Privacy Policy

Legacy Quest is designed for use by families with children ages 6 and older. Because children under the age of 13 may use the app through parent-managed profiles, we comply fully with the Children's Online Privacy Protection Act (COPPA), 15 U.S.C. 6501 et seq., and the FTC's COPPA Rule.

Under COPPA, we are required to:

• Obtain verifiable parental consent before collecting personal information from children under 13

• Provide parents with the ability to review, correct, and delete their child's information

• Collect only the minimum information necessary to operate the app

• Never condition a child's participation on disclosing more information than is reasonably necessary

Children do not create their own accounts. All accounts are created and managed by a verified parent or legal guardian.

Before any child profile is created or any data about a child is collected, we obtain verifiable parental consent through the following process:

• Account creation requires a valid credit card payment, which serves as age verification confirming the account holder is an adult.

• During signup, the account holder must confirm they are 18 years of age or older.

• The account holder must confirm they are the parent or legal guardian of any child whose profile they create.

• The account holder must review and affirmatively agree to this Privacy Policy before proceeding.

This multi-step consent mechanism meets the FTC's approved methods for verifiable parental consent under COPPA. No child profile may be created until all consent steps are completed by the parent account holder.

We collect the minimum information necessary to operate Legacy Quest. Here is exactly what we collect and why:

Parent Account Information:

• Email address and full name

• Authentication credentials (password, hashed and never stored in plain text)

• Payment information processed by Stripe (we do not store card numbers)

Child Profile Information:

• First name and age

• Optional profile photo uploaded by the parent

• A PIN for child login (hashed using bcrypt with salt; never stored in plain text; never transmitted to the browser)

• Gamification data: coins, XP, rank, streaks, and badge achievements

App Activity Data:

• Chore and mission completions

• Game session scores in Brain Academy and Health Academy modules

• Coin transactions and reward redemptions

• Encouragement messages between parent and child

• Affirmation journal entries

Supporter Information:

• Names and optional messages submitted by supporters via parent-shared celebration links

• Supporters do not create accounts and cannot access any private account data

Device and Session Data:

• Local session tokens used to maintain login state

• We do not collect geolocation data, contact lists, microphone data, camera data, or any information beyond what is listed above

We use the information we collect strictly for the following purposes:

• To create and manage parent and child accounts

• To track missions, chores, and gamified progress

• To facilitate the parent-child engagement loop, including approvals, encouragement, and reward redemptions

• To record performance in Brain Academy and Health Academy modules

• To enable supporter features such as encouragement messages and coin donations, subject to parent approval

• To maintain streaks, honor tracking, and affirmation journals

• To process payments securely through Stripe

We do NOT use any data for behavioral advertising, targeted advertising, user profiling, or sale to third parties. We do not display advertisements to children.

Legacy Quest does not sell, rent, or trade your data or your child's data with any third party for commercial purposes.

We work with the following third-party service providers who process data strictly on our behalf and under our direction in order to operate the app:

• Stripe: Payment processing for parent account purchases. Stripe handles all payment card data. We do not store or have access to full card numbers. Stripe's privacy policy is available at stripe.com/privacy.

• Base44: Backend infrastructure, cloud hosting, database storage, and server-side functions. Base44 processes app data on our behalf as a data processor. Child data stored on Base44 infrastructure is subject to the same protections described in this policy.

These providers are contractually prohibited from using your data for any purpose other than providing services to Legacy Quest. We do not share data with any other third parties.

The supporter celebration feature shares a limited, curated set of public-facing data (child's first name, rank, badges, and recent activity) with anyone who receives a parent-generated share link. This feature is entirely opt-in and controlled by the parent. Parents may disable share links at any time from Settings. Supporter links are token-secured and do not expose PINs, parent account details, or internal identifiers.

We are committed to collecting only what is necessary to operate Legacy Quest. We do not collect:

• Geolocation or GPS data

• Contact lists or address book data

• Device camera or microphone access beyond what a parent explicitly initiates

• Social media profile data

• Behavioral data for advertising purposes

• Any data from children that is not directly entered by their parent

Your data is retained for as long as your account remains active.

Parents may delete an individual child profile at any time from Settings. This permanently removes all associated mission, badge, journal, coin, and activity data for that child.

Parents may permanently delete their entire parent account and all associated data, including all child profiles, via the Delete Parent Account option in Settings. This action is irreversible.

Upon account deletion, all data is permanently removed from our systems and from our third-party service providers within 30 days.

To request manual deletion of your data or your child's data, contact us at legacyquest@theagileassist.com. We will process all deletion requests within 30 days.

We use industry-standard security measures to protect your data:

• Passwords are hashed and never stored in plain text

• Child PINs are hashed using bcrypt (salt rounds: 10) and stored as secure hashes. PINs are never transmitted to the browser for comparison. PIN verification occurs server-side only.

• All data transmissions are encrypted in transit

• Authentication tokens are validated server-side on every request

• The supporter feature uses token-based access control. No sensitive identifiers are exposed through public endpoints.

While we implement strong security practices, no method of data transmission or storage is 100% secure. We cannot guarantee absolute security but are committed to protecting your family's data with industry best practices.

In the event of a data breach that affects your personal information or your child's information, we will notify affected users without unreasonable delay and within the timeframes required by applicable law. Notification will be sent to the email address associated with your parent account. We will describe the nature of the breach, the data affected, and the steps we are taking to address it.

As the parent or legal guardian of a child using Legacy Quest, you have the following rights at any time:

• Review all personal information collected about your child by contacting us at legacyquest@theagileassist.com

• Correct or update your child's information directly within the app

• Delete your child's profile and all associated data from Settings

• Revoke consent and request deletion of all data by deleting your parent account

• Opt out of the supporter share feature by disabling share links in Settings

• Request a copy of all data associated with your account by contacting us directly

We will respond to all parental rights requests within 30 days. We will not require you to pay a fee to exercise these rights.

Legacy Quest is currently available to United States residents only. We do not knowingly offer services to residents of the European Union, United Kingdom, Canada, or other jurisdictions with separate children's data protection frameworks. If you access Legacy Quest from outside the United States, you do so at your own risk and your data will be processed in the United States.

We plan to expand to additional markets in the future and will update this policy with the appropriate regional compliance frameworks before doing so.

Legacy Quest is designed in compliance with Google Play's Families Policy for apps that target children or mixed audiences. Specifically:

• All ads, if ever introduced, will comply with Google Play's Families Ad Policy and will not be behaviorally targeted at children

• We do not collect persistent device identifiers for advertising purposes

• The app does not contain links that direct children outside the app without parental awareness

• All data collection practices are consistent with Google Play's Data Safety requirements

We may update this Privacy Policy from time to time. When we make material changes, particularly any changes to how we collect, use, or share children's data, we will:

• Update the Last Updated date at the top of this policy

• Send a notification to the email address associated with your parent account

• Require you to review and re-confirm consent before continuing to use the app if the changes affect children's data practices

Your continued use of Legacy Quest after receiving notice of non-material changes constitutes your acceptance of the updated policy. For material changes affecting children's data, we will obtain fresh parental consent.

If you have questions, concerns, or requests related to this Privacy Policy or your data, please contact us:

Legacy Quest / The Agile Assist

Email: legacyquest@theagileassist.com

United States

We are committed to responding to all privacy-related inquiries within 30 days. For urgent matters involving a child's data, we will prioritize your request.