Privacy Policy and Notice of Collection

Summary of Key Points

You should read this entire Privacy Policy and our Terms & Conditions, but here are some key points:

• Personal Information ("PI") is defined in this policy to mirror the text of the California Consumer Privacy Act (CCPA) and means information that identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household.
• We take your privacy seriously, and we never monetize your PI by providing it to a third party in exchange for money.
• During registration, the only information we ask you to provide about a child who will be using the Services is the child's first name (or nickname), age, and grade level. We do not collect gender, birth month, birth year, or any other demographic information from children.
• Other than in the places and for the purposes explicitly disclosed in this Privacy Policy, we do not knowingly collect any PI directly from Child Users under age 13.
• Because the security of your PI is important to us, we only ask for PI when it serves a business purpose and try to limit the collection of PI to only what is necessary to accomplish those purposes. We also use commercially reasonable physical, technical, and administrative security measures designed to safeguard all information collected by the Services.
• Adult Users may contact us at any time as described in Section 12 (Contact Us) to request that we provide for their review, or delete from our records, any PI they have provided about Child Users associated with their Accounts, or to cease collecting PI from those Child Users.
• We do not serve advertising of any kind to children. No advertising networks, behavioral tracking, or marketing pixels operate on the child-directed portions of the Services.

Table of Contents

1. COPPA Compliance and Parental Consent Mechanism
2. Types of Accounts and Users
3. Information Collection
4. How We Use Information
5. When We Disclose Information to Third Parties
6. How to Access, Change, or Delete Account Information
7. Account Cancellation and Data Deletion
8. State-Specific Privacy Rights
9. Location of Information Processing
10. Security
11. Changes to Our Privacy Policy
12. Contact Us

1. COPPA Compliance and Parental Consent Mechanism

Crayon Islandis subject to the Children's Online Privacy Protection Act (COPPA). We comply with COPPA by obtaining verifiable parental consent before activating any child account for a child under 13, collecting only the minimum information necessary to operate the Services, and never using children's information for advertising or selling it to any third party.

Child Users are blocked from accessing any external links. All navigation within the child-directed portions of the Services is internal. Access to parent-directed sections (including account settings, billing, and child profile management) requires entry of a 4-digit parent PIN.

Parental Consent Mechanism

We obtain verifiable parental consent prior to collecting personal information from children under 13. For paid Family Accounts, we obtain verifiable parental consent through the following process:

1. A parent creates an account and adds a child profile, providing the child's first name and age.
2. The child's account is created in an inactive state — the child cannot access the Services until consent is confirmed.
3. We send a consent request email to the parent's verified email address. The email clearly describes what personal information we collect from the child and how it is used.
4. The parent clicks the consent link in the email to confirm consent. The consent link is valid for 7 days and can only be used once.
5. Upon confirmation, the child's account is activated and the parent receives a confirmation email.

For paid subscriptions, the use of a credit card, debit card, or other online payment system in connection with the subscription transaction provides additional verification of parental consent. This is an approved consent method under the Children's Online Privacy Protection Rule.

2. Types of Accounts and Users

Family Accounts:Created by a parent or legal guardian. Each Family Account may have one or more Child User profiles associated with it. The parent manages all Child User profiles and controls all data associated with the Account. Each child user profile must be associated with a Parent account, and children cannot access the Services or any account information without the Parent's involvement — all parent-directed sections are protected by a 4-digit PIN.

Users of the Services include Child Users (any child under age 18 who uses the learning and creative portions of the Services) and Adult Users(parents and legal guardians of Child Users), collectively referred to as "Users."

3. Information Collection

There are two general categories of information that we collect.

A. Information Users Provide to Us

Adult Users are asked to provide certain PI about themselves when registering for an Account, including:

• Email address — used for account login, COPPA consent verification, and transactional notifications
• Full name (optional) — used for personalization in communications
• Payment information — collected from Adult Users who purchase a subscription, processed securely by Stripe. For your security, we do not store your complete credit card number in our databases. Stripe handles all payment card data.
• Account PIN — a 4-digit PIN set by the parent, stored as a one-way hash in our database. The PIN gates access to sensitive parent dashboard functions including child profile management, billing, data export, and account deletion. We cannot retrieve your PIN from the stored hash.

