Privacy Policy — Myzo Parents

Introduction

Myzo, LLC ("Myzo," "we," "us," or "our") operates the Myzo Parents mobile application (the "Parents App") and the marketing website located at kids.getmyzo.com. The Parents App is the companion to our children's app, Myzo Kids — it is where you, as a parent or legal guardian, create your Family Account, provide COPPA parental consent, subscribe, invite secondary guardians, add your child to the account, and monitor your child's study progress. For information about what we collect through the Myzo Kids app itself, please see the Myzo Kids Privacy Policy.

We take our responsibility to protect your family's privacy seriously. Because our Services are designed to be used by children under the direction of a parent, our practices are shaped first and foremost by the U.S. Children's Online Privacy Protection Act ("COPPA") and by our commitment to collecting only what is necessary to help children succeed in their studies.

This Privacy Policy describes what information we collect from you as an Adult User, how we use and share that information, how we protect it, and the rights and choices you have with respect to it. By creating a Family Account or otherwise using the Myzo Parents app, you accept the practices described here.

---

Table of Contents

1. Key Terms
2. Types of Users and Accounts
3. COPPA & Parental Consent
4. Information We Collect
5. How We Use Information
6. When We Share Information with Third Parties
7. Sub-Processors and Service Providers
8. How to Access, Change, or Delete Account Information
9. Account Cancellation and Data Deletion
10. Data Retention
11. Security
12. Location of Information Processing and International Transfers
13. State-Specific Privacy Rights (California, Colorado, Connecticut, Utah, Virginia, Nevada)
14. Additional Disclosures for Data Subjects in Europe and the United Kingdom
15. Marketing Communications and Your Choices
16. Third-Party Websites and Services
17. Do Not Track and Global Privacy Control
18. Changes to This Privacy Policy
19. Contact Us

---

1. Key Terms

• "Adult User" means any user who is age eighteen (18) or older, including parents, legal guardians, and any secondary guardian who has been invited by the primary guardian to access a Family Account. Adult Users interact with our Services through the Myzo Parents app.
• "Child User" means a user under the age of eighteen (18) whose account has been created and enabled by an Adult User. Where applicable, we further distinguish "Under-13 Child Users" (users under age thirteen) whose accounts are subject to COPPA.
• "Family Account" means the account created by an Adult User that contains one or more Child Users, together with the Adult User's own profile and any secondary guardians.
• "Personal Information" or "PI" means information that identifies, relates to, describes, or could reasonably be linked to a particular individual or household. This is the definition given by U.S. state privacy laws (including the California Consumer Privacy Act, or "CCPA"); non-U.S. residents should read this term to include "personal data" as defined under the EU General Data Protection Regulation ("GDPR") or the UK GDPR.

---

2. Types of Users and Accounts

Myzo currently supports one type of account: the Family Account. Within each Family Account:

• The primary guardian creates the account through the Myzo Parents app, provides parental consent, and manages the subscription.
• The primary guardian may invite one or more secondary guardians (other Adult Users, such as a co-parent or grandparent) to share access.
• The primary guardian may add one or more Child Users for whom the Services will be used.

You can begin creating a Family Account in two ways:

• Directly, through the Myzo Parents app. Download the Parents app, complete the onboarding flow, and add your children from there.
• By scanning a code from your child's Kids app. If your child has already installed the Myzo Kids app on their own device and is using it in device-only trial mode, the Kids app displays a QR code prompting a parent to complete setup. Scanning that code opens the Myzo Parents app on your device (or the App Store if it is not yet installed) and pre-fills a claim identifier so that once you complete onboarding, your child's on-device trial-mode activity is transferred into the newly-created Family Account. The QR code contains only an opaque random identifier and no Personal Information about your child. See the Myzo Kids Privacy Policy, Section 2, for a fuller description of the trial-mode arrangement.

Child Users authenticate to the Myzo Kids app using a PIN chosen at setup (and optionally a device biometric such as Face ID or Touch ID). Child Users do not have a login credential such as an email address or password of their own.

Moving a Child User to a new device (device swap). You may move a Child User from one device to another at any time from the Parents app by opening that child's Settings → Device Access → Swap Devices and displaying a new pairing QR code. When the new device scans that code, our servers atomically revoke the session on the prior device and issue a fresh, device-bound session to the new one. The prior device signs the Child User out on its next foreground check (within approximately thirty seconds) and returns to the Kids app welcome screen; no Child User data remains readable on the prior device after revocation. The Child User's server-side records are preserved and appear on the new device once the child re-enters the PIN.

