Privacy Policy — Myzo Kids

Introduction

Myzo, LLC ("Myzo," "we," "us," or "our") operates the Myzo Kids mobile application (the "Kids App"), which children use under the direction of a parent or legal guardian to focus on homework and track their study progress. Myzo Kids is part of a two-app system: the parent or legal guardian sets up the family, provides consent, and manages the account through our companion Myzo Parents mobile application. For information about that companion app, see the Myzo Parents Privacy Policy.

This Privacy Policy describes what information the Myzo Kids app collects from and about your child, how we use and share that information, how we protect it, and the rights and choices you — as parent or legal guardian — have with respect to it. Because Myzo Kids is designed to be used by children, our practices are shaped first and foremost by the U.S. Children's Online Privacy Protection Act ("COPPA") and by our commitment to collecting only what is necessary to help children succeed in their studies.

By enabling the Myzo Kids app for your child, you accept the practices described here. Please read this Policy carefully and, if you have any questions, contact us at privacy@getmyzo.com before enabling the app for your child.

---

Table of Contents

1. Key Terms
2. COPPA & Parental Consent
3. How Child Accounts Are Created
4. Information the Myzo Kids App Collects
5. How We Use This Information
6. When We Share This Information with Third Parties
7. Sub-Processors and Service Providers
8. How to Access, Change, or Delete Your Child's Information
9. Account Cancellation and Data Deletion
10. Data Retention
11. Security
12. Location of Information Processing and International Transfers
13. State-Specific Privacy Rights
14. Additional Disclosures for Data Subjects in Europe and the United Kingdom
15. Children's Data — Summary for Parents
16. Third-Party Websites and Services
17. Do Not Track and Global Privacy Control
18. Changes to This Privacy Policy
19. Contact Us

---

1. Key Terms

For clarity throughout this Policy, the following terms have the meanings set out below.

• "Adult User" means any user who is age eighteen (18) or older, including parents, legal guardians, and any secondary guardian who has been invited by the primary guardian to access a Family Account. Adult Users interact with our Services through the Myzo Parents app, not through Myzo Kids.
• "Child User" means a user under the age of eighteen (18) whose account has been created and enabled by an Adult User. Where applicable, we further distinguish "Under-13 Child Users" (users under age thirteen) whose accounts are subject to COPPA.
• "Family Account" means the account created by an Adult User that contains one or more Child Users, together with the Adult User's own profile and any secondary guardians.
• "Personal Information" or "PI" means information that identifies, relates to, describes, or could reasonably be linked to a particular individual or household. This is the definition given by U.S. state privacy laws (including the California Consumer Privacy Act, or "CCPA"); non-U.S. residents should read this term to include "personal data" as defined under the EU General Data Protection Regulation ("GDPR") or the UK GDPR.

---

2. COPPA & Parental Consent

Myzo Kids is designed to be used by children under the direction of a parent or legal guardian. We comply with the Children's Online Privacy Protection Act (COPPA) and its implementing regulations.

Verifiable Parental Consent. We collect Personal Information from your child through the Myzo Kids app. Before that information is transmitted to Myzo's servers, we obtain verifiable parental consent from the child's parent or legal guardian through the Myzo Parents app. Consent is obtained through credit-card verification at the point at which the parent activates a subscription trial or paid subscription for the Services. This method is expressly recognized by the Federal Trade Commission's COPPA Rule as a permissible mechanism (16 C.F.R. § 312.5(b)(2)).

Trial mode before parental setup. A child may open the Myzo Kids app and try it out on their own device before a parent has completed setup. In this trial mode, the child can enter a first name and grade, create tasks, run focus sessions, and earn points. During trial mode this information is held on the child's device using the operating system's local application storage; it is transferred to Myzo's servers only after the parent completes onboarding through the Myzo Parents app, subscribes, and provides parental consent as described above. This arrangement is designed to satisfy COPPA's requirement (16 C.F.R. § 312.5(a)) that verifiable parental consent be obtained before Personal Information about a child is collected by an operator, since the information does not reach Myzo's servers until parental consent has been recorded.

No Family Account for the child alone. A child cannot create a Myzo Kids Family Account on Myzo's servers independently. Every Child User account on our servers must be created by a parent or legal guardian through the Myzo Parents app, who first accepts this Privacy Policy and provides parental consent as described above.

Parent controls. Parents may at any time:

• Review the Personal Information we have collected about their child;
• Direct us to correct or delete that Personal Information;
• Refuse to permit further collection or use of the child's Personal Information; and
• Withdraw consent previously given, causing the child's account to be closed.

