Mosslight Island Privacy Policy

Effective date: upon publication

Mosslight Island is an educational learning and practice service for families in the United States. This Privacy Policy explains what information Mosslight Island collects, why we use it, when limited information is disclosed to service providers, how long we keep it, and the choices available to parents.

1. Operator and contact information

Mosslight Island is operated by DBA Mosslight Island Inc. LLC.

Mailing address: 89 Lafayette St., Marblehead, MA 01945

Phone: 617-645-9035

Privacy email: privacy@mosslightisland.com

Parents may contact us at any time with questions about privacy, access, correction, deletion, consent, or stopping future collection.

2. United States service

Mosslight Island is currently offered for use in the United States. We do not ask a child for a home address or precise location in order to determine eligibility.

3. Parent account information

At signup, we ask a parent or other authorized adult for an email address and account credentials. Authentication credentials are handled through our authentication provider. We may also process minimal technical and security information needed to protect the account, maintain sessions, detect abuse, respond to support requests, and operate the service.

We do not require a parent's legal name, home mailing address, or payment information to create the free learning account.

4. Information about children

A parent creates and manages a child's Mosslight Island profile. We intentionally minimize the information requested about children.

We ask the parent to provide:

•a child's first name or nickname only;

•grade level and grade context;

•learning and accessibility preferences needed to operate the experience; and

•optional educational information, such as Lexile, i-Ready, or similar assessment scores, when the parent chooses to provide it.

We do not ask for a child's exact age or date of birth. Grade level and educational assessment information may nevertheless suggest or allow us to infer an approximate age range or academic level. We use that information only for educational placement, content selection, personalization, and progress reporting.

As a child uses Mosslight Island, we collect information needed to provide the learning service, including:

•activities presented and completed;

•answers, attempts, hints, and related learning evidence;

•mastery, progress, placement, and practice state;

•Daily Adventure, story, world, reward, creature, and cosmetic progress;

•parent-selected session and accessibility settings;

•limited child-device session and security records; and

•reports or support evidence a family chooses to submit.

We ask parents not to enter a child's last name. We do not request a child's personal email address, phone number, home address, school name, exact date of birth, government identifier, precise GPS location, photograph, voice recording, biometric identifier, or social-media account as part of the child learning profile.

Mosslight Island does not provide public child profiles, open chat, child-to-child messaging, public leaderboards, or social sharing of a child's learning record.

5. How we use information

We use information only as reasonably necessary to:

•create and secure parent and child access;

•provide educational activities and age/grade-appropriate practice;

•personalize difficulty, pacing, review, and content selection;

•save learning progress and family preferences;

•provide parents with learning and progress information;

•provide stories, rewards, cosmetics, and other product features;

•respond to support or content-problem reports;

•maintain reliability, prevent abuse, investigate security events, and protect the service;

•honor parent privacy requests and maintain minimal evidence that those requests were completed; and

•comply with applicable law.

Mosslight Island is an educational practice and learning service. Its progress measures are internal educational indicators, not clinical diagnoses, standardized test scores, or professional educational evaluations.

6. No sale, targeted advertising, or child-data marketing

We do not sell or rent personal information.

We do not use children's personal information for targeted, behavioral, or cross-site advertising. We do not provide children's personal information to third parties for their own advertising or marketing. Mosslight Island does not use third-party advertising networks in the child experience.

Parent email is currently used for transactional purposes such as account, security, privacy, consent, and support communications. If we later offer optional marketing email, it will use a separate adult-facing choice and will not be based on a child's learning record.

7. Generative AI and child data

We do not send child personal information, child account information, child educational scores, or child learning histories to generative-AI services.

Mosslight Island may use development or content-production tools to create or improve generic educational or entertainment material when that work is not tied to an identifiable child. Those tools are not given a child's account or learning record under this policy.

8. Service providers

We use a limited number of service providers to host, secure, operate, maintain, and support Mosslight Island. They may process only the information reasonably necessary to provide their services to Mosslight Island.

