Privacy Policy

Introduction

Myzo, LLC ("Myzo," "we," "us," or "our") operates the Myzo Kids and Myzo Parents mobile applications and the website located at getmyzo.com (collectively, the "Services"). Myzo is a homework-focus and study-organization app designed for families of children with ADHD and other learning differences.

We take our responsibility to protect your and your children's privacy seriously. Because our Services are designed to be used by children, our practices are shaped first and foremost by the U.S. Children's Online Privacy Protection Act ("COPPA") and by our own commitment to collecting only what is necessary to help children succeed in their studies.

This Privacy Policy describes what information we collect, how we use and share that information, how we protect it, and the rights and choices you have with respect to it. It applies to Family Accounts created by parents or legal guardians and to Child Users added to those accounts. Please read this Privacy Policy carefully. By creating an account or otherwise using the Services, you accept the practices described here.

---

Table of Contents

1. Key Terms
2. COPPA & Parental Consent
3. Types of Users and Accounts
4. Information We Collect
5. How We Use Information
6. When We Share Information with Third Parties
7. Sub-Processors and Service Providers
8. How to Access, Change, or Delete Account Information
9. Account Cancellation and Data Deletion
10. Data Retention
11. Security
12. Location of Information Processing and International Transfers
13. State-Specific Privacy Rights (California, Colorado, Connecticut, Utah, Virginia, Nevada)
14. Additional Disclosures for Data Subjects in Europe and the United Kingdom
15. Children's Data — Special Notice for Parents
16. Marketing Communications and Your Choices
17. Third-Party Websites and Services
18. Do Not Track and Global Privacy Control
19. Changes to This Privacy Policy
20. Contact Us

---

1. Key Terms

For clarity throughout this Policy, the following terms have the meanings set out below.

• "Adult User" means any user who is age eighteen (18) or older, including parents, legal guardians, and any secondary guardian who has been invited by the primary guardian to access a Family Account.
• "Child User" means any user under the age of eighteen (18) whose account has been created and enabled by an Adult User. Where applicable, we further distinguish "Under-13 Child Users" (users under age thirteen) whose accounts are subject to COPPA.
• "Family Account" means the account created by an Adult User that contains one or more Child Users, together with the Adult User's own profile and any secondary guardians.
• "Personal Information" or "PI" means information that identifies, relates to, describes, or could reasonably be linked to a particular individual or household. This is the definition given by U.S. state privacy laws (including the California Consumer Privacy Act, or "CCPA"); non-U.S. residents should read this term to include "personal data" as defined under the EU General Data Protection Regulation ("GDPR") or the UK GDPR.

---

2. COPPA & Parental Consent

Myzo is designed to be used by children under the direction of a parent or legal guardian. We comply with the Children's Online Privacy Protection Act (COPPA) and its implementing regulations.

Verifiable Parental Consent. Before we collect Personal Information from a child under 13, we obtain verifiable parental consent from the child's parent or legal guardian. Myzo obtains this consent through credit-card verification at the point at which the parent activates a subscription trial or paid subscription for the Services. This method is expressly recognized by the Federal Trade Commission's COPPA Rule as a permissible mechanism (16 C.F.R. § 312.5(b)(2)).

No account for the child alone. A child cannot create an account on the Services independently. Every Child User must be added to a Family Account by a parent or legal guardian, who first accepts this Privacy Policy and provides parental consent as described above.

Parent controls. Parents may at any time:

• Review the Personal Information we have collected about their child;
• Direct us to correct or delete that Personal Information;
• Refuse to permit further collection or use of the child's Personal Information; and
• Withdraw consent previously given, causing the child's account to be closed.

See Section 8 for how to exercise these rights.

Notice to educators and schools. The Services are directed to families. We do not currently offer school-managed accounts or classroom integrations. If we begin to do so in the future, we will amend this Privacy Policy to describe those practices.