See Section 8 for how to exercise these rights.

Notice to educators and schools. Myzo Kids is directed to families. We do not currently offer school-managed accounts or classroom integrations. If we begin to do so in the future, we will amend this Privacy Policy to describe those practices.

---

3. How Child Accounts Are Created

A Child User account on Myzo's servers is always created through the Myzo Parents app by the parent or legal guardian, after they accept this Privacy Policy and provide parental consent. There are two setup paths, both of which end with the same Child User account on our servers:

• Parent-first setup. The parent completes onboarding in the Myzo Parents app and adds the child there. The child then installs the Myzo Kids app and scans a pairing QR code that the parent app displays to bind their device to the newly-created Child User account.
• Child-first setup. The child installs and opens the Myzo Kids app first, enters a first name and grade, and uses the app in device-only trial mode (Section 2). When the child reaches a point in the app where continued use requires an account, the Kids app displays a QR code that the parent scans on their own device. Scanning that code opens the Myzo Parents app, where the parent completes onboarding, subscribes, and provides parental consent. Only at that point does the Child User account get created on Myzo's servers, and the child's on-device information (name, grade, tasks, sessions, points, achievements) is transferred to that account and stored on Myzo's servers. The QR code contains only an opaque random identifier and no Personal Information about the child.

In both paths, Child Users authenticate to the Myzo Kids app using a PIN chosen at setup (and optionally a device biometric such as Face ID or Touch ID). Child Users do not have a login credential such as an email address or password of their own.

Moving your child to a new device (device swap). As the parent, you may move your child from one device to another at any time from the Parents app by opening that child's Settings → Device Access → Swap Devices and displaying a new pairing QR code. When the new device scans that code, our servers atomically revoke the session on the prior device and issue a fresh, device-bound session to the new one. The prior device signs your child out on its next foreground check (within approximately thirty seconds) and returns to the Kids app welcome screen; no Child User data remains readable on the prior device after revocation.

Reusing a device for a different child (hand-me-down device). If a device previously paired to one child is later used to start a fresh setup for a different child (for example, an older sibling passes their old phone down to a younger sibling and the younger sibling taps "Start now" on the Kids app welcome screen), the Kids app clears the prior child's on-device state — including the prior session token, family identifier, cached first name and grade, trial-mode identifiers, and any locally stored achievement or first-session flags — before it writes any information about the new child. Server-side records for the prior child are unaffected by this on-device reset; if you wish to remove those records you must do so through the Parents app, as described in Section 9.

---

4. Information the Myzo Kids App Collects

We collect a deliberately minimal set of information from Child Users. In particular, we never collect a Child User's email address, telephone number, photograph, voice recording, video, precise or approximate geolocation, contacts list, or advertising identifier.

4.1 Information collected from the Child User

• First name only. We do not collect a Child User's last name.
• Age range (a bucketed range, not an exact date of birth) and a boolean flag indicating whether the child is under thirteen.
• Grade level (for example, "3rd grade"), used to size age-appropriate content. Grade level is not location-identifying.
• Avatar and color theme, chosen from a fixed catalog of vector-illustration avatars we provide. We do not accept user-uploaded photographs.
• Font-size and color-theme accessibility preferences.
• Device information for each device paired to the Child User: a device fingerprint, device platform, device label, biometric type enrolled (if any), a hashed PIN, and session-management fields (session token, session expiration, failed-PIN counter). We log authentication events (log-in, PIN failure, session revoked) with a timestamp, platform, and IP address for security purposes only.
• Push notification token used to deliver notifications to the Child User's device.
• Notification preferences, including bedtime alerts and audio-announcement settings.
• Application preferences, including break duration and score-tracking types.
• Assignment and study activity: the title and (optionally) description of homework assignments and sub-assignments (whether entered by the child or the parent), subject, due date, task status, scheduled date, notes attached to the task, and any free-text "delay," "cancel," or "completion" reasons the child or parent enters. We also record each focus-timer session and break, including duration, start and end timestamps, whether the session completed, and any free-text end reason.
• Grades and scores logged for the child, including subject, assignment name, grade format (letter or numeric), the score itself, and any free-text note the parent adds when logging the grade.
• Rewards and points: an append-only ledger of points earned or spent, a list of rewards the parent has offered the child, and the child's reward-redemption history.
• Achievements unlocked, together with the timestamp and any note from a parent who manually awarded an achievement.
• Flashcards the parent or child creates as study aids, including the question text, the answer text, the multiple-choice options (which may be generated on our behalf by an AI sub-processor from either the parent's uploaded scan or the child's own written question and answer, as described in Section 7), and per-card study statistics (times seen, times correct, mastery status). A child may also send a Flash Cards access request from the Kids app asking the parent to enable the feature or to allow the child to create their own sets; the request contains only the child's ID and family ID and is displayed to the parent inside the Parents app.

