Legal

Oyster Privacy Policy

Last Updated: June 30, 2026

Introduction

Oyster is designed to support the mathematical and educational needs of 5th-grade children through a gamified space-adventure theme, offering a personalized learning experience on the devices our users prefer.

This Privacy Policy is intended to provide clear information about how we collect, use, disclose, retain, and protect information relating to Oyster users. We are committed to treating personal information, particularly information relating to children, with the highest level of care, security, and respect.

This Privacy Policy applies to information collected through the Oyster mobile application, Oyster websites, and related products, services, features, and support channels collectively referred to as the “Oyster Services.”

By using the Oyster Services, or by permitting a child to use the Oyster Services, you acknowledge the practices described in this Privacy Policy.

1. Information We Collect

We seek to collect only the information reasonably necessary to operate Oyster, provide educational functionality, maintain security, process purchases, communicate with parents and users, and improve the learning experience.

Depending on how Oyster is used, we may collect the following categories of information.

1.1 Parent, Guardian, Teacher, or Account Information

When an account is created or managed, we may collect information such as:

  • First and last name;
  • Email address;
  • Country or general region of residence;
  • Username or account identifier;
  • Password or authentication credentials;
  • Parent, guardian, teacher, or school relationship to the child;
  • Communication and notification preferences; and
  • Information submitted when contacting Oyster Support.

We encourage parents and guardians to create or supervise accounts intended for children.

1.2 Child Profile Information

To provide an age-appropriate and personalized learning experience, we may collect limited information about a child, such as:

  • First name, nickname, or display name;
  • Grade level;
  • Age or age range;
  • Preferred language;
  • Learning preferences;
  • Mathematics skill level;
  • Accessibility preferences; and
  • Parent-, guardian-, teacher-, or school-selected learning settings.

We do not require children to provide more personal information than is reasonably necessary to participate in Oyster’s educational activities.

1.3 Learning, Mathematics, and Gameplay Information

Oyster may collect information generated when a user interacts with educational activities and the space-adventure game environment, including:

  • Mathematics questions presented to the user;
  • Answers submitted by the user;
  • Correct and incorrect responses;
  • Scores, points, rewards, badges, and achievements;
  • Hints requested or used;
  • Number of attempts;
  • Learning progress and completion status;
  • Skill areas practiced;
  • Difficulty levels;
  • Missions, levels, planets, or activities completed;
  • Time spent in the application or on a specific activity;
  • Session frequency;
  • Navigation patterns;
  • Buttons, features, and educational content used;
  • Learning streaks and progress history; and
  • Personalized recommendations generated from learning activity.

This information helps Oyster adapt educational content, monitor progress, identify areas in which a learner may need additional practice, and improve the quality of the learning experience.

1.4 Device, Usage, and Technical Information

When the Oyster Services are accessed, certain technical information may be collected automatically, including:

  • Device type and model;
  • Operating system and version;
  • Application version;
  • Device language;
  • Browser type;
  • Internet Protocol address;
  • General location derived from an Internet Protocol address;
  • Device or application identifiers;
  • Date and time of access;
  • Session duration;
  • Application performance information;
  • Crash reports;
  • Diagnostic information;
  • Security logs; and
  • Information about how users interact with the Oyster Services.

Oyster does not collect precise geolocation information unless a specific feature requires it, the collection is clearly explained, and the required permission or consent has been obtained.

1.5 Purchase and Subscription Information

Some Oyster Services may be available through a paid subscription or in-app purchase.

Purchases made through the Apple App Store, Google Play Store, or another application marketplace are generally processed by the relevant marketplace or payment provider. Oyster may receive limited transaction information, such as:

  • Subscription type;
  • Purchased product;
  • Transaction identifier;
  • Purchase date;
  • Subscription status;
  • Renewal status; and
  • Payment confirmation.

Oyster generally does not receive or store complete payment-card details when a purchase is processed by an application marketplace or third-party payment provider.

1.6 Communications and Support Information

When a parent, guardian, teacher, school representative, or other user contacts us, we may collect:

  • Name and contact information;
  • The content of the communication;
  • Support request details;
  • Screenshots or files voluntarily provided;
  • Device and application information relevant to the issue; and
  • Our responses and resolution records.