In addition, Adult Users can provide us with information through the parent dashboard, which is accessible only after PIN verification. The parent dashboard allows Adult Users to administer their Accounts, including adding or removing Child Users, viewing progress reports, managing subscriptions, and exporting data.

Child Users: During child registration, only the child's first name (or nickname), age, and grade levelare requested. Age is collected as a whole number — we do not request a birth date, birth month, birth year, or any other date-of-birth information. Grade level (Pre-K through 5th grade) is used to adapt the educational curriculum to the child's developmental stage.

Child Users can create free-form artwork, practice letter tracing and writing, solve math problems, build words, learn to read clocks and calendars, compose music beats, and complete other educational activities in the Services. Crayon Island does not collect photographs or video of children, and no image capture of children occurs through any feature. We encourage you to use the Services with your Child Users and to view and monitor any content created by them. You can access all content saved by your Child Users through the parent dashboard.

In addition, we expressly confirm the following with respect to Child Users:

• We do not collect biometric identifiers from Child Users. This includes, without limitation, fingerprints, handprints, retina patterns, iris patterns, genetic data, voiceprints, gait patterns, facial templates, and faceprints.
• We do not collect government-issued identifiers from Child Users. This includes, without limitation, Social Security numbers, state identification card numbers, birth certificate numbers, and passport numbers.
• We do not collect email addresses, last names, physical addresses, phone numbers, precise device location, or device advertising identifiers from Child Users.
• We do not collect gender, full date of birth, or birth month and year from Child Users. We collect only the child's age as an integer and grade level as a category (Pre-K through 5th grade).

B. Information We Collect from All Users

We and our third-party service providers collect PI directly from Users of the Services in the form of the actions they take and activities they complete when using the Services. From Child Users, we may collect information about:

• Which activities a child commences and completes, and when
• Which areas of the Services the child frequents
• The number of questions answered correctly or incorrectly in math, spelling, clock, and other exercises
• Learning progress across skill areas (letter tracing accuracy, math skill mastery, reading level, etc.)
• How many Star Shards the child earns and what virtual cosmetic items the child selects
• The child's choice of avatar and customization
• Artwork created, including canvas data
• Math workspace snapshots (images of scratch work)
• Badges earned, streak progress, and daily challenge submissions

We and our third-party service providers also use a variety of technologies to automatically collect certain technical information when you use the Services, such as your browser type, operating system, device type, and IP address. We use this information to deliver content, maintain security, and support the internal operations of the Services.

Cookies and Session Identifiers

We use session cookies, which are small text files placed on your device, to authenticate your login session. We use only the following types of identifiers:

• Essential Cookies: Session cookies managed by our authentication provider that allow you to remain logged in as you navigate between pages. Without these cookies, you would have to log in during each page transition.
• Internal Identifiers: Unique identifiers (UUIDs) used within our database to distinguish accounts, child profiles, and projects. These are never shared with third parties for tracking purposes.
• Rate Limiting: Your IP address is used to enforce API rate limits (60 requests per minute) via our rate limiting provider. This data is ephemeral with a 1-minute sliding window and is not stored long-term.
• Login Security Records: We use secure, httpOnly cookies to maintain your login session. We record login events — including IP address, browser type, and timestamp — to protect your account and detect unauthorized access. These records are associated with the parent account only (never with child profiles) and are retained for 90 days. This data is used solely for account security and abuse prevention, not for advertising, personalization, or profiling.

We do not use:

• Advertising cookies or tracking pixels
• Analytics cookies that track individual user behavior across websites
• Cross-site tracking identifiers
• Device fingerprinting techniques
• Any persistent identifier for behavioral advertising
• Social media tracking cookies

We do not allow third-party advertising networks to collect information about Users on any portion of the Services. Persistent identifiers on child-directed portions of the Services are used solely for the following internal operations: (1) maintaining the child's login session; (2) tracking the child's progress within the learning curriculum; (3) preventing fraud and ensuring the security of the Services; and (4) enabling technical support and debugging. These identifiers are never used to contact a specific individual, to deliver behavioral advertising, or to amass a profile on a specific individual for any purpose other than supporting the child's in-app educational experience.

