Cookie Policy

ORYN Quest, Inc. ("ORYN Quest," "Company," "we," "our," or "us") provides this Cookie Policy ("Policy") to explain how cookies and similar technologies are used on the ORYN Quest platform, including our websites and mobile applications (the "Platform"). This Policy supplements the ORYN QUEST — PRIVACY POLICY.

The short version: the Platform sets essential cookies, and — only if you choose "Accept All" on the consent banner — Google Analytics cookies that count visits. We use no advertising cookies and no cross-site tracking, and the children's play area at /play uses no analytics and no cookie banner because nothing there requires one.

ARTICLE 1 — WHAT COOKIES AND SIMILAR TECHNOLOGIES ARE

1.1 Cookies

Cookies are small text files placed on your browser or device by a website. Cookies can be "first-party" (set by the site you are visiting) or "third-party" (set by another domain), and can be "session" cookies (deleted when you close your browser) or "persistent" cookies (retained until they expire or are deleted).

1.2 Local Storage

Local storage is a browser feature that lets a website store information on your device. Unlike cookies, local storage values are not automatically transmitted to servers with each request. The Platform uses local storage for certain on-device preferences and game state, as described in Article 3.

1.3 Mobile Applications

Our mobile applications do not set browser cookies of their own. Three parts of them are web pages: the map in the ORYN Quest app (described in Section 2.6); Lanti, our assistant, which in both apps opens our website in an in-app sheet; and, in the ORYN Business app, the vendor workspace, which is our website shown inside the app. These use the same essential sign-in cookies and session storage as the website (Sections 2.2 and 3.3), show no cookie banner, and never run the analytics described in Section 2.3. They use the platform-standard secure storage of your device to hold authentication session tokens — the functional equivalent of the essential cookies described in Article 2 — and on-device storage for the same preferences described in Article 3. The mobile applications contain no analytics library, and the analytics described in Section 2.3 does not run inside either app's embedded web pages. Everything else in this Policy (no advertising, no cross-site tracking) applies equally to the mobile applications.

1.4 Session Storage

Session storage is a browser feature much like local storage, with one difference: your browser clears it when you close the tab that created it. It is not a cookie, and it is not sent to our servers with each request. How the Platform uses it is described in Section 3.3.

ARTICLE 2 — COOKIES WE USE

2.1 Essential Cookies

Essential cookies are strictly necessary to operate the Platform and cannot be switched off within the Platform, because signing in, keeping your session secure and protecting your account depend on them. The sign-in cookies described in Section 2.2 are set on every visit. The one security cookie ORYN Quest sets itself, described in Section 2.7, is set only while you connect Google Calendar. The only other category in use — analytics (Section 2.3) — is set solely after you choose "Accept All" on the consent banner.

2.2 Authentication and Session Cookies (Clerk)

Our identity provider, Clerk, sets cookies to:

• keep you signed in to your account;
• maintain the security and integrity of your session;
• protect against fraudulent requests and session misuse; and
• route you to the correct role-based portal (parent, vendor, or administrator).

These cookies exist so the Platform can function. If you block them, you will not be able to sign in or use account features.

2.3 Analytics Cookies (Google Analytics, With Your Consent)

Since September 20, 2026, the website uses Google Analytics 4, provided by Google LLC, to count visits and understand which pages and articles help families and Vendors — for example, how many people read a blog post or reach the sign-up page, how many visits end with joining the waitlist or creating an account, how far businesses get through the vendor application, and from which search engine or link they arrived. It runs only if you choose "Accept All" on the consent banner; if you choose "Essential Only", or do not respond, no analytics script loads and no analytics cookie is set.

• Cookies set: "_ga" (distinguishes one browser from another; expires after two years) and "_ga_<container id>" (keeps the state of the current visit; expires after two years). Both are first-party cookies set on our domain.
• What is collected: pages viewed, the approximate time and order of views, how far a page is scrolled, the referring site, search engine or app, browser and device type, screen size, language, and an approximate location (city or region) that Google derives from the IP address at the moment of the request. Google Analytics 4 does not log or store individual IP addresses. It also records these moments, only as the fact that they happened: joining the launch waitlist (with whether it was as a family or a business), creating an account, and reaching each step of the vendor application and sending it (with the step's number and name only — for example "2-location" — and never anything entered in it).
• What is never sent: each page's address reaches Google without anything after the "?" in it, except campaign tags such as "utm_source" — so search words, filters (for example autism-friendly, sensory-friendly or wheelchair access, or a child's age), ZIP codes and map positions are removed before anything is sent. Private link codes and record numbers inside an address (for example a shared favorites link, or a child's or booking's page) are replaced with a placeholder. No search words, messages, form entries, email addresses or account identifiers are sent to Google Analytics. A page's title names the activity, business, community group or article on it; a community post, whose title names its author, is reported only as "Community Post".
• What is switched off: Google Signals, advertising personalization, and every advertising feature. The data is not used to build advertising profiles, is not combined with Google accounts, and is not shared with Google for its own purposes beyond operating the service for us. Google processes it as our service provider under the Google Ads Data Processing Terms.
• Retention: event-level data is kept by Google for fourteen (14) months, after which only aggregated reports remain (see the ORYN QUEST — DATA RETENTION POLICY).
• Where it never runs: in the children's play area at /play (Article 4), inside the ORYN Quest or ORYN Business apps, and when your browser sends a Global Privacy Control signal (Section 7.2). A visit that enters the play area switches analytics off for the rest of that visit.