---

3. Types of Users and Accounts

Myzo currently supports one type of account: the Family Account. Within each Family Account:

• The primary guardian creates the account, provides parental consent, and manages the subscription.
• The primary guardian may invite one or more secondary guardians (other Adult Users, such as a co-parent or grandparent) to share access.
• The primary guardian may add one or more Child Users for whom the Services will be used.

Child Users authenticate to the Myzo Kids app using a PIN chosen at pairing (and optionally a device biometric such as Face ID or Touch ID). Child Users do not have a login credential such as an email address or password of their own.

---

4. Information We Collect

We collect only the information necessary to operate the Services. What we collect depends on whether the user is an Adult User or a Child User.

4.1 Information collected from Adult Users (parents and guardians)

• Account credentials: email address and a hashed password.
• Profile information: the Adult User's chosen display name, a "child-facing label" (such as "Mom," "Dad," or "Grandpa"), and birth year (used to confirm the Adult User is at least eighteen years old).
• Onboarding survey responses: answers to a short set of questions when creating the account, including the Adult User's biggest homework-related challenge, their goal for using Myzo, how they heard about Myzo, and their preferences relating to focus, tasks, rewards, and score visibility for their child.
• Referral code and referral history (if the Adult User participates in our referral program).
• Subscription and billing metadata, including subscription status, trial dates, and opaque customer or transaction identifiers issued by our payment processor (see Section 4.6). We do not collect or store payment card numbers, CVV codes, bank account numbers, or billing addresses.
• Device information for each device on which the Adult User signs into the Myzo Parents app, including a device fingerprint (an opaque hash we use to identify the app installation), device platform (iOS or Android), and a device model label.
• Push notification token used to deliver notifications to the Adult User's device.
• Notification preferences, including whether email and push notifications are enabled and whether seasonal (back-to-school) communications are enabled.
• Consent records. Each time the Adult User agrees to our Terms of Service, this Privacy Policy, or provides COPPA parental consent for a Child User, we log the fact of consent, the version of the document consented to, the timestamp, and the Adult User's IP address and user-agent string at the time of consent. These records are retained as a legal audit trail.
• Marketing website waitlist submission, if the Adult User submits their email address on getmyzo.com to join the waitlist. See Section 4.7.

4.2 Information collected from Child Users (under parental direction)

We collect a deliberately minimal set of information from Child Users. In particular, we never collect a Child User's email address, telephone number, photograph, voice recording, video, precise or approximate geolocation, contacts list, or advertising identifier.

• First name only. We do not collect a Child User's last name.
• Age range (a bucketed range, not an exact date of birth) and a boolean flag indicating whether the child is under thirteen.
• Grade level (for example, "3rd grade"), used to size age-appropriate content. Grade level is not location-identifying.
• Avatar and color theme, chosen from a fixed catalog of vector-illustration avatars we provide. We do not accept user-uploaded photographs.
• Font-size and color-theme accessibility preferences.
• Device information for each device paired to the Child User: a device fingerprint, device platform, device label, biometric type enrolled (if any), a hashed PIN, and session-management fields (session token, session expiration, failed-PIN counter). We log authentication events (log-in, PIN failure, session revoked) with a timestamp, platform, and IP address for security purposes only.
• Push notification token used to deliver notifications to the Child User's device.
• Notification preferences, including bedtime alerts and audio-announcement settings.
• Application preferences, including break duration and score-tracking types.
• Assignment and study activity: the title and (optionally) description of homework assignments and sub-assignments (whether entered by the child or the parent), subject, due date, task status, scheduled date, notes attached to the task, and any free-text "delay," "cancel," or "completion" reasons the child or parent enters. We also record each focus-timer session and break, including duration, start and end timestamps, whether the session completed, and any free-text end reason.
• Grades and scores logged for the child, including subject, assignment name, grade format (letter or numeric), the score itself, and any free-text note the parent adds when logging the grade.
• Rewards and points: an append-only ledger of points earned or spent, a list of rewards the parent has offered the child, and the child's reward-redemption history.
• Achievements unlocked, together with the timestamp and any note from a parent who manually awarded an achievement.
• Flashcards the parent or child creates as study aids, including the question text, answer text, multiple-choice options, and per-card study statistics (times seen, times correct, mastery status).

