DRAFT — pending counsel review (G3), not yet legally operative. This is an internal draft describing current practices, prepared by the product team. It has not been reviewed by legal counsel and is not a legal notice. Bracketed placeholders are for counsel to complete.

Direct Notice to Parents (Children Under 13)

Service: Quiz Karts (quizkarts.com)

Operator: [ENTITY] · [MAILING ADDRESS] · [PRIVACY CONTACT EMAIL]

Effective date: [EFFECTIVE DATE]

You are receiving this notice because you are setting up Quiz Karts for a child under 13. It summarizes what we collect, why, and the choices you have. The full policy is in privacy.md. This notice describes our practices; it is not a certification of compliance with any law.

---

What we collect from you (the parent)

To create and secure your account we collect your email address and either a password (stored only as a salted hash) or, if you choose it, your Google account sign-in details (identifier, email, display name). On paid plans, our payment processor handles your card payment and we keep the resulting subscription identifiers and status.

What we collect in connection with your child

When you add a child profile, you enter a display name (your choice — a first name, nickname, or any label), pick a grade level, and choose one of two preset avatars. As your child plays, we record learning activity — the questions answered, whether each was correct, the time taken, game progress, points, and collected in-game items.

Your child does not log in and is never asked to enter personal information. We do not collect a child's address, phone number, photo, or precise location, and the Service gives a child no place to type such information.

Your child cannot chat with or be seen by strangers

The only messages a child can send during a duel are a few preset emoji cheers — free text is discarded by the server. The park and duels are limited to profiles under your account (your own children); a child is never matched with or visible to another family's child.

We do not disclose your child's information to third parties for their own use

We do not sell your child's information and do not use it for advertising. We rely on service providers only to run the Service — sign-in (Google, if you use it), payment processing on paid plans, and hosting — under our direction. The web app loads no advertising or third-party tracking scripts.

---

Your choices as a parent

You may at any time:

1. Review the personal information we have collected from your child;
2. Delete that information and/or close the account;
3. Refuse to permit any further collection or use of your child's information (this may end your child's use of the Service).

To exercise any of these, contact us at [PRIVACY CONTACT EMAIL]. We will verify your request before acting on it. There is no self-service deletion button in the app today, so please use the contact method above.

Consent

[Verifiable parental consent method to be finalized with counsel — e.g. consent via the card transaction on paid signups, and a standalone method (such as text-plus or a small card authorization) for free signups, per research/plan_business.md §7.1. Describe here how consent is obtained and how it can be withdrawn.]

We will not condition your child's participation on disclosing more information than is reasonably necessary to play.

---

Contact

[ENTITY] [MAILING ADDRESS] [PRIVACY CONTACT EMAIL]