Mosslight Island Children's Privacy / COPPA Direct Notice

Effective date: upon publication

This notice is for parents and explains the information Mosslight Island collects from or about a child, how we use it, our limited service-provider disclosures, and how a parent can consent, review information, stop future collection, or request deletion.

1. Operator

Mosslight Island is operated by DBA Mosslight Island Inc. LLC.

Mailing address: 89 Lafayette St., Marblehead, MA 01945

Phone: 617-645-9035

Privacy email: privacy@mosslightisland.com

Mosslight Island is currently offered for families in the United States.

2. What we ask a parent to provide about a child

We intentionally minimize child information. We ask a parent to provide:

•the child's first name or nickname only;

•grade level and grade context;

•learning, accessibility, and session preferences needed to provide the service; and

•optional educational information, such as Lexile, i-Ready, or similar assessment scores, when the parent chooses to provide it.

Please do not provide the child's last name.

We do not ask for the child's exact age or date of birth. Grade level and educational scores may nevertheless suggest or allow us to infer an approximate age range or academic level. We use that information only for educational placement, content selection, personalization, and progress reporting.

We do not request a child's personal email address, phone number, home address, school name, exact date of birth, government identifier, precise GPS location, photograph, voice recording, biometric identifier, or social-media account as part of the child learning profile.

3. Information created when a child uses Mosslight Island

When the child uses the service, Mosslight Island records information needed to provide and improve the child's learning experience, including:

•activities, questions, stories, games, and practice presented;

•answers, attempts, hints, response timing, and learning evidence;

•mastery, placement, progress, and review state;

•Daily Adventure and world progress;

•rewards, creatures, cosmetics, and story progress;

•parent-selected accessibility and session settings;

•minimal child-device session and security records; and

•support or content-problem evidence a family chooses to submit.

Mosslight Island does not provide public child profiles, open chat, child-to-child messaging, public leaderboards, or social sharing of a child's learning record.

4. Why we collect this information

We use child information to:

•provide grade-appropriate educational activities;

•personalize difficulty, pacing, practice, and review;

•save progress and preferences;

•show parents educational progress information;

•operate stories, world progress, rewards, and cosmetic features;

•protect child access and service security;

•respond to family support requests; and

•honor parent privacy choices and legal obligations.

Mosslight Island's progress measures are internal educational indicators. They are not clinical diagnoses, standardized test scores, or professional educational evaluations.

5. What we do not do with child information

We do not sell or rent children's personal information.

We do not use children's personal information for targeted, behavioral, or cross-site advertising. We do not disclose children's personal information to third parties for their own advertising or marketing. We do not use third-party advertising networks in the child experience.

We do not send child personal information, child account information, educational scores, or child learning histories to generative-AI services. Development and content-production tools may be used only with generic material that is not tied to an identifiable child.

6. Service providers used to operate Mosslight Island

We disclose only the minimum information reasonably necessary to service providers acting on our behalf to host, secure, operate, maintain, and support Mosslight Island.

These providers include:

•Supabase for database, authentication, storage, and backend infrastructure;

•Lovable for current application development and frontend/hosting infrastructure;

•Vercel for selected/planned frontend and application hosting as we transition hosting; and

•Resend for transactional account, support, privacy, and parental-consent email.

During a hosting transition, Lovable and Vercel may both be involved for a limited period. We do not authorize our service providers to use children's personal information for their own advertising, behavioral profiling, or marketing.

7. How parental consent works

Before a new public child profile is activated after the consent launch cutover, the authenticated parent is shown the current Privacy Policy, this Children's Privacy / COPPA Direct Notice, and the Terms of Service.

For launch, Mosslight Island uses an email-based Email Plus process for covered internal uses. We send the consent request to the email address associated with the authenticated parent account. The parent must affirmatively reply using the instructions in the message. After the reply, Mosslight Island sends an additional confirming message that repeats the notice information, states that consent may be revoked, and explains how to revoke it.

A checkbox or button in the browser, by itself, is not treated as completed parental verification.

If the parent does not complete the required verification, the new child profile is not activated under the consent-gated flow.

8. Parent choices

A parent may at any time:

•review the information associated with the parent's child;

•obtain a copy of the child's data;

•correct profile information;

•revoke consent and stop future covered collection;

•request deletion of the child's information; or

•contact Mosslight Island with a privacy question or request.

Revoking consent and deleting data are separate actions. Revocation stops future covered collection and child access. Deletion removes the child's live data through the deletion process, subject to limited security, compliance, and backup-reconciliation records that must temporarily remain.

Parents can use the Privacy & Data controls in Mosslight Island or contact privacy@mosslightisland.com.

9. Retention

We keep child information only as long as reasonably necessary to provide the service and for the limited security, privacy-request, consent-evidence, and legal purposes described in the full Privacy Policy.

Our operating targets include 30 days for private report screenshots, 30 days after resolution for support diagnostic evidence when no longer needed, and 90 days for expired child-access/security records. Consent and privacy-request evidence may be retained longer to document parent choices. Provider backups expire according to their verified technical retention windows and are subject to deletion-reconciliation controls.

10. Full policy and contact

The full Mosslight Island Privacy Policy is available at /legal/privacy-policy.

The Mosslight Island Terms of Service are available at /legal/terms-of-service.

For questions or to exercise parent privacy rights, contact:

DBA Mosslight Island Inc. LLC

89 Lafayette St., Marblehead, MA 01945

617-645-9035

privacy@mosslightisland.com