4. How We Use Information

We will never monetize the PI of any User of the Services by providing it to a third party in exchange for money.

Adult User Information may be used:

• To permit you to register for and use the Services, including to send you communications about Child User progress or your Account.
• To complete and fulfill your purchase, such as to process your payments, communicate with you regarding your purchase, and provide you with related customer service.
• To respond to your inquiries and fulfill your requests, retrieve your password, reset your PIN, or provide technical support.
• To send you transactional communications, including COPPA consent emails, subscription confirmations, and account security alerts. You may not opt out of receiving administrative messages from us regarding your Account.
• To send you operational communications including weekly progress digests about your child's learning activity, onboarding guidance, and re-engagement notifications. You may opt out of these communications at any time.
• To generate personalized parent communications using AI. When we use AI to personalize email content, your child's real name and your email address are never sent to the AI service. We use placeholder tokens and coarse age groups in all AI processing. Real names are substituted back into the content only on our own servers, after the AI processing is complete.

Child User Information may be used:

• To measure a Child User's performance in activities and to adapt a Child User's learning experience to the Child User's learning needs.
• To analyze, provide progress reports on, or provide an assessment of a Child User's performance to the Adult User on the Account.
• To power engagement features including badges, streaks, daily challenges, and the Star Shard reward system.
• To moderate artwork submitted to the public gallery to ensure it is appropriate for children.

Both Adult and Child User Information may be used:

• To assess and improve the Services, its educational content, and other services we provide; to research, evaluate, and improve the educational efficacy of the Services.
• To customize, adapt, and personalize Users' viewing and content-consumption experience.
• To maintain and analyze the functioning of the Services.
• As we believe to be necessary or appropriate: (a) under applicable law; (b) to comply with legal process; (c) to respond to requests from public and government authorities; (d) to detect violations of and enforce our terms and conditions; (e) to protect our operations, including the security of the Services; (f) to protect our rights, privacy, safety, or property, or that of our affiliates, you, or others; and (g) to allow us to pursue available remedies or limit the damages that we may sustain.

5. When We Disclose Information to Third Parties

PI collected from both Adult and Child Users will not be disclosed except for the following purposes:

• To third parties who perform certain services for us, as described in the table below. Service providers are contractually required to keep children's personal information confidential, use it only for the stated purpose, and not disclose it to any other party.
• When we believe that disclosure is in accordance with, or required by, any applicable law or legal process, including lawful requests by public authorities. If required or permitted to do so under the law, we will provide notice to Users prior to the disclosure.
• In connection with the consideration, negotiation, or completion of a corporate transaction in which we are acquired by or merged with another company, or we sell, liquidate, transfer, or license all or a portion of our assets. Any such acquirer shall be subject to the same commitments stated under this Privacy Policy.

Third-Party Service Providers

Parental Right to Consent to Collection Without Consenting to Third-Party Disclosure

As a parent or legal guardian, you have the right to consent to our collection and use of your child's personal information without consenting to the disclosure of your child's personal information to third parties, except to the extent that such disclosure is integral to the Services. The third-party disclosures that are integral to the core operation of the Services include disclosures to payment processors (Stripe), which are necessary to complete your subscription transaction, and cloud hosting and infrastructure providers (Supabase, Vercel), which are necessary to operate the Services.

We do not disclose the PI of any Child User to third parties for any marketing or promotional purposes. We do not share the PI of children under the age of 16 for valuable consideration.

6. How to Access, Change, or Delete Account Information

An Adult User can review or change the information they provided when they registered for the Services, including by adding or removing Child Users to or from the Account, through the parent dashboard. Access to the parent dashboard requires PIN verification.

In addition, Adult Users may contact us at any time as described in Section 12 (Contact Us) to request that we provide for their review, or delete from our records, any PI they have provided about Child Users associated with their Accounts, or to cease collecting PI from those Child Users.

