Privacy Policy

1. Introduction

Omo Quest (“we,” “us,” or “our”) is committed to protecting the privacy of all users, especially children. This Privacy Policy explains how we collect, use, store, and protect information when you use the Omo Quest mobile application and website (collectively, the “Service”).

Omo Quest is designed for children in grades K through 8 (ages 5-14) and their parents, guardians, and teachers. We comply with the Children's Online Privacy Protection Act (COPPA), the Family Educational Rights and Privacy Act (FERPA), and applicable state privacy laws.

2. Children's Privacy (COPPA Compliance)

We do not collect personal information from children under 13 without verified parental consent.

• All child accounts are created and managed exclusively by a parent or legal guardian.
• Before a child can use Omo Quest, a parent must provide verified consent through our parental verification process.
• Children never provide personal information directly. All account setup is performed by the parent.
• Parents may review, modify, or delete their child's data at any time through the Parent Dashboard.
• Parents may revoke consent and request complete data deletion at any time by contacting privacy@omoquest.app.

3. Information We Collect

3.1 Parent/Guardian Information

• Full name and email address
• Account credentials (encrypted)
• Device information (device type, operating system)
• Parental consent records

3.2 Child Information (Collected via Parent Only)

• First name only (no last name)
• Birth year (not full date of birth)
• Grade level
• Learning progress and task completion data
• Learning growth metrics

3.3 Information We Do NOT Collect from Children

• Last name
• Full date of birth
• Physical address
• Phone number
• Social Security number or government ID
• Photos (unless explicitly enabled by parent)
• Precise geolocation
• Contact lists or address books
• Advertising identifiers

4. How We Use Information

• To provide the Service: Delivering adaptive learning content, managing device access, and tracking educational progress.
• To personalize learning: Our AI engine adapts content difficulty based on the child's demonstrated skill level.
• To generate progress reports: Providing parents and teachers with insights into learning outcomes.
• To ensure safety: Monitoring AI interactions for inappropriate content using automated safety filters.
• To improve the Service: Analyzing aggregated, de-identified usage patterns to improve educational content.

We NEVER use children's data for advertising, marketing, or sale to third parties.

5. AI Companion Interactions

Omo Quest includes an AI-powered study companion that interacts with children to assist with learning. Regarding these interactions:

• All AI conversations are screened by multi-layer safety filters that detect and block inappropriate content, including self-harm, violence, sexual content, bullying, substance references, and personal information sharing.
• AI conversation logs are automatically deleted after 30 days.
• Parents can view their child's AI conversation history at any time through the Parent Dashboard.
• AI interactions are processed by our third-party AI provider (OpenAI). No personally identifiable information is included in AI requests.

6. Data Storage and Security

• All data is encrypted in transit (TLS 1.3) and at rest (AES-256).
• Data is stored on secure cloud infrastructure (Supabase/AWS) located in the United States.
• Access to personal data is restricted through row-level security policies ensuring users can only access their own data.
• We maintain audit logs of all data access for FERPA compliance.
• Account credentials are hashed using industry-standard bcrypt encryption.

7. Data Sharing

We do not sell, rent, or trade personal information to third parties.

We may share data only in these circumstances:

• Service providers: We use essential service providers (cloud hosting, AI processing, error monitoring) that process data on our behalf under strict data processing agreements.
• Teachers (with parent consent): If a parent enrolls their child in a classroom, the assigned teacher can view that child's learning progress.
• Legal requirements: We may disclose data if required by law, court order, or to protect the safety of a child.

8. FERPA Compliance (For Schools)

When Omo Quest is used in a school setting, we act as a “school official” with a legitimate educational interest under FERPA. We:

• Use education records solely for the purpose of providing the educational service.
• Do not disclose education records to unauthorized parties.
• Maintain audit logs of all access to education records.
• Allow schools to review and request deletion of student data.

9. Device Management

Omo Quest uses platform-provided APIs to manage device access:

• iOS: Uses Apple's FamilyControls framework to restrict app access. This requires parent authorization via Apple ID.
• Android: Uses Usage Access and overlay permissions to display learning reminders when restricted apps are opened.
• Device management is controlled entirely by the parent and can be disabled at any time through the Parent Dashboard.
• We do not collect or transmit information about which third-party apps are installed on the device. App selection is stored locally on the device.

10. Parent/Guardian Rights

Parents and guardians have the right to:

• Review all personal information collected about their child.
• Request correction of inaccurate information.
• Request deletion of their child's account and all associated data.
• Revoke consent at any time.
• Export their child's data in a machine-readable format.
• Opt out of AI companion interactions for their child.

To exercise any of these rights, contact us at privacy@omoquest.app. We will respond within 30 days.

11. Data Retention

• Active accounts: Data is retained for the duration of the account.
• AI conversations: Automatically deleted after 30 days.
• Deleted accounts: All personal data is permanently deleted within 30 days of account deletion. Anonymized, aggregated data may be retained for service improvement.
• COPPA consent records: Retained for the legally required period following consent revocation or account deletion.

12. Changes to This Policy

We will notify parents via email before making material changes to this Privacy Policy. Continued use of the Service after notification constitutes acceptance of the updated policy. For children's accounts, we will obtain new parental consent if changes affect how we collect or use children's data.

13. Contact Us

If you have questions about this Privacy Policy or our data practices, contact us at: