Cookie Policy

ORYN Quest, Inc. ("ORYN Quest," "Company," "we," "our," or "us") provides this Cookie Policy ("Policy") to explain how cookies and similar technologies are used on the ORYN Quest platform, including our websites and mobile applications (the "Platform"). This Policy supplements the ORYN QUEST — PRIVACY POLICY.

The short version: the Platform sets essential cookies, and — only if you choose "Accept All" on the consent banner — Google Analytics cookies that count visits. We use no advertising cookies and no cross-site tracking, and the children's play area at /play uses no analytics and no cookie banner because nothing there requires one.

ARTICLE 1 — WHAT COOKIES AND SIMILAR TECHNOLOGIES ARE

1.1 Cookies

Cookies are small text files placed on your browser or device by a website. Cookies can be "first-party" (set by the site you are visiting) or "third-party" (set by another domain), and can be "session" cookies (deleted when you close your browser) or "persistent" cookies (retained until they expire or are deleted).

1.2 Local Storage

Local storage is a browser feature that lets a website store information on your device. Unlike cookies, local storage values are not automatically transmitted to servers with each request. The Platform uses local storage for certain on-device preferences and game state, as described in Article 3.

1.3 Mobile Applications

Our mobile applications do not use browser cookies (the one embedded web view they contain — the map — is described in Section 2.6). They use the platform-standard secure storage of your device to hold authentication session tokens — the functional equivalent of the essential cookies described in Article 2 — and on-device storage for the same preferences described in Article 3. The mobile applications contain no analytics library, and the analytics described in Section 2.3 does not run inside the ORYN Business app's embedded web view. Everything else in this Policy (no advertising, no cross-site tracking) applies equally to the mobile applications.

ARTICLE 2 — COOKIES WE USE

2.1 Essential Cookies

Essential cookies are set on every visit. They are strictly necessary to operate the Platform and cannot be switched off within the Platform, because signing in and maintaining a secure session depend on them. The only other category in use — analytics (Section 2.3) — is set solely after you choose "Accept All" on the consent banner.

2.2 Authentication and Session Cookies (Clerk)

Our identity provider, Clerk, sets cookies to:

• keep you signed in to your account;
• maintain the security and integrity of your session;
• protect against fraudulent requests and session misuse; and
• route you to the correct role-based portal (parent, vendor, or administrator).

These cookies exist so the Platform can function. If you block them, you will not be able to sign in or use account features.

2.3 Analytics Cookies (Google Analytics, With Your Consent)

Since the Last Updated date above, the website uses Google Analytics 4, provided by Google LLC, to count visits and understand which pages and articles help families and Vendors — for example, how many people read a blog post or reach the sign-up page, and from which search engine or link they arrived. It runs only if you choose "Accept All" on the consent banner; if you choose "Essential Only", or do not respond, no analytics script loads and no analytics cookie is set.

• Cookies set: "_ga" (distinguishes one browser from another; expires after two years) and "_ga_<container id>" (keeps the state of the current visit; expires after two years). Both are first-party cookies set on our domain.
• What is collected: pages viewed, the approximate time and order of views, the referring site or search engine, browser and device type, screen size, language, and an approximate location (city or region) that Google derives from the IP address at the moment of the request. Google Analytics 4 does not log or store individual IP addresses.
• What is switched off: Google Signals, advertising personalization, and every advertising feature. The data is not used to build advertising profiles, is not combined with Google accounts, and is not shared with Google for its own purposes beyond operating the service for us. Google processes it as our service provider under the Google Ads Data Processing Terms.
• Retention: event-level data is kept by Google for fourteen (14) months, after which only aggregated reports remain (see the ORYN QUEST — DATA RETENTION POLICY).
• Where it never runs: in the children's play area at /play (Article 4), inside the ORYN Business app, and when your browser sends a Global Privacy Control signal (Section 7.2). A visit that enters the play area switches analytics off for the rest of that visit.

What we still do not use, as of the Last Updated date above:

• NO advertising or ad-targeting cookies of any kind;
• NO cross-site tracking technologies, pixels, or social-media trackers;
• NO cookie-based profiling for marketing.

