICY, the ORYN QUEST — CHILD SAFETY POLICY, the ORYN QUEST — COOKIE POLICY, and the ORYN QUEST — DATA RETENTION POLICY.

10.2 We may update this Policy from time to time. When we do, we will revise the "Last Updated" date and version above. Material changes will be presented for review and re-acceptance through the Platform's versioned consent system, and we may provide additional notice by email or through the Platform. We will not materially weaken the Kid Zone commitments in Article 3 without prominent advance notice to Parents.

ARTICLE 11 — CONTACT

Parents and Guardians may contact us with any question or request concerning children's information:

ORYN Quest, Inc. Email: support@orynquest.com Website: https://orynquest.com

Please include "CHILDREN'S PRIVACY" in the subject line so we can prioritize your request.

END OF CHILDREN'S PRIVACY POLICY