Consent record for the Child User. When a Child User is added to a Family Account, we log a corresponding consent record identifying the parent or guardian who provided COPPA parental consent for that Child User, the timestamp, and the consent version, together with the IP address and user-agent string described in Section 4.1.

4.3 Information collected automatically

When you use the Services, we and our service providers may automatically collect:

• IP address (for security, fraud prevention, and rate limiting; not stored on your user profile beyond the security-log purpose described in Sections 4.1 and 4.2);
• App version, operating-system version, device model, and language preference;
• Timestamps of your activity on the Services; and
• Anonymous analytics events (see Section 4.4).

4.4 Analytics

We use PostHog (PostHog Inc., United States) as our product-analytics provider.

• For Adult Users, analytics events are associated with an opaque internal user identifier (a UUID), not your email address. Events describe your interactions with the Services (for example, "opened the parent dashboard," "created a task") together with your app version, platform, and role. We do not send your name, your child's name, task titles, assignment content, or any other free-text field to PostHog.
• For Child Users, analytics events are associated with an anonymous session identifier that is minted per session and not persisted across log-outs. We do not send any Child User Personal Information — including first name, age, or family identifier — to PostHog.

PostHog automatically records approximate IP address for country-level geolocation and drops IP address from user profiles after processing.

4.5 Cookies and similar technologies

The Myzo Kids and Myzo Parents mobile applications do not use cookies or cross-site tracking technologies. The getmyzo.com marketing website is a static site hosted on Cloudflare and does not currently set any first-party analytics cookies or use third-party trackers.

4.6 Payment information

We do not collect, store, or process payment card numbers, CVV codes, bank account numbers, or billing addresses.

When you subscribe to Myzo, our payment processor collects your payment method and processes the transaction. Depending on how you subscribe, your payment processor will be:

• Apple, Inc. for subscriptions initiated through the iOS App Store;
• Google LLC for subscriptions initiated through the Google Play Store; or
• Paddle.com Market Limited, acting as Merchant of Record, for subscriptions initiated through our website.

Payment card details, bank account information, and billing addresses are collected and stored solely by these payment processors. Each processor is the party responsible for PCI-DSS compliance, chargeback handling, tax remittance, and refund processing with respect to the payment method itself. Myzo receives only opaque customer and transaction identifiers from these processors so that we can verify your subscription status.

4.7 Information collected on getmyzo.com

The getmyzo.com marketing website collects only the email address you submit if you join our waitlist. Waitlist emails are delivered to and stored by Resend (Drie Labs Inc., United States) as our email service provider, and are used only to send you communications about the launch of Myzo. See Section 16 for how to unsubscribe.

We do not run advertising trackers, cookies, or third-party analytics on the marketing website.

---

5. How We Use Information

We use the information described in Section 4 for the following purposes:

• To provide and operate the Services, including authenticating your account, syncing your family's data across devices, delivering the study, focus, reward, and flashcard features, and delivering push notifications you have opted into.
• To personalize the experience for each Adult User and each Child User, including tailoring the app to the child's grade level, accessibility preferences, and score-tracking preferences.
• To communicate with you, including sending transactional messages (such as one-time-password codes, receipts, and important account or security notifications), responding to your requests, and — only if you have opted in — sending marketing communications about new Myzo features.
• To operate and improve the Services, including diagnosing and fixing bugs, understanding aggregate usage patterns through the anonymous or pseudonymous analytics described in Section 4.4, and testing new features.
• To administer subscriptions and prevent fraud, including verifying your subscription status through our payment processors and detecting misuse of the Services.
• To comply with legal obligations, including responding to lawful requests from public authorities.
• To enforce our Terms of Service and protect the safety of our users, our Services, and the public.

We do not use Child User Personal Information to serve advertising to children, and we do not sell or share Child User Personal Information for any advertising or marketing purposes.

