Wiz Kidz Forge Adult Privacy Notice

1. Who we are

Forge is operated by Wiz Kidz (The Kumars Academy of Science and Technology, LLC), located in Portland, Oregon, to help kids and their families prepare for and excel at competitive STEM programs such as FIRST LEGO League, Congressional App Challenge, Presidential AI Challenge, etc. This notice tells you, as an adult using Forge, what we collect about you and why.

2. Information we collect from you

Directly from you, when you create or use your account:

• Your email address and display name.

• Your role (Parent, Coach, or Administrator).

• If you're a Parent: how many children you're allocated to enroll, and the identity of the children you add (governed separately by other documents once you consent to enroll each child).

• Your sign-in itself is handled by Google — Forge does not create or store a separate password for your account.

What we do not collect today, but plan to collect as Forge adds features: a phone number, an emergency contact, a mailing address, and payment or billing information for program fees. We are naming these now so that adding them later is not a surprise. Our commitments:

• We update this notice to describe a feature before that feature goes live, so the notice always matches what Forge actually does.

• We tell you directly — by email or an in-app notice — when a change is significant, for example when Forge begins taking payment information. Routine additions within the categories listed just above are reflected in an updated notice rather than a separate message each time, so you are not chased with a "terms have changed" notice for every small step.

We do not collect, and have no current plan to collect: your precise geolocation, biometric information, or the contents of your device outside Forge.

3. How we measure and use your account activity

Four systems use information about your account activity. We keep them separate on purpose.

Items 1 to 3 below are Forge measuring how you use the app. We never use them to build an advertising profile of you, and we never share them with an advertising company. Item 4 is us measuring our own outreach. Separately from all four, Wiz Kidz has named Google Analytics (a "Google tag" set up specifically for Forge) as the measurement tool it plans to run on adult account screens and on our public website, and may add other companies' advertising tools alongside it. This tag is not active today — section 4 describes it fully, including exactly when and how it switches on, what Google will receive, and how you opt out.

You agree to items 1 to 3 as part of the End User Licence Agreement you accept the first time you sign in. They are not a setting you switch on or off. The advertising choices in section 4 are different: you can change them from your account at any time (see section 7). Your right to opt out of targeted advertising is not something the licence agreement can take away.

1. Operating your account. Signing you in, keeping your team and child assignments correct, sending you account-related email (invitations, PIN-reset confirmations, published Meetup Reports), and showing your dashboard. This is the ordinary data needed to run the service you signed up for.

2. Account analytics. Records of your sign-ins, session length, and activity, drawn from the account tables Forge already keeps to run the program — used to understand overall usage of Forge (how many coaches are active, how long a typical session lasts, whether people come back season over season). Reported only in aggregate: counts are published as program totals; averages, rates, and medians are withheld unless at least ten accounts contribute to the figure, so no number can be read back to one person.

3. Usage measurement. Forge records coarse, anonymous signals about how the app performs — which features are used, how long common tasks take (as ranges, not exact figures), and where the app is slow or fails to sync. These carry no name, email, or account identifier, and no text you have typed; they are tied only to a short-lived anonymous code that resets regularly. We use them solely to keep Forge working and to improve it — never for advertising. The same first-party system runs for every role; for a signed-in child it runs at a stricter standard, described in the child Privacy Notice.

4. Outreach measurement — adult screens only. How you found Forge, whether an invitation became an account, and which onboarding step you completed, so we know where to focus outreach. This is first-party and is not shared with any advertising network. A child's signed-in session is never part of it, and it is never combined with a child's information.

Aggregate, anonymous statistics about the program as a whole (for example, "42 coaches ran practice sessions with their teams this season") may be shared outside Forge — in materials describing the program to potential partners or supporters. We do not publish a figure about you individually, and no such aggregate is published from a group smaller than ten contributing accounts. This is the same rule that governs any aggregate touching your child's activity, applied here to your own.

4. Marketing communications

• Operational email — invitations, PIN-reset confirmations, Meetup Report notifications — is necessary to run your account and is not something you can opt out of while keeping the account.

• Discretionary marketing email (season announcements, newsletters, program updates) is not yet something Forge sends. If and when it starts, every such email will carry a working unsubscribe link and our mailing address, as required by the CAN-SPAM Act, and unsubscribing from marketing email will never affect the operational email above.

• Google Analytics on adult screens — not switched on yet. We've picked the tool we plan to use to understand how adults find and use Forge: Google Analytics, set up specifically for Forge. It isn't running today. It goes live only once (i) a structural boundary is in place that keeps it off any screen a child can load, including the PIN sign-in screen, and (ii) the privacy protections below are built and turned on. We're telling you about it now, in full, before either of those is true — so that turning it on later doesn't require a new notice or asking you again.