Consent record for the Child User. When a Child User is added to a Family Account, we log a corresponding consent record identifying the parent or guardian who provided COPPA parental consent, the timestamp, and the consent version, together with the parent's IP address and user-agent string.

4.2 Information collected automatically

When your child uses the Myzo Kids app, we and our service providers may automatically collect:

• IP address (for security, fraud prevention, and rate limiting; not stored on your child's user profile beyond the security-log purpose described in Section 4.1);
• App version, operating-system version, device model, and language preference;
• Timestamps of your child's activity in the app; and
• Anonymous analytics events (see Section 4.3).

4.3 Analytics

We use PostHog (PostHog Inc., United States) as our product-analytics provider. For Child Users, analytics events are associated with an anonymous session identifier that is minted per session and not persisted across log-outs. We do not send any Child User Personal Information — including first name, age, or family identifier — to PostHog. Events describe interactions with the app (for example, "started a focus block" or "checked off a sub-task") together with app version and platform.

PostHog automatically records approximate IP address for country-level geolocation and drops IP address from user profiles after processing.

4.4 Cookies and similar technologies

The Myzo Kids mobile application does not use cookies or cross-site tracking technologies.

4.5 Payment information

Myzo Kids does not collect any payment information from Child Users. Children do not have the ability to make purchases within the Kids App. All subscription and billing activity happens in the Myzo Parents app; see the Myzo Parents Privacy Policy for details.

4.6 How trial-mode information reaches our servers

When the app is used in trial mode (Section 2), the categories of information listed in Section 4.1 that the child enters or generates — first name, grade level, tasks and sub-tasks, focus sessions, points, achievements — are held on the child's device using the operating-system-provided local application storage. In addition, the Kids app generates a random identifier called a claim token that is stored only on the child's device and encoded into the QR code shown to the parent; the claim token contains no Personal Information and is used only to link the child's device to the Family Account the parent later creates.

When the parent completes onboarding through the Myzo Parents app, subscribes, and provides parental consent (Section 2), the child's on-device information is transferred to the newly-created Child User account on our servers, at which point it is treated identically to any other information described in Section 4.1. If the child never completes parent-side setup, the on-device information stays only on that device and is deleted when the app is uninstalled or the child's device is reset.

4.7 Bundled sample content

The Myzo Kids app ships with a small set of pre-authored practice flashcards (for example, basic math facts) that any child may play with as a demonstration of the flashcards feature. This bundled sample content is delivered as part of the app package itself and is not personalized, tracked, or associated with the child. Once the parent completes setup, the sample content becomes hidden and only the child's own flashcards (created through the parent's account) are shown.

---

5. How We Use This Information

We use the information described in Section 4 for the following purposes:

• To provide and operate the Myzo Kids app, including authenticating your child's account, syncing your family's data across devices, delivering the study, focus, reward, and flashcard features, and delivering push notifications your child has opted into.
• To personalize the experience for your child, including tailoring the app to their grade level, accessibility preferences, and score-tracking preferences.
• To operate and improve the Services, including diagnosing and fixing bugs, understanding aggregate usage patterns through the anonymous analytics described in Section 4.3, and testing new features.
• To comply with legal obligations, including responding to lawful requests from public authorities.
• To enforce our Terms of Service and protect the safety of our users, our Services, and the public.

We do not use Child User Personal Information to serve advertising to children, and we do not sell or share Child User Personal Information for any advertising or marketing purposes. We do not send marketing communications to Child Users.

---

6. When We Share This Information with Third Parties

We share your child's information only in the limited circumstances described below.

• With the members of your Family Account. Adult Users who are members of the same Family Account (for example, co-parents who have been invited as secondary guardians) can see the Child User's profile, tasks, grades, rewards, and achievements through the Myzo Parents app.
• With our sub-processors and service providers, as described in Section 7. These vendors are contractually restricted to processing information on our behalf and only for the purposes we specify.
• With push-notification providers (Apple Push Notification service and, for Android, Google Firebase Cloud Messaging) to deliver notifications to your child's device.
• In a business transaction. If Myzo is acquired by or merges with another company, we may transfer your information as part of that transaction. We will provide notice before your information is transferred and becomes subject to a different privacy policy.
• For legal reasons. We may disclose information if we believe in good faith that disclosure is necessary to comply with a subpoena, court order, or other legal process, to enforce our Terms of Service, or to protect the rights, property, or safety of Myzo, our users, or the public.
• With your consent, or as you otherwise direct.