---

3. COPPA & Parental Consent

The Myzo Kids app is designed to be used by children under the direction of a parent or legal guardian, and the Myzo Parents app is the tool through which you exercise that direction. We comply with the Children's Online Privacy Protection Act (COPPA) and its implementing regulations.

Verifiable Parental Consent. Before we collect Personal Information from a child under 13, we obtain verifiable parental consent from you through credit-card verification at the point at which you activate a subscription trial or paid subscription. This method is expressly recognized by the Federal Trade Commission's COPPA Rule as a permissible mechanism (16 C.F.R. § 312.5(b)(2)).

No account for the child alone. A child cannot create an account independently. Every Child User must be added to a Family Account by a parent or legal guardian, who first accepts this Privacy Policy and provides parental consent as described above.

Parent controls. Through the Myzo Parents app, you may at any time:

• Review the Personal Information we have collected about your child;
• Direct us to correct or delete that Personal Information;
• Refuse to permit further collection or use of the child's Personal Information; and
• Withdraw consent previously given, causing the child's account to be closed.

For more detail on the information we collect about your child and how you can manage it, please see the Myzo Kids Privacy Policy.

Notice to educators and schools. Our Services are directed to families. We do not currently offer school-managed accounts or classroom integrations. If we begin to do so in the future, we will amend this Privacy Policy to describe those practices.

---

4. Information We Collect

We collect only the information necessary to operate the Services.

4.1 Information collected from Adult Users

• Account credentials: email address and a hashed password.
• Profile information: the Adult User's chosen display name, a "child-facing label" (such as "Mom," "Dad," or "Grandpa"), and birth year (used to confirm the Adult User is at least eighteen years old).
• Onboarding survey responses: answers to a short set of questions when creating the account, including the Adult User's biggest homework-related challenge, their goal for using Myzo, how they heard about Myzo, and their preferences relating to focus, tasks, rewards, and score visibility for their child.
• Referral code and referral history (if the Adult User participates in our referral program).
• Subscription and billing metadata, including subscription status, trial dates, and opaque customer or transaction identifiers issued by our payment processor (see Section 4.5). We do not collect or store payment card numbers, CVV codes, bank account numbers, or billing addresses.
• Device information for each device on which the Adult User signs into the Myzo Parents app, including a device fingerprint (an opaque hash we use to identify the app installation), device platform (iOS or Android), and a device model label.
• Push notification token used to deliver notifications to the Adult User's device.
• Notification preferences, including whether email and push notifications are enabled and whether seasonal (back-to-school) communications are enabled.
• Consent records. Each time the Adult User agrees to our Terms of Service, this Privacy Policy, or provides COPPA parental consent for a Child User, we log the fact of consent, the version of the document consented to, the timestamp, and the Adult User's IP address and user-agent string at the time of consent. These records are retained as a legal audit trail.
• Marketing website waitlist submission, if the Adult User submits their email address on kids.getmyzo.com to join the waitlist. See Section 4.6.

4.2 Information you enter about your child through the Myzo Parents app

Through the Myzo Parents app you enter information about your child that becomes part of your child's record in our database. This includes information you provide when adding your child to your Family Account (first name, age range, grade level, avatar and color choices) and information you add on an ongoing basis (assignments, sub-tasks, due dates, subjects, grades and scores you log for your child, rewards you offer, achievements you award manually, and any free-text notes you enter). Data your child enters directly through the Myzo Kids app is described in the Myzo Kids Privacy Policy.

4.3 Information collected automatically

When you use the Myzo Parents app or the kids.getmyzo.com website, we and our service providers may automatically collect:

• IP address (for security, fraud prevention, and rate limiting; not stored on your user profile beyond the security-log purpose described in Section 4.1);
• App version, operating-system version, device model, and language preference;
• Timestamps of your activity on the Services; and
• Anonymous analytics events (see Section 4.4).

4.4 Analytics

We use PostHog (PostHog Inc., United States) as our product-analytics provider. Analytics events for Adult Users are associated with an opaque internal user identifier (a UUID), not your email address. Events describe your interactions with the Services (for example, "opened the parent dashboard," "created a task") together with your app version, platform, and role. We do not send your name, your child's name, task titles, assignment content, or any other free-text field to PostHog.

PostHog automatically records approximate IP address for country-level geolocation and drops IP address from user profiles after processing.

4.5 Payment information

We do not collect, store, or process payment card numbers, CVV codes, bank account numbers, or billing addresses.