When we change or delete any PI at your request, we will make good faith efforts to make the changes in our then-active databases as soon as reasonably practicable. Please note that information may remain in backup or archive records, and we may retain certain data relevant to preventing fraud or future abuse or for legitimate business purposes, such as analysis of aggregated, non-personally-identifiable or de-identified data, Account recovery, or if required by law. All retained data will continue to be subject to the Privacy Policy in effect at that time.

Data Export:Adult Users can export all data we hold for their account and associated Child Users via the "Download Your Data" function in account settings (PIN required), or by contacting us at privacy@crayonisland.com.

Consent Revocation (Suspend Without Deleting):You may revoke consent for a Child User at any time without deleting their data. Navigate to the child's profile in the parent dashboard and select "Suspend Account." This immediately stops all data collection for that child and prevents them from using the Service. The child's data is preserved, and you may restore access at any time by selecting "Restore Access." To permanently delete a child's data instead, use the "Delete Profile" option or contact us at privacy@crayonisland.com.

7. Account Cancellation and Data Deletion

Children's Personal Information — Data Retention Policy

In accordance with the Children's Online Privacy Protection Rule (COPPA), we maintain the following written data retention policy for personal information collected from children. We retain children's personal information only for as long as is reasonably necessary to fulfill the specific purposes for which it was collected. Children's personal information is not retained indefinitely. When a retention period expires or the business need no longer applies, we delete children's personal information using reasonable measures to protect against unauthorized access during the deletion process.

At any time, Adult Users may delete individual Child User profiles from the parent dashboard (PIN required). Adult Users may also delete their entire Account from the parent dashboard settings (PIN required).

When an Adult User deletes a Child User profile: All data associated with that Child User is permanently deleted from our active databases, including all learning progress, projects, artwork, activity logs, badges, streaks, and stored files.

When an Adult User deletes their Account: All Child User profiles and all associated data are permanently deleted. Active subscriptions are cancelled. All stored files are deleted from our storage systems.

Automatic deletion due to inactivity: If an Account remains inactive for 24 months, we will delete all User PI in our active databases associated with the Account. The 24-month period is provided so that you have the ability, following cancellation or inactivity, to reactivate your Account and potentially recover previous information. We will not use Child User PI for any other purpose during this period other than for potential reactivation.

Billing records:Billing records are retained by our payment processor (Stripe) per their standard data retention policy for tax, accounting, and chargeback purposes. We do not control Stripe's retention of billing records. If you wish to request deletion of billing records held by Stripe, please contact privacy@crayonisland.com.

Upon Account cancellation or deletion, de-identified and/or aggregated User information may persist internally for our internal support, administrative, and record-keeping purposes as permissible by applicable law. Information including PI may remain in backup or archive records, and we may retain certain data if required by law, relevant to preventing fraud or future abuse, or for legitimate business purposes. All retained data will continue to be subject to the Privacy Policy in effect at that time.

8. State-Specific Privacy Rights

States with comprehensive consumer data privacy laws may provide residents with additional rights regarding our use of PI. The following applies to individuals who reside in California, Colorado, Connecticut, Utah, and Virginia ("Relevant States").

Right to Access Specific Information and Data Portability: You have the right to request that we disclose certain information to you about our collection and use of PI over the past twelve (12) months, including the categories of PI collected, the sources, our business purpose for collecting it, the categories of third parties with whom we share it, and the specific pieces of PI collected.

Right to Correct Information: You have the right to request we update PI about you that is incorrect in our systems.

Right to Delete: You have the right to request that we delete the PI that we have collected from you, subject to certain exceptions. Once we receive and confirm your verifiable consumer request, we will delete (and direct our service providers to delete) the PI from our records, unless an exception applies.

Right to Opt Out of the Sale or Sharing of Personal Information: We do not sell PI. We do not share PI for cross-contextual behavioral advertising.

Non-Discrimination: We will not discriminate against you for exercising any of your rights.