  Here's what will be true once (and only once) it's switched on:

  • It only ever runs on adult screens — the Coach, Parent, and Administrator parts of Forge, and our public website. It will never load on any screen a child can reach, including the PIN sign-in page. Google will never see anything about your child or your child's session.

  • Google will receive: the pages you view, a general location (city-level, from a shortened IP address), your device and browser type, and a Google-assigned browser identifier. That's separate from Forge's own usage tracking in section 3, which never goes to Google.

  • You'll be able to turn it off (see section 7) — an opt-out control in your account, and we'll also honor your browser's Global Privacy Control or Do Not Track setting as an opt-out, automatically. This stays available even though the section 3 measurement is agreed once in the licence agreement — a right to opt out of this kind of tracking isn't something a licence removes.

  If anything about this changes before it's switched on, we'll update this notice first.

  • Configuration we will hold Google to, from the day it is switched on: IP addresses truncated before storage; data retained by Google for the shortest period Google offers — if any of this changes, we update this notice first.

  • If we add another company's advertising tag alongside Google, we update this notice to name it and what it receives, and the same protections above apply to it.

5. Who can see your information, and where it's stored

Access is limited by role: a Coach sees the roster information needed to run their team; an Administrator sees the full roster to operate the program; one Parent never sees another Parent's account information. We store account information with a third-party cloud database and authentication provider (Supabase), protected in transit and at rest. We do not sell your information. Once the Google Analytics tag described in §4 is switched on (it is not yet), Google will receive adult-screen analytics data as our service provider; §4 limits that tag to adult screens, keeps it away from anything a child can reach, and gives you an opt-out. Any additional advertising vendor is named in §4 before it goes live.

6. How long we keep it

Your account information is kept while your account is active. If you delete your account, your Coach or Administrator role and access are removed; if you are a Parent and the sole guardian for a child, deletion asks you to either invite a replacement guardian or confirm deleting the child's account and information together. Account-analytics rollups persist as long as the underlying account does; anonymous telemetry raw events are deleted after 90 days regardless of account status, whether or not you keep your account.

7. Your rights

You may, at any time, contact support@wizkidz.ai to:

• Access the information Forge holds about your own account;

• Correct your display name or role-relevant information;

• Delete your account (see §6 for what that does and does not affect); and

• Opt out of marketing communications and, once the Google Analytics tag described in §4 is active (it is not yet — see §4), of that tag and any other advertising/analytics tag.

The targeted-advertising opt-out will be available even though the usage measurement in §3 is agreed once through the End User Licence Agreement rather than a settings toggle: a right to opt out of targeted advertising is not something a licence term removes.

Once the Google Analytics tag or any other third-party advertising/analytics tool described in §4 is active, Forge will honor a browser's Global Privacy Control signal as an opt-out of it, whether or not Oregon law requires it of a business Forge's size. When you opt out — by the in-product control or by GPC — Forge will not load the tag on your session. The in-product opt-out and the GPC/DNT handler are built and turned on before the tag itself is switched on, not after.

Why we offer these rights now. Oregon has a consumer privacy law (the Oregon Consumer Privacy Act) that usually applies only once a business is above a certain size. We are giving you these rights now anyway, even though the law may not require them of a company our size yet. It is easy to build them in at our size, and much harder to add them later once the company has grown.

8. Security

We use reasonable safeguards, including encryption in transit and at rest and role-based access controls, to protect your account information. No system is perfectly secure; if a breach affecting your information occurs, we will respond and provide any notice required by Oregon and federal law.

9. If you're a Parent: your child's information is separate

Your own account is covered by this notice. Your child's information — name, grade, avatar, practice scores, task completion, Meetup Report content, Student ID and PIN — is covered by the Direct Notice, Parental Consent Agreement, and Privacy Notice, which you accept separately, per child, when you enroll them.

10. Changes to this notice

If we make a material change to what we collect from you or how we use it, we will post an updated version here and, where the change is significant, tell you directly (for example, by email or an in-app notice) before it takes effect.

11. Governing law

This notice is governed by the laws of the State of Oregon and applicable U.S. federal law, including the FTC Act and the CAN-SPAM Act.

Wiz Kidz Forge Privacy Consent

1. Who we are

Forge is operated by Wiz Kidz (The Kumars Academy of Science and Technology, LLC), located in Portland, Oregon. For any privacy question or request, contact support@wizkidz.ai / +1 (971) 771-7405 / 15619 NW Trakehner Way, Portland, OR 97229.

