2. PRIVACY POLICY

⚖️ This policy must be reviewed by a qualified attorney before public launch, because Enginaut knowingly collects personal information from children under 13 and is therefore subject to the U.S. Children's Online Privacy Protection Act (COPPA) and related rules.

1. Who we are

Enginaut ("Enginaut," "we," "us," or "our") is an educational application that helps middle and high school students explore different fields of engineering through short, interactive lessons. This Privacy Policy explains what information we collect, how we use it, how we protect it, and the choices and rights you and your child have.

If you have any questions about this policy or your data, contact us at enginaut.app@gmail.com.

[BRACKET: If Enginaut is operated by a registered company or by you personally, state the legal name and mailing address here. A physical contact address is expected in a COPPA-compliant policy.]

2. Who can use Enginaut, and a note for parents

Enginaut is designed for learners of middle and high school age. We allow children under the age of 13 to use Enginaut, but only with verifiable consent from a parent or legal guardian, as required by COPPA. If you are under 13, you must have a parent or guardian complete the consent step before you can create an account and use the app.

If you are a parent or guardian, this policy explains what we collect from your child and the rights you have to review, delete, and control that information. You can exercise those rights at any time by contacting enginaut.app@gmail.com.

3. What information we collect

We collect only what we need to run Enginaut and help students learn. Specifically:

Information you or your child provide when creating an account:

• First name or a display name
• Email address (the child's and/or the parent's, depending on the sign-up path)
• Age or date of birth (used to determine whether the parental-consent step is required)
• Sign-in credentials, or a Google sign-in token if you choose to sign in with Google

Information created as your child learns:

• Lessons started and completed, answers chosen, and progress through courses
• Streaks, goals, and other learning stats
• Preferences and settings selected in the app

Information collected automatically (usage analytics):

• Basic device and app information (such as device type, operating system, and app version)
• How the app is used (such as which screens are visited and which features are used), so we can find and fix problems and improve lessons
• General, approximate location derived from an IP address (country/region level), not precise location

We do not knowingly collect more personal information from a child than is reasonably necessary for them to use Enginaut.

4. What we do NOT do

• We do not sell or rent personal information. ⚖️
• We do not show behavioral/targeted advertising to children, and we do not allow third parties to use children's data to build advertising profiles.
• We do not require a child to disclose more information than is reasonably necessary to use the app as a condition of participation.
• We do not knowingly collect precise geolocation, contacts, photos, or similar sensitive data from children.

5. How we use the information

We use the information we collect to:

• Create and manage accounts and keep learners signed in
• Save and display learning progress, streaks, and preferences
• Operate, maintain, and secure the app
• Understand how the app is used so we can fix bugs and improve lessons (analytics)
• Communicate important account or service information (for example, to a parent about consent)
• Comply with our legal obligations

When a paid plan becomes available in the future, we will use necessary information to process payments and manage subscriptions, and we will update this policy before doing so. [BRACKET: update this section when payments launch — payment data is typically handled by a third-party processor and this must be disclosed. ⚖️]

6. How we share information (service providers)

We do not sell personal information. We share limited information only with trusted service providers who help us run Enginaut, and only so they can perform services for us. These may include:

• Our hosting and database provider (for example, [Supabase] and [hosting provider]) to store accounts and progress
• Our sign-in provider (for example, Google) if you choose Google sign-in
• Our analytics provider ([BRACKET: name your analytics tool, e.g. PostHog, Plausible, Google Analytics — and confirm it is configured in a child-appropriate way]) ⚖️

We require these providers to protect the information and use it only for the services they provide to us. We may also disclose information if required by law, to protect the rights and safety of our users, or in connection with a business transfer (such as a merger or acquisition), in which case we will notify affected users as required.

7. Parental rights (COPPA)

If your child is under 13, you have the right to:

• Review the personal information we have collected from your child
• Request deletion of your child's personal information
• Refuse further collection or use of your child's information (note: this may mean your child can no longer use parts of the app)
• Revoke your consent at any time

To exercise any of these rights, contact us at enginaut.app@gmail.com. We will verify that you are the parent or guardian before acting on the request, to protect your child's privacy.

8. How we get parental consent

When someone indicates they are under 13, we require a parent or guardian to provide verifiable consent before the child's account becomes active and before we collect personal information beyond what's needed to obtain that consent. [BRACKET + ⚖️: describe your ACTUAL consent method here once finalized — e.g. parent email confirmation plus an additional verification step. Note: a plain "enter a parent email" step alone may not meet COPPA's "verifiable parental consent" standard for all types of data use; confirm your method with a lawyer.]

9. Data retention

We keep personal information only as long as needed to provide Enginaut and for legitimate, disclosed purposes such as legal compliance. If an account is deleted, or a parent requests deletion, we will delete or de-identify the associated personal information within a reasonable period, except where we are required to retain it by law.

10. How we protect information

We use reasonable administrative, technical, and physical safeguards to protect personal information, including [BRACKET: e.g. encrypted connections, access controls, and a reputable hosting provider]. No system is perfectly secure, but we work to protect your child's information and to limit who can access it.

11. Cookies and similar technologies

Enginaut uses cookies or similar technologies to keep users signed in, remember preferences, and collect the usage analytics described above. You can control cookies through your browser settings, and our cookie banner lets you decline non-essential cookies. [BRACKET: ensure this matches what your cookie banner actually does.]

12. Changes to this policy

We may update this Privacy Policy from time to time. If we make material changes — especially changes to how we handle children's information — we will notify parents and users as required by law and update the "Last updated" date above. For material changes affecting children's data, we will obtain new parental consent where the law requires it.

13. Contact us

Questions, requests, or concerns about privacy: Email: enginaut.app@gmail.com [BRACKET: mailing address]