Exercising Your Rights: To exercise these rights, please submit a verifiable consumer request by contacting us as set forth in Section 12 (Contact Us). Only you or an authorized representative may make a request related to your PI. You may also make a request on behalf of your Child. We endeavor to respond within 45 days. We do not charge a fee unless the request is excessive, repetitive, or manifestly unfounded.

Notice for Nevada Residents

Nevada residents may submit a request directing us not to sell certain PI we have collected about them. To exercise this right under the Nevada Privacy Law (NRS Ch. 603A), please contact us at privacy@crayonisland.comwith "Nevada Rights Request" in the subject line. Please note that we do not sell PI as defined under Nevada law.

9. Location of Information Processing

The Services are controlled and operated by us from the United States. Your information may be stored and processed in any country where we have facilities or in which we engage service providers, including the United States. In addition, your information may be subject to access requests from governments, courts, or law enforcement officials in countries where it may be processed, under the laws of those countries.

10. Security

Written Information Security Program

We have established, implemented, and maintain a written information security program containing safeguards appropriate to the sensitivity of the personal information we collect from children and to our size, complexity, and nature and scope of activities.

Designated Security Coordinator: We have designated one or more individuals to coordinate our information security program and oversee its implementation and ongoing maintenance.

Safeguard Design and Implementation: We design, implement, and maintain technical, physical, and administrative safeguards including:

• Encryption in transit: All data uses TLS/HTTPS encryption, enforced by HTTP Strict Transport Security (HSTS) with a 2-year max-age.
• Encryption at rest: Data stored in our database is encrypted at rest using industry-standard encryption.
• Row-level security: Our database enforces row-level security policies on all tables containing user and child data — authenticated users can only access records belonging to their own account.
• PIN protection: All sensitive parent dashboard functions require PIN verification. PINs are stored as one-way hashes — we cannot retrieve your PIN. A lockout policy limits incorrect PIN attempts.
• PII scrubbing: Error reports are automatically scrubbed to remove email addresses, names, and other identifying information before transmission to our monitoring service.
• No session replay: Our error monitoring provider does not capture screen recordings of user sessions — session replay is permanently disabled.
• Security headers: Our application sets strict security headers including HSTS, Content Security Policy, X-Frame-Options (DENY), and Permissions-Policy (camera, microphone, and geolocation access restricted).
• AI anonymization: Before any data is sent to our AI service provider, all personally identifiable information is stripped and replaced with placeholder tokens. Real names, email addresses, and specific ages are never transmitted.
• Rate limiting: API endpoints are protected by rate limiting (60 requests per minute per IP) to prevent automated abuse.

Written Third-Party Assurances:Before allowing service providers to collect or maintain personal information from children on our behalf, we take reasonable steps to determine that such entities are capable of maintaining the confidentiality, security, and integrity of children's personal information. We obtain written assurances (Data Processing Agreements) from such entities confirming that they will employ reasonable measures to maintain the confidentiality, security, and integrity of children's personal information.

Please be aware, however, that no information system can be guaranteed to be 100 percent secure, so we cannot guarantee the absolute security of your information. If there is a breach of our security, we will notify you as required by law. Moreover, we are not responsible for the security of information you transmit to the Services over networks that we do not control, including the Internet and wireless networks.

11. Changes to Our Privacy Policy

If we update this Privacy Policy, we will notify you by posting the revised Privacy Policy on the Services. For revisions that materially expand the ways in which we use or share the information previously collected from you through the Services, we will notify you by email at the address associated with your Account at least 30 days before the changes take effect.

The current version of this Privacy Policy is always available atcrayonisland.com/privacy.

12. Contact Us

JGN Media Corporation is in the United States of America. JGN Media Corporation is the operator of the Services. You may contact us if you have any questions, complaints, or other issues related to this Privacy Policy and issues related to your or a Child User's information for which you are responsible:

JGN Media Corporation
5794 Bird Rd, Unit #752, Miami, FL 33155

Email Address: privacy@crayonisland.com

Support Email: support@crayonisland.com

Appendix: 16 CFR 312.4 Compliance Checklist

This appendix maps every required element of 16 CFR 312.4(d) to the section of this policy where it is addressed.