2. Information we collect from children

First name and last initial; grade; a chosen avatar (a picture selected from a set we provide — not a photograph of the child); practice hours and meetup hours; Robot Game practice scores; task completion status; the content of coach-written Meetup Reports about the team's activity; and a system-generated permanent Student ID and login PIN. We also collect the registering parent's display name and email address; the parent signs in through their Google account, so Forge does not create or store a separate password.

We collect only what we need to run the program. We do not collect a child's email, full name, birth date or birth year, home address, telephone number, photograph, precise location, or biometric information.

Usage measurement. Separately from the information above, Forge records grouped counts of how the app is used — which screens are opened, how long common tasks take, and where the app is slow or fails to sync. Each count carries only: an anonymous code for the browser, an anonymous code for the visit, which screen was in use, whether the person was a parent, coach, student or administrator, the hour it happened, and a pre-set answer chosen from a fixed list (for example "under a minute" rather than a timing, or "sync failed" rather than an error message).

These counts carry nothing that identifies your child — no name, Student ID, PIN, team, or grade — and no free text of any kind. The browser code is not linked to any account anywhere, and it is replaced regularly: every 90 days, on sign-out, whenever a child signs in or out with their PIN, and whenever Forge data is cleared or consent is withdrawn.

3. How we use the information

To run the coaching program. We record and show scores and progress, make Meetup Reports for families, show the program calendar, send reminders in the app, and let coaches assign tasks and see when they are done.

To keep Forge running, keep it secure, fix problems, and make it better. Part of making it better is a study of what teams do. We look at whole teams. We never single out one child, and we never use a child's grade. We look at which coaching activities and practices tend to go along with teams that do well, so we can improve Forge and the advice we give coaches. This study uses activity records — things like practice logs, hours, completed tasks, and the Meetup Reports coaches write — and those records are linked to a team, not to a child as an individual. We do this study with our own tools.

Sending this information to an outside company, or using it to train an AI model, would be a major change ("material change"). We would not do either one without first issuing a new version of this notice and asking for your consent again.

We use the usage counts described in section 2 only to keep Forge working and to improve it — to find what is slow, what fails on a weak connection, and where the app is confusing. We do not use your child's activity for advertising, ad targeting, audience-building, or to measure advertising campaigns, and we do not use it to evaluate, score, rank, or profile any child. We may publish anonymous, grouped totals about the program as a whole — for example, total students or total practice hours — in materials describing Wiz Kidz; these contain no information about any individual child. Reports built from these counts are shown only to a Wiz Kidz administrator, and only as totals: a figure is withheld unless at least ten separate browsers contributed to it, so no figure can be traced back to one family.

4. How we share and store the information

We do not sell children's personal information. We do not use it for advertising or targeted advertising. We do not use it to train AI models. When we study this information to make Forge better (see section 3), that is us using it ourselves — not selling it, not sharing it outside Wiz Kidz, and not training AI with it. Inside the program, who can see the information depends on their role: your child's coach, a Wiz Kidz administrator, you, and your child.

We store the information with a third-party cloud database provider (Supabase). Data is protected in transit and at rest. Some information may be stored on your or your child's device so the app works offline; that on-device information is cleared when you log out or withdraw consent.

The usage counts in section 2 are handled the same way and are not shared or sold either. They are collected by Forge itself and stored in the same cloud database — no analytics company or advertising network receives your child's information, and none of these tools runs on any screen your child uses.

About Google Analytics / the Google tag. Wiz Kidz has named a Google tag (a Google Analytics property set up specifically for Forge) that it plans to use, in the future, to understand how adults use Forge — it is not active today. When it is switched on, it will run only on Wiz Kidz's public website and on the signed-in screens for parents, coaches, and administrators. It will never be placed on any screen your child uses, and it will never be on the sign-in screen where your child enters their PIN. Google will not receive your child's information. The Adult Privacy Notice describes this tool in full, including its current status, what Google will receive about an adult, and how an adult can opt out. Putting a Google tag — or any other outside advertising or analytics service that would receive your child's information — on a screen your child uses would be a major change, and we would issue a new version of this notice and ask for your consent again before doing it.

5. Recording and AI

The Forge app does not record audio or video, does not record or transcribe sessions, and does not use AI to profile, evaluate, rank, or make decisions about your child. If we add any such feature to Forge in the future, we will update this notice and ask for your consent before it applies to your child.

Separately, as part of your child's participation in the in-person Wiz Kidz Program (club meetups, practices, and competition events), Wiz Kidz may take photos or record audio/video of program activities. That recording is covered by the consent given when your child enrolled in the Wiz Kidz Program, is not governed by this Forge Privacy Notice, and is not stored in or accessible through Forge.