Our current or selected infrastructure and operational providers include:

•Supabase for database, authentication, storage, and backend infrastructure;

•Lovable for current application development and frontend/hosting infrastructure;

•Vercel for selected/planned frontend and application hosting as we transition hosting; and

•Resend for transactional account, support, privacy, and parental-consent email.

During an infrastructure transition, Lovable and Vercel may both be involved for a limited period. We do not authorize these providers to use children's personal information for their own advertising, behavioral profiling, or marketing.

We may replace a service provider when needed to operate the service. We will require providers that handle personal information on our behalf to protect it and use it only for the services they provide to Mosslight Island.

9. Parental consent

For new public child profiles after our parental-consent launch cutover, Mosslight Island obtains verifiable parental consent before activating the child profile and beginning covered collection.

Our selected launch method is an email-based "Email Plus" process. The parent receives the required notice at the email address associated with the authenticated parent account, affirmatively responds as instructed, and receives an additional confirming message explaining the consent and how it may be revoked. A browser checkbox or button alone is not treated as completed parental verification.

Existing pre-launch beta profiles may remain under the documented pre-launch transition rule unless a material change requires new consent.

10. Parent rights and controls

A parent can use Mosslight Island's Privacy & Data controls or contact us to:

•review information associated with the parent's child;

•download a copy of the child's data;

•correct profile information;

•revoke parental consent and stop future covered collection;

•sign the child out of active devices; and

•request deletion of the child's data.

Revoking consent and deleting data are separate controls. Revoking consent stops future covered collection and child access. Deletion is a separate request to remove the child's live data, subject to limited records we must retain for security, legal, deletion-reconciliation, or compliance purposes.

11. Data retention and deletion

We retain personal information only for as long as reasonably necessary for the purpose for which it was collected, to provide the service, protect security, honor parent requests, or meet applicable legal obligations.

Our operating retention policy is:

•active child profile and learning information: while the profile is active and the information is needed to provide the service;

•live child data after a verified deletion request: removed promptly through the deletion process;

•private support/report screenshots: generally 30 days;

•support/problem diagnostic evidence: generally 30 days after resolution when no longer needed;

•revoked or expired child sessions, access badges, and invitations: generally 90 days;

•security and access-event records: generally 90 days, unless a specific security investigation requires a limited extension;

•completed privacy-request receipts: generally 3 years after completion;

•parental-consent evidence: while the child profile is active and generally for 3 years after deletion or revocation, as needed to document the consent history; and

•deletion tombstones: only for the period necessary to prevent deleted information from being restored from backup, with a minimum target of 90 days and a period at least 30 days beyond the verified maximum backup-restore window when that is longer.

Provider-managed backup and authentication-audit retention may be governed by the provider's verified technical retention window. Deleted information may remain in protected backups until those backups expire or are overwritten. We do not use backup copies to resume ordinary processing of deleted child information, and deletion-reconciliation controls are used after restores when applicable.

12. Security

We use administrative, technical, and organizational safeguards designed to protect parent and child information. These include authenticated parent controls, hashed child-session credentials, server-authoritative access checks, least-privilege design, row-level security and restricted service tables where appropriate, encrypted transport, security logging, deletion controls, and written incident-response and information-security procedures.

No online service can guarantee absolute security. If we identify a security incident involving personal information, we will investigate, contain, document, and provide notifications when required by law.

13. Merchandise and commerce

Mosslight Island may show children that real-world Mosslight merchandise exists. Child-facing merchandise areas are designed to be informational and non-coercive. Children cannot complete a purchase.

Actual purchase details, checkout, payment, shipping, and order management are placed behind a grown-up/parent handoff. Commerce information belongs to the adult purchaser and order system and is not added to the child's educational profile. A purchase does not change educational access, child privacy protections, safety protections, accessibility features, progress, rewards, or learning outcomes.

14. Changes to this policy

We may update this Privacy Policy as the service changes. We will maintain versioned notices. If a change is material to the collection, use, or disclosure of children's personal information in a way that requires new parental consent, we will obtain that consent before applying the material change to covered child information.

15. Contact us

Questions or requests about privacy may be directed to:

DBA Mosslight Island Inc. LLC

89 Lafayette St., Marblehead, MA 01945

617-645-9035

privacy@mosslightisland.com