We do not sell Personal Information as that term is defined under the California Consumer Privacy Act, and we do not share Personal Information for cross-context behavioral advertising. We do not disclose Child User Personal Information for any marketing or promotional purpose.

---

7. Sub-Processors and Service Providers

Myzo uses the following service providers to operate the Myzo Kids app. We have executed a Data Processing Agreement (DPA) with each sub-processor, including — where the sub-processor is located outside the European Economic Area, the United Kingdom, or Switzerland — the European Commission's Standard Contractual Clauses (or the equivalent transfer mechanisms recognized under the UK GDPR and the Swiss Federal Data Protection Act) as an appendix to that DPA. Each sub-processor is contractually obligated to protect the information we share, to process it only on our documented instructions, and to use it only for the purposes we specify. A current list of sub-processors is also published at /subprocessors.

AI processing for the Flash Cards feature. When a parent uses the Parents app to scan pages of homework, worksheets, or notes into a flash card set, or when your child writes a custom flash card in the Kids app, Myzo sends the scanned image or the child-authored question and answer text to Anthropic PBC over TLS. Anthropic returns candidate multiple-choice distractor answers, which Myzo saves alongside the card so your child can practice in quiz mode. Your child's first name, your email, your family ID, and every other account or profile field are never sent in the request. Under Anthropic's API data-retention policy, the content of the request is not retained after Anthropic returns its response and is never used to train Anthropic's models.

---

8. How to Access, Change, or Delete Your Child's Information

Parental review of Child User information. As the parent or legal guardian of a Child User, you may at any time review the Personal Information we have collected about your child, direct us to correct or delete that information, or refuse to permit further collection of your child's Personal Information. Most Child User information — including profile, tasks, grades, rewards, achievements, and flashcards — is directly viewable and editable within the Myzo Parents app. For any request we cannot fulfill in-app, please contact us at privacy@getmyzo.com.

We will respond to requests within the timeframes required by applicable law. For requests where identity verification is required, we may ask you to verify the email address on file, confirm your PIN through the Myzo Parents app, or provide other reasonable verifying information.

---

9. Account Cancellation and Data Deletion

You may cancel a Child User account, or your entire Family Account, at any time through the Myzo Parents app under Settings → Account → Delete Account, or by contacting privacy@getmyzo.com.

When a Child User account is deleted:

• All Child User records — including profile, devices, tasks, sessions, grades, rewards, achievements, flashcards, and points ledgers — are deleted from our production database.
• The event of deletion is recorded in our audit log.

Some information may be retained in encrypted backups for a limited period (up to seven days) before being purged, and we may retain a narrow set of records where required to comply with a legal obligation.

---

10. Data Retention

We retain Child User Personal Information for as long as the child's account is active and for as long as reasonably necessary to provide the Myzo Kids app, comply with legal obligations, resolve disputes, and enforce our agreements.

• Active accounts. We retain the child's account, profile, and study data for as long as the child's account is active within an active Family Account.
• Deleted accounts. When the child's account is deleted, we delete production data as described in Section 9. Encrypted disaster-recovery backups are retained for up to seven (7) days after deletion and are then purged.
• Consent records. Because consent records are our legal audit trail for parental consent under COPPA, they are retained for the life of the Family Account and are deleted together with the account.
• Anonymous analytics. Anonymized product-analytics events are retained by our analytics provider for the period set in their default retention policy (currently seven years). Because Child User events are not linkable to any individual, retention of these events is not a personal-data retention concern.

---

11. Security

We maintain a written information-security program appropriate to our size and to the sensitivity of the information we hold. Our security measures include, without limitation:

• Encryption of data in transit (Transport Layer Security) and at rest (AES-256) throughout our infrastructure;
• Row-Level Security enforced at the database layer, so that Child Users may access only their own records;
• Session tokens for Child Users that are device-bound, individually revocable by the parent, and automatically expiring;
• Hashed storage of PINs and passwords (bcrypt for parent passwords; SHA-256 for child PINs);
• Multi-factor authentication for administrative access to our production infrastructure;
• Regular review of access rights, security-advisor findings, and third-party-provider security posture; and
• A privacy manifest declared in each iOS build in accordance with Apple's App Store requirements.

No security program is perfect, and we cannot guarantee absolute security. In the event of a breach that affects Personal Information, we will notify affected users in accordance with applicable law.