2.4 Cookie Reference Summary

For clarity, the complete set of cookie categories in use today is:

• Category: Essential (authentication and session)

Provider: Clerk (first-party operation of our sign-in system) Purpose: sign-in state, session security, request integrity, role-based routing Duration: session cookies expire when the session ends; persistent sign-in cookies expire on the identity provider's schedule or when you sign out

• Category: Analytics (with consent)

Provider: Google Analytics 4 (Google LLC), first-party cookies "_ga" and "_ga_<container id>" Purpose: counting visits and page views, understanding which content and pages are useful, and where visitors arrive from Duration: two years from the last visit; set only after you choose "Accept All"; never in the children's play area

• Category: Advertising — NONE in use
• Category: Social media / cross-site tracking — NONE in use

2.5 Error Monitoring Without Tracking Cookies

We use Sentry for error monitoring so we can detect and fix defects. Sentry is not used to set advertising or cross-site tracking cookies. Error monitoring is disabled entirely in the children's play area (see Article 4). On non-kid-zone surfaces, session-replay diagnostics — used solely to reproduce and fix errors — cover approximately ten percent (10%) of sessions, plus sessions in which an error occurs.

Replay recordings mask text and media content, exist solely to reproduce and fix defects, are never shared with advertisers, and are never used to build profiles. The consent banner tells you about this diagnostic capture, and it begins for your session only after you have responded to the banner; it never operates in the kid zone. Session replay runs on the website only: our iOS and Android apps perform error monitoring with no session replay and no screen capture of any kind.

2.6 Third-Party Files Requested by the Map (Not Cookies)

The interactive map on the website and in the iOS and Android apps is built on the open-source Leaflet library and OpenStreetMap imagery. Displaying it causes your browser, or the app's embedded map view, to request files directly from third-party servers: map tiles from the OpenStreetMap Foundation (tile.openstreetmap.org); from the unpkg.com content delivery network, served through Cloudflare's network, the Leaflet library and its stylesheet in the apps and Leaflet's map-marker images on the website (which bundles the library itself); and — in the apps only — the map-marker icon font from Google Fonts (fonts.googleapis.com and fonts.gstatic.com). Each request carries what every web request carries: your IP address and the file requested, which for map tiles identifies the map area you are viewing. No name, account identifier or cookie of ours is sent with them, we do not use them for tracking, and any cookies those operators may set through the request are governed by their own policies, not by us. The same recipients are listed in Section 9.2 of the ORYN QUEST — PRIVACY POLICY.

ARTICLE 3 — LOCAL STORAGE WE USE

3.1 Theme and Interface Preferences

Your light/dark theme preference and similar interface state — such as recent searches you have typed, prompts you have dismissed or snoozed, and panels you have collapsed — are stored in your browser's local storage. They stay on your device and are not cookies.

3.2 Kid Zone Game State

Game and town progress in the children's play area is stored only in local storage on the device, under five keys: "oryn-play" (game progress and badges), "oryn-play-art" (art studio creations), "oryn-town-quests" (town quest progress), "oryn-town-spot" (the last place visited in the town), and "oryn-town-sparks" (the day's collected sparks). This state never leaves the device and is never transmitted to our servers. Clearing your browser data removes it.

ARTICLE 4 — THE KID ZONE

The children's play area at /play (including all pages beneath it) is designed for zero data collection:

• no cookie consent banner is shown there, because no non-essential cookies are used there;
• no accounts, no advertising, no analytics, and no tracking of any kind — the analytics script described in Section 2.3 is not loaded on any page beneath /play, and a visit that navigates into the play area has analytics switched off for the rest of that visit;
• error monitoring (Sentry) is fully disabled for sessions that begin in the kid zone and is stopped when a session navigates into it; and
• the only data stored on the device is the local storage described in Section 3.2.

