Direct Notice to Parents — PlayGM

Delivered by: email to the parent-provided address
Purpose: to give a parent the information the Children's Online Privacy Protection Act (COPPA) requires them to see before they consent, so they can make an informed decision.
Version: NOTICE-2026.1
Effective date: {{PLACEHOLDER: launch date}}
Companion: Privacy Policy at {{PLACEHOLDER: URL of privacy policy}}

This file has two parts: Part A is the exact text sent to the parent, ready to drop into the transactional email template. Placeholders in double curly braces are filled at send-time from the pending consent record. Part B is a compliance map from § 312.4(c) of the COPPA Rule to the paragraph of Part A that satisfies each element. This is for internal and counsel review; it is not shown to the parent.

Part A — the parent-facing message

Subject: Please review this before {{child_display_name}} plays PlayGM

Hi,

Someone using this email address opened a PlayGM household and wants to add a child profile for {{child_display_name}} in the {{age_band}} age band. Before we let {{child_display_name}} play, US law (COPPA) requires you to see what we would collect and how we would use it, and to give us your consent.

If you did not open this account, you do not have to do anything — the account will be canceled automatically if you don't respond in 14 days, and we will delete this email address and the pending record.

Who we are

PlayGM Inc. Contact us at stefan@playgm.app, PO Box 95, Armonk NY 10504, or 914-294-5209.

What we would collect from your child, and why

We collect only what we need to run the game.

• A display name you approve (not your child's real name), so we can identify {{child_display_name}} in the app.
• An age track — a broad band such as "7–9" — so we can serve age-appropriate content. We do not collect your child's date of birth.
• Gameplay records — drafts, rosters, scores, and trivia answers — to run the game.
• Questions your child types to our in-game assistant, Ask Scout. These are sent to Google's Vertex AI in real time to get an answer, and then discarded. We do not save them. Google does not save or review them either, under a written commitment we have on file.
• A session token so the app can stay logged in.

We do not collect your child's real name, birthdate, address, phone number, photograph, voice, location, biometric identifier, contact list, or any advertising identifier. When your child scans a physical trading card, the image is processed entirely on the device and nothing about it leaves the device.

What we would collect from you

• Your email address, so we can verify this consent and contact you about the account.
• Payment information if you subscribe, processed by our payment provider and not stored by us.

How we would use what we collect from your child

Only for the following purposes, and no others:

1. To run PlayGM: create the profile, remember the game state, show age-appropriate content.
2. To answer questions your child asks Ask Scout.
3. To keep the service secure and prevent abuse.
4. To respond to a request you make (review, correction, deletion, refusal of further collection, appeal).

We will not use your child's personal information for advertising, profiling, or training any general-purpose AI model.

Who we would share it with

Only with service providers who use it strictly to run PlayGM for us, under written contracts. Today those providers are:

• Supabase — our database and authentication.
• Vercel — our website and background jobs.
• Google Cloud (Vertex AI) — runs Ask Scout, receives your child's questions in real time, does not store them.
• Resend — sends parent emails (yours only).
• {{PLACEHOLDER: payment processor}} — bills your subscription.
• {{PLACEHOLDER: Expo/EAS classification}}

If we ever want to share your child's information with someone else who is not solely providing services to us, we will ask your consent first.

We do not sell your child's personal information. We do not use it for targeted advertising. We do not disclose it to anyone else except when required by law.

Your rights

At any time, you can:

• Review what we have collected from {{child_display_name}}.
• Delete it.
• Refuse to allow further collection while keeping the account.
• Correct anything that is wrong.
• Consent to collection without consenting to disclosure to any recipient that is not integral to providing PlayGM. See the option below.

You do not need to create or log in to an account to make a request. Email stefan@playgm.app, use the parent surface in the app, or use the web form at {{PLACEHOLDER: URL of web request form}}.

We acknowledge every request within 5 business days and respond within 30 days. We may extend once by 45 days for complex requests, with written notice inside the initial period. If we deny a request, we tell you the reason and how to appeal.

Please make two choices

Choice 1 — do you consent to us collecting your child's personal information, using and sharing it only as described in this notice?

• ☐ Yes, I consent.
• ☐ No, I do not consent. (You will not be able to add {{child_display_name}}. We will delete this email and the pending record.)

Choice 2 — separately, do you consent to us sharing your child's information with recipients above who are not strictly needed to run the game?

Today, every recipient listed above is strictly needed to run the game. There are none we would need this consent for at launch. Your choice here takes effect if that ever changes: we will honor your election and will not add a non-integral recipient without your consent. This choice does not gate Choice 1.

• ☐ Yes, I consent to future non-integral sharing described in an update.
• ☐ No, I do not consent to any non-integral sharing. (You can change this later.)

How this consent is confirmed

After you tap Consent, we will send you a second confirmation message in {{confirmation_delay}} to make sure the consent is really from you. If you do nothing, the account is not created. You can revoke consent at any time from the parent surface or by emailing us.

We keep proof of your consent for five years in a minimized form (see the Privacy Policy § 14). We do this so we can show a regulator we had consent, without holding a plaintext copy of your email address any longer than necessary.

Where to read more

• The full Privacy Policy is at {{PLACEHOLDER: URL of privacy policy}}.
• The Retention Policy — how long we keep what, and how deletion actually runs — is at {{PLACEHOLDER: URL of retention policy}}.
• The Terms of Service are at {{PLACEHOLDER: URL of terms}}.
• Your child can read a shorter, kid-friendly version of what happens with their information at {{PLACEHOLDER: URL of kid summary}}.

Thanks,

The PlayGM team
stefan@playgm.app

Part B — compliance map (internal, not sent to the parent)

Each row cites the operative § 312.4(c) element, quotes the Part A paragraph that satisfies it, and flags any gap.

Retention of this notice: every parent's consent record stores the version identifier of the direct notice they saw (NOTICE-2026.1 at launch) so we can reproduce the exact text if asked. The versioned copy of every prior notice is archived at {{PLACEHOLDER: URL of notice archive}}.

Delivery mechanics:

• Send to the parent-provided email using Resend under our DPA.
• Log the send event, the delivered event, the opened event, and the clicked event to the consent_record_version schema. Do not log the message body — the notice version identifier is sufficient to reproduce it.
• If the parent does not act within 14 days, run the abandoned-consent purge: delete the email address and the pending child record.
• Second confirmation goes out after {{confirmation_delay}} using the same channel and is required for consent to be complete.

Counsel review: § 312.5(b)(2) email-plus permissibility depends on PlayGM making no disclosures of children's personal information to third parties. This notice claims that posture. The claim rests on (a) Google being a service provider under the Vertex AI DPA and the abuse-monitoring exception being on file, and (b) every other named recipient being a service provider under § 312.2. Counsel to confirm before this notice is sent to any parent.

Placeholders in this document

• Effective date (header)
• URL of the privacy policy (header, footer, § 312.4(c) links)
• URL of the retention policy (footer)
• URL of the terms of service (footer)
• URL of the kid-readable summary (footer)
• URL of the web request form ("Your rights")
• URL of the notice archive (retention note)
• Payment processor name (recipients list)
• Expo/EAS classification (recipients list)
• confirmation_delay — recommend 24 hours; owner and counsel to confirm
• child_display_name and age_band — populated at send from the pending consent record