---

12. Location of Information Processing and International Transfers

Myzo is headquartered in the United States, and our infrastructure is hosted primarily in the United States. If you access the Services from outside the United States, Personal Information about your child will be transferred to and processed in the United States, where privacy laws may differ from those in your country.

For users located in the European Economic Area, the United Kingdom, or Switzerland, we rely on the European Commission's Standard Contractual Clauses (SCCs), and the equivalent transfer mechanisms recognized under the UK GDPR and the Swiss Federal Data Protection Act, to safeguard Personal Information during transfer. The SCCs are incorporated as appendices to the executed Data Processing Agreements we hold with each of our sub-processors, as described in Section 7.

---

13. State-Specific Privacy Rights

Parents of Child Users who reside in the U.S. states listed below may exercise the privacy rights described in this section on behalf of their child.

13.1 California, Colorado, Connecticut, Utah, and Virginia

Residents of these states have the right to:

1. Know / access the categories and specific pieces of Personal Information we have collected about the child;
2. Correct inaccurate Personal Information we hold about the child;
3. Delete Personal Information we hold about the child, subject to statutory exceptions;
4. Portability — receive a copy of the child's Personal Information in a portable format;
5. Opt out of the "sale" or "sharing" of Personal Information for cross-context behavioral advertising. Myzo does not sell or share Personal Information for cross-context behavioral advertising.
6. Limit the use and disclosure of sensitive Personal Information. We do not process any Personal Information for the purpose of inferring characteristics about a consumer.
7. Non-discrimination — we will not charge you a different price, deny you Services, or provide a different quality of service because you exercised a privacy right.

To exercise any of these rights, contact us at privacy@getmyzo.com. If we deny your request, we will explain why, and (where applicable) you may appeal our decision within sixty (60) days by replying to our response.

13.2 Nevada

Nevada residents have the right, under Nevada Revised Statutes Chapter 603A, to direct us not to sell certain covered information. Myzo does not sell Personal Information as that term is defined by Nevada law.

---

14. Additional Disclosures for Data Subjects in Europe and the United Kingdom

If your child is located in the European Economic Area, the United Kingdom, or Switzerland, the following disclosures apply.

Data controller. Myzo, LLC is the data controller for Personal Information processed in connection with the Myzo Kids app.

Legal bases for processing. We rely on one or more of the following legal bases when processing Personal Information: contract (processing necessary to provide the Services), consent (parental consent under COPPA and applicable EU/UK laws), legitimate interests (operating, improving, and securing the Services), and legal obligation.

Your rights. In addition to the rights described in Sections 8 and 13, you have the right on behalf of your child to (a) access Personal Information, (b) request correction, (c) request erasure, (d) request restriction of processing, (e) object to processing based on our legitimate interests, (f) request data portability, and (g) withdraw consent at any time. You also have the right to lodge a complaint with your local supervisory authority.

International transfers. See Section 12.

---

15. Children's Data — Summary for Parents

• We collect the minimum information necessary to operate the app for your child. See Section 4.
• We do not collect a child's email address, telephone number, photograph, voice recording, video, contacts list, precise geolocation, or advertising identifier.
• We do not permit advertising to children on the Services. No third-party advertising networks are integrated into the Myzo Kids app.
• We do not sell or share Child User Personal Information for any marketing purpose.
• We do not permit peer-to-peer communication. Child Users cannot message other Child Users or any Adult User outside their own Family Account.
• You can review, correct, and delete your child's Personal Information at any time. See Section 8.
• You can revoke your parental consent at any time by deleting your child's account or your entire Family Account. See Section 9.

If you have questions or concerns about our practices with respect to Child Users, please contact us at privacy@getmyzo.com.

---

16. Third-Party Websites and Services

The Myzo Kids app does not contain in-app advertising and does not include links out to third-party websites or services.

---

17. Do Not Track and Global Privacy Control

The Myzo Kids mobile application does not respond to browser-based "Do Not Track" signals because such signals do not apply in a mobile-app context.

---

18. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we make a material change, we will notify the parent or legal guardian by email (to the address associated with the Family Account) or through a prominent notice within the Myzo Parents app before the change takes effect. The "Last Updated" date at the top of this Policy indicates when it was most recently revised.

---

19. Contact Us

If you have any questions or concerns about this Privacy Policy or our practices, or if you would like to exercise any of the rights described in this Policy, please contact us:

Myzo, LLC Attn: Privacy 116 Agnes Rd, Suite 200 Knoxville, TN 37919 United States

Email: privacy@getmyzo.com