---

6. When We Share Information with Third Parties

We share information only in the limited circumstances described below.

• With the members of your Family Account. Adult Users who are members of the same Family Account (for example, co-parents who have been invited as secondary guardians) can see the Child Users, tasks, grades, rewards, and achievements associated with that Family Account.
• With our sub-processors and service providers, as described in Section 7. These vendors are contractually restricted to processing information on our behalf and only for the purposes we specify.
• With payment processors, as described in Section 4.6.
• With push-notification providers (Apple Push Notification service and, for Android, Google Firebase Cloud Messaging) to deliver notifications to your device.
• In a business transaction. If Myzo is acquired by or merges with another company, we may transfer your information as part of that transaction. We will provide notice before your information is transferred and becomes subject to a different privacy policy.
• For legal reasons. We may disclose information if we believe in good faith that disclosure is necessary to comply with a subpoena, court order, or other legal process, to enforce our Terms of Service, or to protect the rights, property, or safety of Myzo, our users, or the public.
• With your consent, or as you otherwise direct.

We do not sell Personal Information as that term is defined under the California Consumer Privacy Act, and we do not share Personal Information for cross-context behavioral advertising. We do not disclose Child User Personal Information for any marketing or promotional purpose.

---

7. Sub-Processors and Service Providers

Myzo uses the following service providers to operate the Services. We have executed a Data Processing Agreement (DPA) with each sub-processor, including — where the sub-processor is located outside the European Economic Area, the United Kingdom, or Switzerland — the European Commission's Standard Contractual Clauses (or the equivalent transfer mechanisms recognized under the UK GDPR and the Swiss Federal Data Protection Act) as an appendix to that DPA. Each sub-processor is contractually obligated to protect the information we share, to process it only on our documented instructions, and to use it only for the purposes we specify. A current list of sub-processors is also published at getmyzo.com/subprocessors.

---

8. How to Access, Change, or Delete Account Information

Adult Users may review and update their own profile information at any time in the Myzo Parents app under Settings. To change your email address, delete your account, or exercise any other privacy right described in this Policy, please contact us at privacy@getmyzo.com.

Parental review of Child User information. As the parent or legal guardian of a Child User, you may at any time review the Personal Information we have collected about your child, direct us to correct or delete that information, or refuse to permit further collection of your child's Personal Information. Most Child User information — including profile, tasks, grades, rewards, achievements, and flashcards — is directly viewable and editable within the Myzo Parents app. For any request we cannot fulfill in-app, please contact us at privacy@getmyzo.com.

We will respond to requests within the timeframes required by applicable law. For requests where identity verification is required, we may ask you to verify the email address on file, confirm your PIN through the Myzo Parents app, or provide other reasonable verifying information.

Authorized agents. California residents may designate an authorized agent to submit privacy requests on their behalf, subject to identity verification as required by the California Consumer Privacy Act.

---

9. Account Cancellation and Data Deletion

You may cancel your Family Account at any time through the Myzo Parents app under Settings → Account → Delete Account, or by contacting privacy@getmyzo.com.

When you delete your Family Account:

• All Child User records associated with the account — including profiles, devices, tasks, sessions, grades, rewards, achievements, flashcards, and points ledgers — are deleted from our production database.
• Your own Adult User profile, notification preferences, subscription record, and consent records are deleted.
• Your authentication credentials with Supabase Auth are deleted.
• The event of deletion is recorded in our audit log.

Some information may be retained in encrypted backups for a limited period (up to seven days) before being purged, and we may retain a narrow set of records where required to comply with a legal obligation (for example, tax records associated with a completed subscription transaction).