One thing is sent to our servers from the kid zone, stated here so the list above can be read literally. ORYN Town keeps two town-wide counters for the current calendar day: how many times the town was opened, and how many sparks all visitors collected together, so that a child playing alone can see others are playing too. They are plain numbers in a single shared daily record. No account, device identifier, session identifier, cookie, or IP address is stored with them, nothing is written per visitor, and nothing about them can be attributed to any person or device. They are not cookies and they are never used for advertising, recommendations, or profiling. The same disclosure appears in the ORYN QUEST — PRIVACY POLICY, Article 7, and the ORYN QUEST — CHILDREN'S PRIVACY POLICY, Article 3.

The full commitment appears in the ORYN QUEST — PRIVACY POLICY and the ORYN QUEST — CHILDREN'S PRIVACY POLICY.

ARTICLE 5 — THE CONSENT BANNER

5.1 Choices Offered

Outside the kid zone, the Platform presents a cookie consent banner offering two choices: "Accept All" or "Essential Only". The banner also tells you that our error-monitoring tool may capture a masked session-replay sample, as described in Section 2.5; that diagnostic capture begins for your session only after you have responded to the banner.

5.2 Effect of Your Choice

"Accept All" sets the essential cookies and allows the analytics cookies described in Section 2.3. "Essential Only" sets the essential cookies and nothing else. Until you respond, only essential cookies are set. No analytics cookie is ever set before you have chosen "Accept All".

5.3 Changing Your Choice

Your choice is stored on your device. To change it, use the "Cookie preferences" control at the bottom of the Cookie Policy page, which clears your stored choice and shows the banner again, or delete this site's cookies and site data in your browser. Withdrawing consent stops further analytics collection; it does not delete data Google already holds, which expires on the schedule in Section 2.3.

5.4 Banner Not Shown in the Kid Zone

The banner is not shown in the children's play area, consistent with Article 4.

ARTICLE 6 — CHANGES TO COOKIE CATEGORIES

Analytics was introduced on the Last Updated date above, following the steps below. If we introduce any further cookie category, we will first:

• (a) update this Policy to describe each new category, its purpose, and its provider;

• (b) update the consent banner so that non-essential cookies are set only in accordance with your choice; and

• (c) where the change is material, present the updated Policy for review through the Platform's versioned consent system described in the ORYN QUEST — PRIVACY POLICY.

We will not introduce advertising cookies directed at children under any circumstances.

ARTICLE 7 — MANAGING COOKIES IN YOUR BROWSER

7.1 Browser Controls

Most browsers let you view, block, and delete cookies through their settings, and let you clear local storage. If you block or delete essential cookies, you will be signed out and account features will not function. Because we do not serve third-party advertising cookies, there are no ad-network opt-outs required to use the Platform. Google also offers a browser add-on that blocks Google Analytics in every site you visit (tools.google.com/dlpage/gaoptout).

7.2 Do Not Track and Universal Opt-Out Signals

The Platform does not track users across third-party sites or services. A universal opt-out preference signal (Global Privacy Control) is honored as a choice of "Essential Only": when your browser sends it, the analytics described in Section 2.3 does not load even if you choose "Accept All". Browser "Do Not Track" settings are not a standardized signal, and our default operation (no cross-site tracking) already matches what they request.

ARTICLE 8 — RETENTION

Cookie lifetimes are set by their purpose: session cookies expire when your session ends, persistent authentication cookies expire on the schedule set by our identity provider or when you sign out, and analytics cookies expire two years after your last visit. Local storage values remain on your device until you clear them. Retention of server-side personal information is described in the ORYN QUEST — DATA RETENTION POLICY.

ARTICLE 9 — RELATED POLICIES AND CHANGES

9.1 This Policy should be read together with the ORYN QUEST — PRIVACY POLICY, the ORYN QUEST — CHILDREN'S PRIVACY POLICY, and the ORYN QUEST — DATA RETENTION POLICY.

9.2 We may update this Policy from time to time. When we do, we will revise the "Last Updated" date and version above, and material changes will be presented through the Platform's versioned consent system and, where appropriate, by notice through the Platform or by email.

ARTICLE 10 — CONTACT

Questions about this Policy or our use of cookies may be directed to:

ORYN Quest, Inc. Email: support@orynquest.com Website: https://orynquest.com

END OF COOKIE POLICY