When you subscribe to Myzo, our payment processor collects your payment method and processes the transaction. Depending on how you subscribe, your payment processor will be:

• Apple, Inc. for subscriptions initiated through the iOS App Store;
• Google LLC for subscriptions initiated through the Google Play Store; or
• Paddle.com Market Limited, acting as Merchant of Record, for subscriptions initiated through our website.

Payment card details, bank account information, and billing addresses are collected and stored solely by these payment processors. Each processor is the party responsible for PCI-DSS compliance, chargeback handling, tax remittance, and refund processing with respect to the payment method itself. Myzo receives only opaque customer and transaction identifiers from these processors so that we can verify your subscription status.

For subscriptions purchased in the Myzo Parents app, we use RevenueCat, Inc. to verify purchases with Apple (and, once available, Google) and to keep track of your subscription status. RevenueCat receives the purchase and renewal records from the app store together with an opaque identifier for your Adult User account. It does not receive your payment card details, and it never receives any information about your child.

4.6 Information collected on kids.getmyzo.com

The kids.getmyzo.com marketing website collects only the email address you submit if you join our waitlist. Waitlist emails are delivered to and stored by Resend (Drie Labs Inc., United States) as our email service provider, and are used only to send you communications about the launch of Myzo. See Section 15 for how to unsubscribe.

We do not run advertising trackers, cookies, or third-party analytics on the marketing website.

---

5. How We Use Information

We use the information described in Section 4 for the following purposes:

• To provide and operate the Services, including authenticating your account, syncing your family's data across devices, and delivering push notifications you have opted into.
• To personalize the experience, including tailoring the app to your role and preferences.
• To communicate with you, including sending transactional messages (such as one-time-password codes, receipts, and important account or security notifications), responding to your requests, and — only if you have opted in — sending marketing communications about new Myzo features.
• To operate and improve the Services, including diagnosing and fixing bugs, understanding aggregate usage patterns through the anonymous or pseudonymous analytics described in Section 4.4, and testing new features.
• To administer subscriptions and prevent fraud, including verifying your subscription status through our payment processors and detecting misuse of the Services.
• To comply with legal obligations, including responding to lawful requests from public authorities.
• To enforce our Terms of Service and protect the safety of our users, our Services, and the public.

---

6. When We Share Information with Third Parties

We share information only in the limited circumstances described below.

• With the members of your Family Account. Adult Users who are members of the same Family Account (for example, co-parents who have been invited as secondary guardians) can see the Child Users, tasks, grades, rewards, and achievements associated with that Family Account.
• With our sub-processors and service providers, as described in Section 7. These vendors are contractually restricted to processing information on our behalf and only for the purposes we specify.
• With payment processors, as described in Section 4.5.
• With push-notification providers (Apple Push Notification service and, for Android, Google Firebase Cloud Messaging) to deliver notifications to your device.
• In a business transaction. If Myzo is acquired by or merges with another company, we may transfer your information as part of that transaction. We will provide notice before your information is transferred and becomes subject to a different privacy policy.
• For legal reasons. We may disclose information if we believe in good faith that disclosure is necessary to comply with a subpoena, court order, or other legal process, to enforce our Terms of Service, or to protect the rights, property, or safety of Myzo, our users, or the public.
• With your consent, or as you otherwise direct.

We do not sell Personal Information as that term is defined under the California Consumer Privacy Act, and we do not share Personal Information for cross-context behavioral advertising.

---

7. Sub-Processors and Service Providers

Myzo uses the following service providers to operate the Services. We have executed a Data Processing Agreement (DPA) with each sub-processor, including — where the sub-processor is located outside the European Economic Area, the United Kingdom, or Switzerland — the European Commission's Standard Contractual Clauses (or the equivalent transfer mechanisms recognized under the UK GDPR and the Swiss Federal Data Protection Act) as an appendix to that DPA. Each sub-processor is contractually obligated to protect the information we share, to process it only on our documented instructions, and to use it only for the purposes we specify. A current list of sub-processors is also published at /subprocessors.

AI processing for the Flash Cards feature. When you scan pages of homework, worksheets, or notes into a flash card set from the Parents app, or when your child writes a custom flash card in the Kids app, Myzo sends the scanned image or the child-authored question and answer text to Anthropic PBC over TLS. Anthropic returns candidate multiple-choice distractor answers, which Myzo saves alongside the card so your child can practice in quiz mode. Your child's first name, your email, your family ID, and every other account or profile field are never sent in the request. Under Anthropic's API data-retention policy, the content of the request is not retained after Anthropic returns its response and is never used to train Anthropic's models.