What we still do not use, as of the Last Updated date above:

• NO advertising or ad-targeting cookies of any kind;
• NO cross-site tracking technologies, pixels, or social-media trackers;
• NO cookie-based profiling for marketing.

2.4 Cookie Reference Summary

For clarity, the complete set of cookie categories in use today is:

• Category: Essential (authentication and session)

Provider: Clerk (first-party operation of our sign-in system) Purpose: sign-in state, session security, request integrity, role-based routing Duration: session cookies expire when the session ends; persistent sign-in cookies expire on the identity provider's schedule or when you sign out

• Category: Essential (account security while connecting Google Calendar)

Provider: ORYN Quest (first-party), cookie "gcal_oauth_state" Purpose: confirming that a Google Calendar connection was started by you, to protect against forged requests Duration: deleted when the connection succeeds, and expires ten (10) minutes after it was set in any case; set only when you choose to connect Google Calendar

• Category: Retired (no longer set)

Provider: ORYN Quest (first-party), cookie "kp_group_ref" Purpose: set by earlier versions of the website when you visited a community group page, and never set now; if your browser still holds it, the website reads it once, moves the group it names into the session-storage note "oryn:group-ref" (Section 3.3) — except in the children's play area, where nothing is kept — and deletes the cookie Duration: deleted on your next visit; it never lasted more than thirty (30) days

• Category: Analytics (with consent)

Provider: Google Analytics 4 (Google LLC), first-party cookies "_ga" and "_ga_<container id>" Purpose: counting visits and page views, understanding which content and pages are useful, and where visitors arrive from; counting waitlist joins, new accounts, and how far businesses get through the vendor application Duration: two years from the last visit; set only after you choose "Accept All"; never in the children's play area

• Category: Advertising — NONE in use
• Category: Social media / cross-site tracking — NONE in use

2.5 Error Monitoring Without Tracking Cookies

We use Sentry for error monitoring so we can detect and fix defects. Sentry is not used to set advertising or cross-site tracking cookies. Error monitoring is disabled entirely in the children's play area (see Article 4). On non-kid-zone surfaces, session-replay diagnostics — used solely to reproduce and fix errors — cover only sessions in which an error occurs: your browser keeps up to the last minute of masked activity in memory and sends it, together with the rest of that session, only if an error is reported. We do not record a random sample of sessions.

Replay recordings mask text and media content, exist solely to reproduce and fix defects, are never shared with advertisers, and are never used to build profiles. The consent banner tells you about this diagnostic capture, and it begins for your session only after you have responded to the banner; it never operates in the kid zone. Session replay runs on the website only: our iOS and Android apps perform error monitoring with no session replay and no screen capture of any kind.

2.6 Third-Party Files Requested by the Map and by Embedded Videos (Not Cookies)

The interactive map on the website and in the iOS and Android apps is built on the open-source Leaflet library and OpenStreetMap imagery. Displaying it causes your browser, or the app's embedded map view, to request files directly from third-party servers: map tiles from the OpenStreetMap Foundation (tile.openstreetmap.org); from the unpkg.com content delivery network, served through Cloudflare's network, the Leaflet library and its stylesheet in the apps and Leaflet's map-marker images on the website (which bundles the library itself); and — in the apps only — the map-marker icon font from Google Fonts (fonts.googleapis.com and fonts.gstatic.com). Each request carries what every web request carries: your IP address and the file requested, which for map tiles identifies the map area you are viewing. No name, account identifier or cookie of ours is sent with them, we do not use them for tracking, and any cookies those operators may set through the request are governed by their own policies, not by us. The same recipients are listed in Section 9.2 of the ORYN QUEST — PRIVACY POLICY.

