Children's Privacy Notice

Direct notice to parents under COPPA

Effective date: [EFFECTIVE DATE]

This notice explains what Immuno collects from children under 13, what we do with it, and the control you have. It is our "direct notice to parents" under the U.S. Children's Online Privacy Protection Act (COPPA) and the FTC's COPPA Rule (16 C.F.R. Part 312). It supplements our Privacy Policy.

We ask you to read this before you add a child to your account.

1. We collect children's information — here is exactly what

Immuno is a health-habit game, so it necessarily collects information about your child. We collect only what the Service needs to work:

When you set up your child's profile:

• Display name or username (a nickname is fine — it does not need to be their real name)
• Birth date (used to set age-appropriate content and to know that COPPA applies)
• An autoimmune condition, if you choose to select one
• Weight, if you choose to enter it
• A profile photo or avatar, if you choose to upload one

As your child plays:

• Foods logged, hydration, sleep, activity and workouts
• Symptom entries — the symptom, a 1–5 severity rating, an optional note, and the date
• Game progress: creatures, levels, experience, coins, gems, farm and battle state, quests, cosmetics

If you connect Apple Health (optional):

• Only the metrics you approve — for example step count, heart rate, resting heart rate, blood oxygen, or sleep

Automatically, for security and reliability:

• IP address, device and browser type, and timestamps, logged by our infrastructure providers

Everything except the first two bullet points is optional. The game is playable without health conditions, weight, a photo, or any connected device.

2. What we do with it

We use your child's information only to:

• Run the game and save their progress
• Show you their nutrition, habits, symptoms, and trends in the Parent Dashboard
• Keep the account secure

We do not, and will not:

• Show your child advertising of any kind
• Use their information for behavioral advertising, marketing, or commercial profiling
• Use their information to train AI or machine-learning models
• Sell or rent their information to anyone
• Let your child make a purchase — only the parent, using the parent's account and payment method, can buy anything
• Let your child post publicly, chat with strangers, or share anything outside your family account
• Ask your child for more information than the Service reasonably needs to work
• Condition your child's participation in any activity on disclosing more information than is reasonably necessary

3. Who else can see it

Only the vendors that run our infrastructure, listed in SUBPROCESSORS.md, and only to provide services to us under contracts that forbid them from using the data for their own purposes. The main ones are Supabase (database and authentication), Vercel (hosting), and Stripe (which handles your payment and receives no information about your child).

If you use voice food logging, the audio and the resulting transcript are processed by OpenAI and Anthropic solely to produce a food entry, and neither may train on it. You can avoid this entirely by logging food by hand.

We may also disclose information when the law requires it, or to protect a child's safety.

4. Your consent

We obtain your verifiable parental consent before collecting personal information from your child.

You give consent when you, as the account holder, create your child's profile and confirm that you are their parent or legal guardian and that you agree to this notice. Because Immuno is a paid service, consent is confirmed through the payment transaction on your account — an FTC-recognized method of verifiable parental consent.

You may consent to the core Service while declining optional items. Specifically, you can:

• Skip the autoimmune condition, weight, and profile photo
• Decline to connect Apple Health, or connect it and revoke it later in the iOS Health app
• Decline voice logging and log food by hand

Declining any optional item does not stop your child from using Immuno.

5. Your rights as a parent — you are always in control

At any time, you may:

To protect your child, we will verify that a request comes from the parent on the account before we act on it — normally by confirming it came from the account's email address.

If you withdraw consent or ask us to stop collecting information, we will delete your child's information and their profile will no longer work. We will tell you clearly before that happens. This does not affect your right to a refund under the Terms of Service.

6. How long we keep it

We keep your child's information only as long as needed to provide the Service. When you delete a profile or close the account, we delete it from our live systems within 30 days and from backups within 90 days. We do not keep children's information indefinitely.

7. Security

Your child's information is encrypted in transit and at rest, isolated from other families' data by database-level access rules, and reachable by only a small number of our personnel who need it to run or support the Service. See Section 8 of the Privacy Policy.

8. If we change this notice

We will not use your child's information in a materially different way than described here without notifying you and getting your consent again. Material changes will be emailed to the parent on the account before they take effect.

9. Questions or complaints

[COMPANY LEGAL NAME] [COMPANY MAILING ADDRESS] [PRIVACY EMAIL]

You may also contact the U.S. Federal Trade Commission at ftc.gov/complaint or 1-877-FTC-HELP. Information about COPPA is at ftc.gov/coppa.