Privacy Policy

Our Commitment

Childrens Wellbeing, Inc. ("Company," "we," "us," or "our"), which operates The SuperMe Club ("SuperMe"), builds a gamified health and wellness platform for children in grades K through 8. Protecting the privacy of the children who use SuperMe is at the center of how we designed our product. We collect as little information as possible, we never sell it, and we hold ourselves to the standards set by the Children's Online Privacy Protection Act (COPPA), the Family Educational Rights and Privacy Act (FERPA), the California Student Online Personal Information Protection Act (SOPIPA), and other applicable student data privacy laws.

This policy explains what we collect, what we deliberately do not collect, how the information is used, and the rights that schools and parents have.

Who This Policy Covers

This policy applies to children who use SuperMe through their school, as well as to the teachers, school administrators, and parents who interact with the platform. Children access SuperMe in an educational context, and participating schools provide consent on behalf of parents for the collection and use of student information solely for that educational purpose, consistent with COPPA.

On-Device Exercise Detection

SuperMe turns a child's real physical exercise into action inside the game. To do this, the platform uses the device camera to detect body position and movement in real time while the child is playing.

We want to be completely clear about how this works:

• Body-position detection happens locally, on the device itself, and controls the child's in-game avatar in real time.
• The current runner does not record, upload or save the camera feed. Camera frames are processed in memory on the device to detect movement.
• The camera feed and pose coordinates stay on the device. Gameplay outcomes, such as jumps, scores and progress, can be saved with the student account.
• The current runner uses body-position detection, not facial recognition, and does not create a stored identity or faceprint from the camera feed.

Students can also play with keyboard or on-screen buttons without enabling the camera.

Information Students Enter

Students can enter short written reflections in Daily Missions and answer questions in the game. Reflections are saved with the student's account and can be read by authorized school staff through their classroom tools. Quiz answers, results, rewards and curriculum progress are also saved to support learning and resume play.

Students should not include contact details, passwords or private health information in their reflections. A school or parent can request review, correction or deletion using the contact details below.

Account and Classroom Information

School-managed accounts include a name or username, a school email or login identifier where used, school and classroom membership, grade and teacher assignments. A student profile may also contain an age entered by staff. Teachers can manage classroom sign-in cards and PINs. Account records can include links to authorized parent accounts.

The platform saves participation, quiz results, game sessions, math progress, rewards, teacher coin gifts and associated dates. These records support classroom activities, saved progress and authorized staff views. Students need an authorized account to save their work.

Cookies, Browser Storage and Diagnostics

We use essential sign-in cookies and browser storage for account display, a remembered class code, preferences and saved game progress. Signing out invalidates the server session. Shared devices should be signed out between students.

AWS CloudWatch RUM receives limited diagnostic events to help us find application failures. Our error reports use fixed error categories, generated application file locations, a broad app area and the deployed version. We do not send raw error messages, reflection answers, camera images, full page addresses or query strings in these reports. Session replay, automatic network-request recording and RUM tracking cookies are disabled.

We also send limited operational game summaries to AWS: which game page is opened or ended (including introductory screens), a general ending category and rounded time on that page, which can include pauses. Camera-control summaries can include frame-rate and timing measurements, setup status, tracking losses and recoveries, and counts of jumps or ducks accepted by the game. These custom event details do not include account, student, school, classroom, race or game-session identifiers, camera recordings or pose coordinates. They help us assess game reliability and responsiveness; they do not establish attendance or whether every intended movement was detected.

AWS also processes technical metadata such as network IP address, browser and device information, a diagnostic session identifier and approximate location derived from the IP address. This does not use device GPS. Browser diagnostic events are retained by AWS RUM for 30 days. Its authentication library may cache restricted diagnostic-upload credentials in browser storage. These diagnostics are used for operation and reliability, not targeted advertising.

How We Use Information

We use the limited information we collect only to:

• Create and maintain a child's account so their progress is saved,
• Allow teachers and school administrators to see participation and support students,
• Enable in-game features such as multiplayer play within the school setting, and
• Operate, maintain, secure, and improve the platform.

We use information solely for educational and platform purposes. We never use it to build a profile of a child for any purpose unrelated to the educational service.

What We Never Do

We want schools and parents to understand our firm limits:

• We do not sell, rent, or trade children's personal information to anyone.
• We do not use children's personal information for targeted or behavioral advertising, and we do not allow third parties to do so.
• We do not build advertising or marketing profiles of children.
• We do not disclose children's personal information to third parties for advertising or any other purpose that is not integral to providing the service.

Service Providers and Third Parties

We work with a small number of trusted service providers that help us operate the platform, such as secure hosting and database services. These providers may process the limited account information described above only to perform services for us, under contracts that require them to protect the information and prohibit them from using it for any other purpose.

The categories of third parties we share limited account information with, and the purpose of each, are:

We do not disclose children's personal information to any third party for targeted advertising. If we ever wished to disclose personal information for a purpose that is not integral to the service, we would first obtain separate verifiable consent, consistent with COPPA.

Data Retention and Deletion

We do not retain children's personal information for longer than is reasonably necessary to provide the educational service.

• We retain a child's account information (name or username and school email) only for as long as the child's school maintains an active account, or as directed by the school.
• When a school ends its use of SuperMe, or when a school or parent requests deletion, we delete the associated children's personal information within 60 days, except where a longer period is required by law.
• We never retain children's personal information indefinitely.
• The current runner does not retain camera images or video, as described above.

Data Security

We use technical controls including TLS for information in transit, database encryption at rest, hashed account passwords, role and classroom access checks, sign-in attempt controls and operational monitoring. Classroom PINs are a separate sign-in method: authorized staff can read and reprint them for students. No system can guarantee complete protection; we review and improve these controls as the service changes.

School Consent and Parental Rights

Because SuperMe is used in schools for an educational purpose, participating schools may consent to the collection and use of student information on behalf of parents, as permitted under COPPA. Consistent with FERPA, SuperMe acts as a service provider to the school, the school controls the student records, and we use student information only under the school's direction.

Parents and schools have the right to:

• Review the personal information we have collected from a child,
• Request that we correct or delete that information, and
• Refuse to permit further collection or use of the child's information.

To exercise any of these rights, parents should contact their child's school, or contact us directly using the details below and we will work with the school to fulfill the request.

Children Outside a School Setting

SuperMe is designed for school-authorized use. If we learn that a child's information has reached us without the required school involvement and consent, we will work with the school to investigate and address it. Please use the contact details below to report a concern.

Changes to This Policy

If we make material changes to this policy, we will update the effective date above and notify participating schools before the changes take effect, so that schools can review the changes on behalf of the families they serve.

Contact Us

If you have questions about this policy or about how we handle children's information, please contact us:

Childrens Wellbeing, Inc.
Operator of The SuperMe Club
Email: privacy@thesupermeclub.com