Some articles on our blog may show a video through YouTube's privacy-enhanced player (youtube-nocookie.com, operated by Google). Where a video is shown, your browser loads the player from Google's servers when the video comes close to the part of the page you are viewing — for a video near the top of an article, as soon as the article opens — and those requests carry your IP address, which video to show, and the address of our website (not the page you are reading). Once loaded, the player may contact other Google servers and store data on your device under YouTube's own domain even if you never press play, and more if you do. Google states that in this mode a viewer's watching is not used to personalize their YouTube experience and that any ads shown in the player are non-personalized. What the player does is governed by Google's own policies (policies.google.com/privacy), not by us; we receive nothing from it and do not use it for tracking. The same recipient is listed in Section 9.2 of the ORYN QUEST — PRIVACY POLICY.

2.7 One Security Cookie Set by ORYN Quest (Google Calendar)

ORYN Quest itself sets one essential cookie, "gcal_oauth_state", and only when you choose to connect Google Calendar to your account. It holds a random code created fresh each time you start connecting. When Google sends you back to us, we check that the code matches, which confirms the connection is the one you started and protects your account against forged requests. Scripts on the page cannot read it, it is never used for analytics or advertising, and it is deleted as soon as the connection succeeds; if the connection fails or is abandoned, it expires by itself ten (10) minutes after it was set.

ARTICLE 3 — LOCAL STORAGE AND SESSION STORAGE WE USE

3.1 Theme and Interface Preferences

Your light/dark theme preference and similar interface state — such as recent searches you have typed, prompts you have dismissed or snoozed, and panels you have collapsed — are stored in your browser's local storage. They stay on your device and are not cookies.

3.2 Kid Zone Game State

Game and town progress in the children's play area is stored only in local storage on the device, under five keys: "oryn-play" (game progress and badges), "oryn-play-art" (art studio creations), "oryn-town-quests" (town quest progress), "oryn-town-spot" (the last place visited in the town), and "oryn-town-sparks" (the day's collected sparks). This state never leaves the device and is never transmitted to our servers. Clearing your browser data removes it.

3.3 Session Storage (This Tab Only)

The website keeps a few short-lived notes in the browser tab's session storage, so that nothing is lost while you create an account. Your browser clears them when you close the tab, and most are deleted sooner, as soon as they have been used:

• "oryn:qr-code": the code of the printed ORYN Quest card or flyer you scanned to reach us;
• "oryn:group-ref": the ORYN Quest community group page that brought you to us, and when you opened it (written only while you are signed out, or once, from the retired "kp_group_ref" cookie described in Section 2.4);
• "oryn:vendor-ref": the referral code in a link a parent shared with a business;
• "oryn:signup-intent": that you started on the business sign-up page, so your new account is labelled as a business application;
• "oryn:signup-consent-ack": that you ticked the box agreeing to our terms before your account was created (it counts for one hour at most); and
• "oryn:webview-auth:evictions", "oryn:webview-auth:refused-tickets" and "oryn:webview-auth:loads": used only inside the ORYN Business app, to stop its sign-in hand-off from repeating in a loop and to tell our error monitoring when it does. They hold times and sign-in link identifiers, never a password or a sign-in link that works.

Each of the first five is used at most once — when a signed-in account claims the card, group or referral credit, the business-application label, or the terms you agreed to — and is deleted straight away, whether or not the claim is accepted. A note that is never used, for example because you close the tab before creating an account, stays only until the tab closes. None of these notes is written in the children's play area at /play, none is used for advertising, and none is shared with advertisers.

Our error-monitoring tool (Section 2.5) also keeps one note of its own in session storage while session replay runs, "sentryReplaySession": a random replay identifier and timestamps, never your text or media.

Only if you chose "Accept All", the website keeps one more note, "oryn:ga-sign-up-counted", after a new account is counted in Google Analytics (Section 2.3): the value "1" and nothing else, so that a reload or the return from a payment page does not count the same new account twice. It is never sent anywhere and is cleared when you close the tab.

Inside the ORYN Business app only, the website also keeps one note in local storage, "oryn:app-signing-out": the time at which the app began signing you out, so that no page signs you back in part-way through. It holds nothing but that time and is ignored fifteen seconds after it was set.

ARTICLE 4 — THE KID ZONE

The children's play area at /play (including all pages beneath it) is designed for zero data collection:

• no cookie consent banner is shown there, because no non-essential cookies are used there;
• no accounts, no advertising, no analytics, and no tracking of any kind — the analytics script described in Section 2.3 is not loaded on any page beneath /play, and a visit that navigates into the play area has analytics switched off for the rest of that visit;
• error monitoring (Sentry) is fully disabled for sessions that begin in the kid zone and is stopped when a session navigates into it; and
• the play area itself stores nothing on the device except the local storage described in Section 3.2; the essential sign-in cookies that Section 2.1 says are set on every visit, and the copy of our offline page and app icon that the website's service worker keeps in the browser's cache, are present there as on any other page and record nothing about play.