---

8. How to Access, Change, or Delete Account Information

Adult Users may review and update their own profile information at any time in the Myzo Parents app under Settings. To change your email address, delete your account, or exercise any other privacy right described in this Policy, please contact us at privacy@getmyzo.com.

Parental review of Child User information. See the Myzo Kids Privacy Policy for detail on how to review, correct, or delete your child's information. Most Child User information is also directly viewable and editable within the Myzo Parents app.

We will respond to requests within the timeframes required by applicable law. For requests where identity verification is required, we may ask you to verify the email address on file, confirm your PIN through the Myzo Parents app, or provide other reasonable verifying information.

Authorized agents. California residents may designate an authorized agent to submit privacy requests on their behalf, subject to identity verification as required by the California Consumer Privacy Act.

---

9. Account Cancellation and Data Deletion

You may cancel your Family Account at any time through the Myzo Parents app under Settings → Account → Delete Account, or by contacting privacy@getmyzo.com.

When you delete your Family Account:

• All Child User records associated with the account — including profiles, devices, tasks, sessions, grades, rewards, achievements, flashcards, and points ledgers — are deleted from our production database.
• Your own Adult User profile, notification preferences, subscription record, and consent records are deleted.
• Your authentication credentials with Supabase Auth are deleted.
• The event of deletion is recorded in our audit log.

Some information may be retained in encrypted backups for a limited period (up to seven days) before being purged, and we may retain a narrow set of records where required to comply with a legal obligation (for example, tax records associated with a completed subscription transaction).

---

10. Data Retention

We retain Personal Information for as long as your Family Account is active and for as long as reasonably necessary to provide the Services, comply with legal obligations, resolve disputes, and enforce our agreements. Specifically:

• Active accounts. We retain your account, profile, subscription, and family data for as long as your account is active.
• Deleted accounts. When you delete your Family Account, we delete production data as described in Section 9. Encrypted disaster-recovery backups are retained for up to seven (7) days after deletion and are then purged.
• Consent records. Because consent records are our legal audit trail for parental consent under COPPA, they are retained for the life of the Family Account and are deleted together with the account.
• Payment and subscription records. Records that our payment processors require us to retain (for example, transaction identifiers associated with a completed subscription) may be retained for the period required by our payment processor and by applicable tax and consumer-protection law.
• Anonymous analytics. Anonymized product-analytics events are retained by our analytics provider for the period set in their default retention policy (currently seven years).

---

11. Security

We maintain a written information-security program appropriate to our size and to the sensitivity of the information we hold. Our security measures include, without limitation:

• Encryption of data in transit (Transport Layer Security) and at rest (AES-256) throughout our infrastructure;
• Row-Level Security enforced at the database layer, so that Adult Users may access only their own family's records and Child Users may access only their own records;
• Session tokens for Child Users that are device-bound, individually revocable by the parent, and automatically expiring;
• Hashed storage of PINs and passwords (bcrypt for parent passwords; SHA-256 for child PINs);
• Multi-factor authentication for administrative access to our production infrastructure;
• Regular review of access rights, security-advisor findings, and third-party-provider security posture; and
• A privacy manifest declared in each iOS build in accordance with Apple's App Store requirements.

No security program is perfect, and we cannot guarantee absolute security. In the event of a breach that affects Personal Information, we will notify affected users in accordance with applicable law.

---

12. Location of Information Processing and International Transfers

Myzo is headquartered in the United States, and our infrastructure is hosted primarily in the United States. If you access the Services from outside the United States, Personal Information about you (and, where applicable, your child) will be transferred to and processed in the United States, where privacy laws may differ from those in your country.

For users located in the European Economic Area, the United Kingdom, or Switzerland, we rely on the European Commission's Standard Contractual Clauses (SCCs), and the equivalent transfer mechanisms recognized under the UK GDPR and the Swiss Federal Data Protection Act, to safeguard your Personal Information during transfer. The SCCs are incorporated as appendices to the executed Data Processing Agreements we hold with each of our sub-processors, as described in Section 7.

---

13. State-Specific Privacy Rights

If you are a resident of one of the U.S. states listed below, you may have additional rights with respect to your Personal Information.