---

10. Data Retention

We retain Personal Information for as long as your Family Account is active and for as long as reasonably necessary to provide the Services, comply with legal obligations, resolve disputes, and enforce our agreements. Specifically:

• Active accounts. We retain your account, profile, subscription, and family data for as long as your account is active.
• Deleted accounts. When you delete your Family Account, we delete production data as described in Section 9. Encrypted disaster-recovery backups are retained for up to seven (7) days after deletion and are then purged.
• Consent records. Because consent records are our legal audit trail for parental consent under COPPA, they are retained for the life of the Family Account and are deleted together with the account.
• Payment and subscription records. Records that our payment processors require us to retain (for example, transaction identifiers associated with a completed subscription) may be retained for the period required by our payment processor and by applicable tax and consumer-protection law.
• Anonymous analytics. Anonymized product-analytics events are retained by our analytics provider for the period set in their default retention policy (currently seven years). Because Child User events are not linkable to any individual, retention of these events is not a personal-data retention concern.

---

11. Security

We maintain a written information-security program appropriate to our size and to the sensitivity of the information we hold. Our security measures include, without limitation:

• Encryption of data in transit (Transport Layer Security) and at rest (AES-256) throughout our infrastructure;
• Row-Level Security enforced at the database layer, so that Adult Users may access only their own family's records and Child Users may access only their own records;
• Session tokens for Child Users that are device-bound, individually revocable by the parent, and automatically expiring;
• Hashed storage of PINs and passwords (bcrypt for parent passwords; SHA-256 for child PINs);
• Multi-factor authentication for administrative access to our production infrastructure;
• Regular review of access rights, security-advisor findings, and third-party-provider security posture; and
• A privacy manifest declared in each iOS build in accordance with Apple's App Store requirements.

No security program is perfect, and we cannot guarantee absolute security. In the event of a breach that affects Personal Information, we will notify affected users in accordance with applicable law.

---

12. Location of Information Processing and International Transfers

Myzo is headquartered in the United States, and our infrastructure is hosted primarily in the United States. If you access the Services from outside the United States, Personal Information about you (and, where applicable, your child) will be transferred to and processed in the United States, where privacy laws may differ from those in your country.

For users located in the European Economic Area, the United Kingdom, or Switzerland, we rely on the European Commission's Standard Contractual Clauses (SCCs), and the equivalent transfer mechanisms recognized under the UK GDPR and the Swiss Federal Data Protection Act, to safeguard your Personal Information during transfer. The SCCs are incorporated as appendices to the executed Data Processing Agreements we hold with each of our sub-processors, as described in Section 7.

---

13. State-Specific Privacy Rights

If you are a resident of one of the U.S. states listed below, you may have additional rights with respect to your Personal Information. This Section 13 describes those rights and how to exercise them.

13.1 California, Colorado, Connecticut, Utah, and Virginia

Residents of these states have the right to:

1. Know / access the categories and specific pieces of Personal Information we have collected about you, the sources of that information, the purposes for which we collected it, and the categories of third parties with whom we have shared it;
2. Correct inaccurate Personal Information we hold about you;
3. Delete Personal Information we hold about you, subject to statutory exceptions;
4. Portability — receive a copy of your Personal Information in a portable format;
5. Opt out of the "sale" or "sharing" of Personal Information for cross-context behavioral advertising. Myzo does not sell or share Personal Information for cross-context behavioral advertising.
6. Limit the use and disclosure of sensitive Personal Information. We do not process any Personal Information for the purpose of inferring characteristics about a consumer.
7. Non-discrimination — we will not charge you a different price, deny you Services, or provide a different quality of service because you exercised a privacy right.

To exercise any of these rights, contact us at privacy@getmyzo.com. If we deny your request, we will explain why, and (where applicable) you may appeal our decision within sixty (60) days of receiving our denial by replying to our response.

Categories of Personal Information collected and disclosed (past 12 months). For purposes of the CCPA and the equivalent statutes of the states listed above:

13.2 Nevada

Nevada residents have the right, under Nevada Revised Statutes Chapter 603A, to direct us not to sell certain covered information. Myzo does not sell Personal Information as that term is defined by Nevada law. If our practices change, we will honor Nevada residents' opt-out requests submitted to privacy@getmyzo.com.

