🔒 Privacy Policy

Welcome to LockedIn! We're so glad you're here. LockedIn (lockedin.mobi) is a learning platform built for young legends aged 10 and up. We teach three game-changing skills: How to Use AI, How to Use Money, and How to Use People (the right way — like teamwork, leadership, and communication!). We're operated by FinHub, an Australian company. Our job is to help you level up in life — and part of that means keeping your personal information safe, private, and protected. This Privacy Policy explains: • What information we collect • Why we collect it • How we protect it • What rights you (and your parents) have This policy complies with the Australian Privacy Act 1988 (including the Australian Privacy Principles), the U.S. Children's Online Privacy Protection Act (COPPA), and other applicable privacy laws. By using LockedIn, you and your parent or guardian agree to this policy. If you're under 18, a parent or guardian must review this policy and consent to your use of the platform.

We only collect what we need to make LockedIn work for you. Nothing extra. No sneaky stuff. Account Info (when you sign up): • Email address — So we can create your account and send important updates • Display name — The name other learners see (you choose this!) • Login method — Whether you signed up with Google, Facebook, or email Learning Data (as you use LockedIn): • Learning progress — Which lessons you've completed • XP (Experience Points) — Your points as you level up 🥋 • Belt rank — From 🤍 White Belt to ⚫ Black Belt • Journal entries — Things you write in your learning journal Technical Data (collected automatically): • Device type — Phone, tablet, or computer • Browser type — Chrome, Safari, Firefox, etc. • General location — Country-level only (NOT your exact location) • Usage data — How you navigate the app What we DON'T collect: ❌ Your real full name (unless you choose to use it) ❌ Your home address ❌ Your phone number ❌ Photos or videos of you ❌ Your school name ❌ Financial info directly from kids

Your data is used to help YOU learn and grow. That's it. 1. Run Your Account — Create and manage your profile, let you log in securely 2. Power Your Learning — Track lessons, calculate XP and belt promotions, save journal entries, personalise your learning path 3. Make LockedIn Better — Understand usage patterns, fix bugs, develop new features 4. Keep You Safe — Detect misuse, enforce Community Guidelines, protect all members 5. Communicate With You — Account updates, password resets, milestones 🎉 What we NEVER do with your data: ❌ Sell it — Your data is NEVER sold. Ever. ❌ Use it for ads — No targeted advertising ❌ Share it with marketers — No third-party marketing companies ❌ Use it to manipulate you — No dark patterns, no tricks

🟢 Only You Can See: • Your journal entries (private by default) • Your email address • Your login details 🟡 Other Learners May See: • Your display name • Your belt rank • Your XP level • Content you share in community features 🔵 LockedIn Team Can See: • Account info (for support) • Learning progress (to improve the platform) • Technical data (to fix bugs) 🟣 Parents/Guardians Can: • View account information • See learning progress • Request a copy of all data • Request deletion of account and data Third-Party Services We Use: • Supabase — Secure data storage and authentication • Vercel — Website hosting • Google & Facebook — Only if you choose social login We NEVER share your data with advertisers, data brokers, or other companies for marketing.

What are cookies? Cookies are tiny text files that help LockedIn remember who you are so you don't have to log in every time. Essential Cookies (Required) ✅ • Keep you logged in and make the platform work • Don't track you around the internet Analytics Cookies (Helping Us Improve) 📊 • General usage stats (not personally identifying) • Help us understand which features are popular What we do NOT use: ❌ Advertising or tracking cookies ❌ Third-party marketing cookies ❌ Cookies that follow you to other websites You or your parent can control cookies through browser settings. Turning off essential cookies may affect functionality.

Your data, your rights. Here's what you can do: 📂 See Your Data — Request a summary of what we hold about you at any time. 📥 Download Your Data — Request a copy in readable format. We'll provide it within 30 days. 🗑️ Delete Your Data — Request deletion of your account and all associated data. This is permanent and cannot be undone. Processed within 30 days. ✏️ Correct Your Data — Update display name and email in settings, or contact us for other corrections. 🚫 Opt Out — Opt out of non-essential communications at any time. How to make a request: Email daniel@finhub.net.au with subject "Privacy Request." Under Australian Privacy Law, you have the right to access your information, request corrections, and complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

Hey parents and guardians! This section is especially for you. 👋 Parental Consent: • LockedIn is designed for children aged 10 and above • By allowing your child to create an account, you consent to this policy • We encourage active participation in your child's learning journey Your Parental Rights: ✅ Review your child's personal information ✅ Request a copy of all data we hold ✅ Request deletion of your child's account ✅ Refuse further collection (may require account closure) ✅ Contact us at any time COPPA Compliance (U.S. Families): • We don't collect more info than necessary • We don't condition participation on excess disclosure • Parents can review, delete, and control collection • We don't share children's info for marketing Social Login Note: If your child uses Google or Facebook login, we only receive email and basic profile name. We NEVER access contacts, friend lists, photos, or other social data. To exercise any parental right, email daniel@finhub.net.au with subject "Parent Privacy Request."

🔐 Encryption • HTTPS/TLS for all data in transit • Encryption at rest in our database • Passwords are securely hashed 🏗️ Secure Infrastructure • Supabase — enterprise-grade database with built-in security • Vercel — DDoS protection and secure hosting • Row Level Security (RLS) — users can only access their own data 🔑 Authentication Security • Secure login via Google, Facebook, or email/password • Secure, expiring session tokens • No plain-text password storage 👥 Access Controls • Only authorised team members can access personal data • Access limited to what's necessary • Regular access reviews 🚨 Breach Response If a breach occurs, we will investigate immediately, notify affected users and parents, notify the OAIC if required, and take steps to contain and remediate.

When we make changes: • We update the "Last Updated" date • For significant changes, we notify via email or in-app announcement • We give reasonable notice before major changes Significant changes include collecting new types of info, using data in new ways, sharing with new third parties, or changes to your rights. Continuing to use LockedIn after changes means you accept the updated policy.

LockedIn Privacy Team 📧 Email: daniel@finhub.net.au 🌐 Website: lockedin.mobi Operated by: FinHub (Australian Business) For parents: Use subject "Parent Privacy Request" and include your child's display name or account email. We aim to respond within 14 days. Not happy with our response? Lodge a complaint with the Office of the Australian Information Commissioner (OAIC): 🌐 oaic.gov.au 📞 1300 363 992 📧 enquiries@oaic.gov.au This Privacy Policy was last updated on April 22, 2026. LockedIn is operated by FinHub, an Australian company. We are committed to protecting the privacy of all our users, especially our younger learners. 🚀