Children’s Privacy Notice

Effective date: November 12, 2026 1. Who operates Bleoh Bleoh is a private online club for children and families at bleoh.com. This notice explains how we handle children’s personal information on Bleoh, including information connected to a child’s account that a parent provides during signup or while managing that account. The operator responsible for children’s privacy is Lion Star. Contact us to ask about this notice or to review, correct, or request deletion of your child’s information. Mailing address: 3760 W McFadden Ave, Suite B, MB#108, Santa Ana, CA 92704 Email: contact@bleoh.com 2. How parents give permission A parent or legal guardian starts signup with their own email address and a password. Bleoh sends a direct notice and a one-time code to that address. Entering the code confirms access to the inbox. Epic Games’ Kids Web Services (KWS) checks whether the person completing verification is an adult. In Bleoh, the adult then confirms their authority to act for the child and gives permission for that child. After verification, the parent or guardian checks the consent box to permit the collection and use of their child’s information and the sharing described for general club use in Section 4. Bleoh records the consent and notice version before enabling the child’s account. Parents can decide separately whether to allow live calls for each child. Calls are off by default. 3. What we collect and why Account and profile. Bleoh uses the child’s username and nickname or display name to identify them in the club. A password protects the account. Bleoh stores a password hash. The child may choose an avatar or upload a profile photo. Club activity. Bleoh stores chat messages and reactions, event responses, assignment check-ins, challenge replies, quiz answers and results, Showcase projects and images, team contributions, suggestions, votes, stickers, and game awards. We use this information to run activities, show progress, moderate the club, and let parents review their child’s activity. Information that children include in posts or images becomes part of those submissions. We encourage children to use a nickname and keep their address, school, and contact details out of club content. Live calls. When a parent enables calls, the child’s browser sends their voice and camera video to the other participants over an encrypted connection. The connection may be direct or go through Bleoh’s TURN relay. Network information such as IP addresses is used to establish and maintain the call. Bleoh’s calling feature does not record or store call audio or video. Technical information. Bleoh and its hosting systems receive information such as IP addresses and browser or request details to deliver the site, diagnose problems, and protect accounts. Bleoh uses a sign-in cookie to maintain the session. Parent and consent records. Bleoh uses the parent’s email address and password hash to operate the parent account. The child’s country or region helps select available verification methods. We keep the verification result and reference, the linked account information, the notice version, consent choices and timestamps, and records of requests to administer access and respond to parents. Bleoh does not sell children’s information or use it for targeted advertising. We ask for only the information reasonably needed for a child to take part in an activity. 4. Who receives information Club members. Bleoh makes member content available inside the signed-in club and keeps it off the public website. Signed-in members can see nicknames, profile pictures, chat posts and reactions, challenge replies, and approved Showcase projects. Team contributions are available to the assigned team and authorized administrators. Players may see participant names and results in games and quizzes. When live calls are enabled, the people in a call receive the other participants’ voice and video. Copies made by members. Other members who can see a post or join a call may be able to copy content, take screenshots, or record through their own devices. Use a nickname and keep school names, home addresses, contact details, and other identifying information out of posts and calls. If someone shares your child’s personal information or misuses a call, contact contact@bleoh.com so we can review it. Parents and staff. A verified parent can see selected activity for their own linked child in the Parent Portal. Authorized administrators can access information to run the club, moderate content, manage membership, and handle parent requests. Hosting. We use an infrastructure provider to host Bleoh and store its records so we can operate and secure the club. Email. Google Workspace receives the recipient’s email address and message content to deliver signup codes and notices to parents. If you email us, we use the information in your message to respond to your question or request. Adult verification. Kids Web Services Ltd, an Epic Games company, receives the parent’s email address, the child’s country or region, and a verification reference to perform the adult check. When a parent uses card verification, they enter their card details on the hosted verification page. Stripe processes the card check. Bleoh receives the verification result and reference. See the KWS privacy notice at https://www.kidswebservices.com/privacy-policy. Legal and safety disclosures. When required by law or valid legal process, we may provide relevant information to courts, regulators, or law enforcement. Where permitted by law, we may provide relevant information to emergency responders or child protection authorities to address a serious safety threat. Sharing choices. General club activities that involve other members share the information described above with those participants. You can approve general club use and leave live calls off. If you enable live calls for your child, their voice and video are shared with the other call participants. You can turn calls off in the Parent Portal. 5. How long we keep information • Pending signup. One-time codes expire after 10 minutes. Unfinished signup sessions expire after 24 hours or when the server restarts. If we do not obtain consent, we delete contact information collected solely to send the direct notice and obtain consent within [confirmed period] after sending that notice, including contact information linked to a signup that never records consent. • Child accounts and activity. We keep account and activity information as needed to provide and supervise membership. We delete the child’s personal information from active systems on this schedule: [confirmed deadlines measured from membership ending, consent withdrawal, or verification of a deletion request]. The separate schedules below apply to technical logs, recovery copies, and limited consent and request records. • Technical logs. We keep web access and error logs and any system and call-relay logs for [confirmed retention periods for each log type]. We use these logs to diagnose service problems, protect accounts, and investigate security incidents. • Backups. We keep private recovery copies for [confirmed retention period from creation] to recover the service after a failure. Information removed from active systems may remain in a recovery copy until that copy expires. [Confirm and describe how deletions and consent withdrawals are reapplied if a backup is restored.] • Verification, consent, and request records. During membership, we keep the verification result and reference, the linked account identifiers, notice version, consent choices and timestamps, and the records needed to respond to privacy requests. After membership ends or consent is withdrawn, we keep only the minimum records needed to verify the permissions previously given, document a privacy request or deletion, and prevent deleted information from being restored. We delete these limited records [confirmed period and starting event]. We retain information for a longer period when the law requires it and delete it when that requirement ends. 6. Parent choices and requests Sign in to the Parent Portal to see activity for your linked child, change access and live-call permissions, withdraw consent, or request a full review or deletion of your child’s information. You can also contact us using the details in Section 1. We verify your identity and authority before releasing or deleting a child’s information. You can withdraw consent to refuse further collection or use of your child’s personal information for club activities. We disable the child’s access and handle deletion under Section 5. You may also request deletion directly through the Parent Portal or by contacting us. Turning off live calls removes the child’s access to that feature. 7. How we protect information Bleoh uses HTTPS and stores passwords as hashes. The Parent Portal restricts access to the children linked to that parent account. If a security incident affects personal information, we investigate, take steps to contain it, and notify affected families and authorities when required by applicable law. 8. Changes to this notice If we materially change how we collect, use, or disclose children’s information, we will give parents an updated direct notice and obtain renewed consent before applying the changes to their child’s information. The current notice is at https://bleoh.com/privacy.