One thing is sent to our servers from the kid zone, stated here so the list above can be read literally. ORYN Town keeps two town-wide counters for the current calendar day: how many times the town was opened, and how many sparks all visitors collected together, so that a child playing alone can see others are playing too. They are plain numbers in a single shared daily record. No account, device identifier, session identifier, cookie, or IP address is stored with them, nothing is written per visitor, and nothing about them can be attributed to any person or device. They are not cookies and they are never used for advertising, recommendations, or profiling. The same disclosure appears in the ORYN QUEST — PRIVACY POLICY, Article 7, and the ORYN QUEST — CHILDREN'S PRIVACY POLICY, Article 3.

The full commitment appears in the ORYN QUEST — PRIVACY POLICY and the ORYN QUEST — CHILDREN'S PRIVACY POLICY.

ARTICLE 5 — THE CONSENT BANNER

5.1 Choices Offered

Outside the kid zone, the Platform presents a cookie consent banner offering two choices: "Accept All" or "Essential Only". The banner also tells you that our error-monitoring tool may capture a masked session replay when an error occurs, as described in Section 2.5; that diagnostic capture begins for your session only after you have responded to the banner.

5.2 Effect of Your Choice

"Accept All" sets the essential cookies and allows the analytics cookies described in Section 2.3. "Essential Only" sets the essential cookies and nothing else. Until you respond, only essential cookies are set. No analytics cookie is ever set before you have chosen "Accept All".

5.3 Changing Your Choice

Your choice is stored on your device. To change it, use the "Cookie preferences" control at the bottom of the Cookie Policy page, which clears your stored choice and shows the banner again, or delete this site's cookies and site data in your browser. Withdrawing consent stops further analytics collection; it does not delete data Google already holds, which expires on the schedule in Section 2.3.

5.4 Banner Not Shown in the Kid Zone

The banner is not shown in the children's play area, consistent with Article 4.

ARTICLE 6 — CHANGES TO COOKIE CATEGORIES

Analytics was introduced on September 20, 2026, following the steps below. If we introduce any further cookie category, we will first:

• (a) update this Policy to describe each new category, its purpose, and its provider;

• (b) update the consent banner so that non-essential cookies are set only in accordance with your choice; and

• (c) where the change is material, present the updated Policy for review through the Platform's versioned consent system described in the ORYN QUEST — PRIVACY POLICY.

We will not introduce advertising cookies directed at children under any circumstances.

ARTICLE 7 — MANAGING COOKIES IN YOUR BROWSER

7.1 Browser Controls

Most browsers let you view, block, and delete cookies through their settings, and let you clear local storage. If you block or delete essential cookies, you will be signed out and account features will not function. Because we do not serve third-party advertising cookies, there are no ad-network opt-outs required to use the Platform. Google also offers a browser add-on that blocks Google Analytics in every site you visit (tools.google.com/dlpage/gaoptout).

7.2 Do Not Track and Universal Opt-Out Signals

The Platform does not track users across third-party sites or services. A universal opt-out preference signal (Global Privacy Control) is honored as a choice of "Essential Only": when your browser sends it, the analytics described in Section 2.3 does not load even if you choose "Accept All". Browser "Do Not Track" settings are not a standardized signal, and our default operation (no cross-site tracking) already matches what they request.

ARTICLE 8 — RETENTION

Cookie lifetimes are set by their purpose: session cookies expire when your session ends, persistent authentication cookies expire on the schedule set by our identity provider or when you sign out, the Google Calendar security cookie (Section 2.7) lasts ten (10) minutes at most, and analytics cookies expire two years after your last visit. Local storage values remain on your device until you clear them; session storage (Section 3.3) is cleared by your browser when you close the tab. Retention of server-side personal information is described in the ORYN QUEST — DATA RETENTION POLICY.

ARTICLE 9 — RELATED POLICIES AND CHANGES

9.1 This Policy should be read together with the ORYN QUEST — PRIVACY POLICY, the ORYN QUEST — CHILDREN'S PRIVACY POLICY, and the ORYN QUEST — DATA RETENTION POLICY.

9.2 We may update this Policy from time to time. When we do, we will revise the "Last Updated" date and version above, and material changes will be presented through the Platform's versioned consent system and, where appropriate, by notice through the Platform or by email.

ARTICLE 10 — CONTACT

Questions about this Policy or our use of cookies may be directed to:

ORYN Quest, Inc. Email: support@orynquest.com Website: https://orynquest.com

END OF COOKIE POLICY