13.3 "Shine the Light" — California Civil Code § 1798.83

California residents may request information about the categories of Personal Information (if any) we have disclosed to third parties for those third parties' direct-marketing purposes in the previous calendar year. We do not disclose Personal Information to third parties for their direct-marketing purposes. California residents may nonetheless submit inquiries under this section to privacy@getmyzo.com.

---

14. Additional Disclosures for Data Subjects in Europe and the United Kingdom

If you are located in the European Economic Area, the United Kingdom, or Switzerland, the following disclosures apply to your use of the Services.

Data controller. Myzo, LLC is the data controller for Personal Information processed in connection with the Services.

Legal bases for processing. We rely on one or more of the following legal bases when processing your Personal Information:

• Contract: processing necessary to provide the Services you have signed up for;
• Consent: processing you have consented to, including parental consent under COPPA and marketing communications;
• Legitimate interests: processing necessary for our legitimate interests in operating, improving, and securing the Services, provided such interests are not overridden by your rights and freedoms; and
• Legal obligation: processing necessary to comply with legal obligations to which we are subject.

Your rights. In addition to the rights described in Sections 8 and 13, you have the right to (a) access your Personal Information, (b) request correction, (c) request erasure, (d) request restriction of processing, (e) object to processing based on our legitimate interests, (f) request data portability, and (g) withdraw consent at any time. You also have the right to lodge a complaint with your local supervisory authority.

International transfers. See Section 12.

---

15. Children's Data — Special Notice for Parents

This section summarizes our practices with respect to Child Users. Please read it together with the rest of this Policy.

• We collect the minimum information necessary to operate the Services for your child. See Section 4.2 for the full list.
• We do not collect a child's email address, telephone number, photograph, voice recording, video, contacts list, precise geolocation, or advertising identifier.
• We do not permit advertising to children on the Services. No third-party advertising networks are integrated into the Myzo Kids app.
• We do not sell or share Child User Personal Information for any marketing purpose.
• We do not permit peer-to-peer communication. Child Users cannot message other Child Users or any Adult User outside their own Family Account.
• You can review, correct, and delete your child's Personal Information at any time. See Section 8.
• You can revoke your parental consent at any time by deleting your child's account or your entire Family Account. See Section 9.

If you have questions or concerns about our practices with respect to Child Users, please contact us at privacy@getmyzo.com.

---

16. Marketing Communications and Your Choices

If you have opted in to receiving marketing communications from us, you may opt out at any time by:

• Clicking the "unsubscribe" link in any marketing email we send you;
• Adjusting your notification preferences in the Myzo Parents app under Settings → Notifications; or
• Contacting us at privacy@getmyzo.com.

Even after you opt out of marketing communications, we may continue to send you transactional messages that are necessary to operate the Services (for example, security alerts, one-time-password codes, and receipts).

---

17. Third-Party Websites and Services

The Services may from time to time contain links to third-party websites or services (for example, a link from the Myzo Parents app to an external resource for parents of children with ADHD). We do not control those third-party websites and services and are not responsible for their privacy practices. When you follow a link to a third-party website, we encourage you to review its privacy policy.

---

18. Do Not Track and Global Privacy Control

Our mobile applications do not respond to browser-based "Do Not Track" signals because such signals do not apply in a mobile-app context.

The getmyzo.com marketing website does not currently set any tracking cookies to respond to. If we begin using cookies in the future that would be affected by browser-based signals, we will honor the Global Privacy Control (GPC) signal for users who transmit it.

---

19. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we make a material change, we will notify you by email (to the address associated with your Family Account) or through a prominent notice within the Myzo Parents app before the change takes effect. The "Last Updated" date at the top of this Policy indicates when it was most recently revised. Your continued use of the Services after the effective date of a revised Privacy Policy constitutes your acceptance of the revised Policy.

---

20. Contact Us

If you have any questions or concerns about this Privacy Policy or our practices, or if you would like to exercise any of the rights described in this Policy, please contact us:

Myzo, LLC Attn: Privacy 116 Agnes Rd, Suite 200 Knoxville, TN 37919 United States

Email: privacy@getmyzo.com

---