13.1 California, Colorado, Connecticut, Utah, and Virginia

Residents of these states have the right to:

1. Know / access the categories and specific pieces of Personal Information we have collected about you, the sources of that information, the purposes for which we collected it, and the categories of third parties with whom we have shared it;
2. Correct inaccurate Personal Information we hold about you;
3. Delete Personal Information we hold about you, subject to statutory exceptions;
4. Portability — receive a copy of your Personal Information in a portable format;
5. Opt out of the "sale" or "sharing" of Personal Information for cross-context behavioral advertising. Myzo does not sell or share Personal Information for cross-context behavioral advertising.
6. Limit the use and disclosure of sensitive Personal Information. We do not process any Personal Information for the purpose of inferring characteristics about a consumer.
7. Non-discrimination — we will not charge you a different price, deny you Services, or provide a different quality of service because you exercised a privacy right.

To exercise any of these rights, contact us at privacy@getmyzo.com. If we deny your request, we will explain why, and (where applicable) you may appeal our decision within sixty (60) days of receiving our denial by replying to our response.

Categories of Personal Information collected and disclosed (past 12 months). For purposes of the CCPA and the equivalent statutes of the states listed above:

13.2 Nevada

Nevada residents have the right, under Nevada Revised Statutes Chapter 603A, to direct us not to sell certain covered information. Myzo does not sell Personal Information as that term is defined by Nevada law. If our practices change, we will honor Nevada residents' opt-out requests submitted to privacy@getmyzo.com.

13.3 "Shine the Light" — California Civil Code § 1798.83

California residents may request information about the categories of Personal Information (if any) we have disclosed to third parties for those third parties' direct-marketing purposes in the previous calendar year. We do not disclose Personal Information to third parties for their direct-marketing purposes. California residents may nonetheless submit inquiries under this section to privacy@getmyzo.com.

---

14. Additional Disclosures for Data Subjects in Europe and the United Kingdom

If you are located in the European Economic Area, the United Kingdom, or Switzerland, the following disclosures apply to your use of the Services.

Data controller. Myzo, LLC is the data controller for Personal Information processed in connection with the Services.

Legal bases for processing. We rely on one or more of the following legal bases when processing your Personal Information:

• Contract: processing necessary to provide the Services you have signed up for;
• Consent: processing you have consented to, including parental consent under COPPA and marketing communications;
• Legitimate interests: processing necessary for our legitimate interests in operating, improving, and securing the Services, provided such interests are not overridden by your rights and freedoms; and
• Legal obligation: processing necessary to comply with legal obligations to which we are subject.

Your rights. In addition to the rights described in Sections 8 and 13, you have the right to (a) access your Personal Information, (b) request correction, (c) request erasure, (d) request restriction of processing, (e) object to processing based on our legitimate interests, (f) request data portability, and (g) withdraw consent at any time. You also have the right to lodge a complaint with your local supervisory authority.

International transfers. See Section 12.

---

15. Marketing Communications and Your Choices

If you have opted in to receiving marketing communications from us, you may opt out at any time by:

• Clicking the "unsubscribe" link in any marketing email we send you;
• Adjusting your notification preferences in the Myzo Parents app under Settings → Notifications; or
• Contacting us at privacy@getmyzo.com.

Even after you opt out of marketing communications, we may continue to send you transactional messages that are necessary to operate the Services (for example, security alerts, one-time-password codes, and receipts).

---

16. Third-Party Websites and Services

The Services may from time to time contain links to third-party websites or services (for example, a link from the Myzo Parents app to an external resource for parents of children with ADHD). We do not control those third-party websites and services and are not responsible for their privacy practices. When you follow a link to a third-party website, we encourage you to review its privacy policy.

---

17. Do Not Track and Global Privacy Control

Our mobile applications do not respond to browser-based "Do Not Track" signals because such signals do not apply in a mobile-app context.

The kids.getmyzo.com marketing website does not currently set any tracking cookies to respond to. If we begin using cookies in the future that would be affected by browser-based signals, we will honor the Global Privacy Control (GPC) signal for users who transmit it.

---

18. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we make a material change, we will notify you by email (to the address associated with your Family Account) or through a prominent notice within the Myzo Parents app before the change takes effect. The "Last Updated" date at the top of this Policy indicates when it was most recently revised. Your continued use of the Services after the effective date of a revised Privacy Policy constitutes your acceptance of the revised Policy.

---

19. Contact Us

If you have any questions or concerns about this Privacy Policy or our practices, or if you would like to exercise any of the rights described in this Policy, please contact us:

Myzo, LLC Attn: Privacy 116 Agnes Rd, Suite 200 Knoxville, TN 37919 United States

Email: privacy@getmyzo.com