6. How long we keep it

We keep your child's personal information for as long as your child takes part in Wiz Kidz programs, across seasons. We do this because a child's coaching history from season to season is part of what Forge is for. We delete the information if you withdraw your consent or ask us to delete it. In every case, we delete it no later than 5 years after your child's last active season — the last season your child took part in. We keep a written policy that says how long we keep each kind of information, and we do not keep a child's personal information forever. When we delete, we remove the information from our online storage and from copies saved on devices. If we are deleting the information because you withdrew your consent, we first offer you a copy of your child's information to download and keep (see section 7).

The 5 years is a maximum, not a promise. It is the longest we will keep your child's information after they stop taking part — not a commitment to keep it that long. We may delete it sooner, for any reason, and we are not obligated to preserve your child's history for the full period. If you want to be sure you have your child's record, download a copy (section 7); do not rely on us still holding it if your child returns after a long gap.

If Forge, the program, or Wiz Kidz shuts down. If we discontinue Forge, end the program this serves, or wind down the company, we are not required to keep running Forge or holding your child's information for the rest of the 5 years. What we will do is: tell you in advance (we aim for at least 30 days' notice where circumstances allow), keep the download in section 7 available during that time so you can save your child's record, and then securely delete your child's personal information. We will not sell your child's information or hand it to an unrelated company as part of a shutdown. The only exception is if another organization takes over the same program for the same families under these same terms — if that happens, we will tell you before it does and you can withdraw and delete first.

About the permanent Student ID. We call the Student ID "permanent," so here is exactly what that means. The ID stays the same for the whole time your child has a Forge record. It does not change if your child switches teams, moves up a grade, or comes back for a new season while we still have the record. But it is not kept forever. When we delete your child's information — because you withdrew your consent, because you asked us to, or because the 5-year limit above was reached — we delete the Student ID and everything linked to it as well. If your child comes back after that, they get a brand-new record and a brand-new Student ID.

Where the law allows it, we keep a few small records even after a deletion, to keep our own records accurate and complete. These are: that consent was given or withdrawn; that a PIN was reset; and, after a deletion, the Student ID on its own with nothing attached to it. Keeping the retired Student ID means a deleted record cannot quietly come back later — not even if we restore a backup. None of these small records hold your child's coaching history, name, or contact details.

We also keep an encrypted backup of our database, kept for disaster recovery only and retained for up to 30 days. Deleting your child's information removes it from active use immediately; a copy may remain in an already-made backup for up to 30 days until that backup itself is retired, after which no copy exists anywhere. We do not restore from a backup except to recover from a failure, and never to bring back information that was deleted at your request.

The usage counts in section 2 are deleted 90 days after they are recorded. Grouped totals built from them — which are only counts, with nothing left that could point to a person — may be kept longer. Being straightforward about one thing: because those counts never contain your child's Student ID or anything linked to it, there is nothing in them for us to find and delete when you withdraw consent, and we will not claim otherwise. What happens instead is that the browser's random code is replaced immediately, so nothing recorded afterwards connects to anything recorded before, and everything already recorded ages out within 90 days.

7. Your rights as a parent

Consenting is required for your child to use Forge. If you do not consent, or if you later withdraw consent, your child will not be able to create or use a Forge account. This does not affect your child's ability to take part in the in-person Wiz Kidz Program itself — Forge is the coaching app layered on top of the program, not the program.

At any time, you can:

• See the personal information we hold about your child.

• Download a copy of your child's Forge information to keep.

• Delete your child's personal information.

• Tell us to stop collecting or using your child's information.

• Withdraw your consent. When you withdraw, we first offer you a copy of your child's information to download and keep. Then your child's access to Forge ends and we delete your child's information. Keeping your own copy lets your family build on earlier seasons even after our copy is gone.

You may also turn usage measurement off from your parent account. Your choice applies to you and to every child in your family, takes effect immediately, discards anything waiting to be sent, and does not change or reduce anything else about Forge.

To exercise any of these, use the controls in your parent account or contact support@wizkidz.ai. We will verify that the request comes from the child's parent before acting on it.

8. Security

We use reasonable safeguards, including encryption in transit and at rest and role-based access controls, to protect children's information. No system is perfectly secure; if a breach affecting your child's information occurs, we will respond and provide any notice required by Oregon and federal law.

9. Not a school record

Forge is operated by Wiz Kidz as a private enrichment program. It is not operated for or on behalf of a school, and the information in Forge is not a school education record.

10. Changes to this notice

If we make a material change to what we collect or how we use children's information, we will issue a new version and ask for your consent again before the change applies to your child.

11. Governing law

This notice and our handling of your child's information are governed by the laws of the State of Oregon and applicable U.S. federal law, including COPPA.