1.7 Push Notification Information

When push notifications are enabled, Oyster may collect or use:

  • A device notification token;
  • Notification preferences;
  • Whether a notification was delivered or opened; and
  • Interactions with a notification.

Push notifications may be disabled through the device settings at any time.

1.8 Website, Cookie, and Similar Technology Information

Our websites may use cookies, software development kits, local storage, pixels, or similar technologies to:

  • Maintain sessions;
  • Remember preferences;
  • Protect account security;
  • Understand website performance;
  • Diagnose technical problems; and
  • Measure general use of the Oyster Services.

Where required by law, we obtain consent before using non-essential cookies or similar technologies.

2. How We Collect Information

We may collect information:

  • Directly from parents, guardians, teachers, schools, and users;
  • When an account or child profile is created;
  • When educational activities or games are completed;
  • When a subscription or purchase is made;
  • When users contact Oyster Support;
  • Automatically through the application, website, device, and related technologies;
  • From application marketplaces and payment providers;
  • From schools or educational institutions using Oyster;
  • From authentication providers selected by the user; and
  • From service providers acting on our behalf.

Information collected directly through Oyster is governed by this Privacy Policy. Information independently collected by an application store, payment provider, device manufacturer, school, or third-party platform is governed by that organization’s own privacy policy.

3. How We Use Information

We may use information for the following purposes.

3.1 Providing and Operating Oyster

We use information to:

  • Create and maintain accounts;
  • Provide mathematics lessons and educational activities;
  • Operate the gamified space-adventure environment;
  • Save learning progress;
  • Display achievements and rewards;
  • Authenticate users;
  • Synchronize progress across supported devices;
  • Process subscriptions; and
  • Provide requested features and services.

3.2 Personalizing the Learning Experience

We may use learning and gameplay information to:

  • Adjust question difficulty;
  • Recommend appropriate mathematics activities;
  • Identify skills that may require additional practice;
  • Present personalized missions or exercises;
  • Adapt content to a learner’s progress;
  • Maintain learning continuity; and
  • Provide progress information to an authorized parent, guardian, teacher, or school.

Automated systems may assist in selecting appropriate educational content. Oyster does not use automated decision-making to make legal or similarly significant decisions about children.

3.3 Communicating with Users and Parents

We may use contact information to:

  • Send account-related notices;
  • Respond to support requests;
  • Provide security alerts;
  • Communicate changes to the Oyster Services;
  • Notify users of updates to this Privacy Policy;
  • Provide subscription or transaction information; and
  • Send optional product communications where permitted and consented to.

3.4 Safety, Security, and Fraud Prevention

We may use information to:

  • Protect accounts;
  • Prevent unauthorized access;
  • Detect fraud, misuse, or security incidents;
  • Investigate technical or security problems;
  • Enforce our policies;
  • Protect children and other users; and
  • Comply with legal requirements.

3.5 Analysis and Service Improvement

We may use information to:

  • Understand how Oyster is used;
  • Evaluate the effectiveness of educational content;
  • Correct errors and application crashes;
  • Improve usability, accessibility, and performance;
  • Develop new educational features;
  • Conduct internal research; and
  • Produce aggregated or anonymized statistics.

Where reasonably possible, information used for analytics and research is aggregated, anonymized, or otherwise processed to reduce privacy risks.

3.6 Legal Compliance

We may process information when reasonably necessary to:

  • Comply with applicable laws and regulations;
  • Respond to valid legal requests;
  • Establish, exercise, or defend legal claims;
  • Maintain required business and financial records; and
  • Protect the rights, safety, and property of users, children, Bulvar.co Limited, and others.

4. Legal Bases for Processing

Where the UK General Data Protection Regulation, European General Data Protection Regulation, or similar data protection laws apply, we process personal information under one or more of the following legal bases:

  • Performance of a contract: When processing is necessary to provide the Oyster Services requested by the user.
  • Consent: When a parent, guardian, or other authorized person has provided consent, including parental authorization where required.
  • Legitimate interests: When processing is necessary for legitimate operational, educational, security, or service-improvement purposes and those interests are not overridden by the rights and interests of the individual.
  • Legal obligation: When processing is necessary to comply with applicable law.
  • Protection of vital interests: In limited circumstances where processing is necessary to protect a person’s safety or vital interests.

When processing children’s information, we consider the best interests, rights, developmental needs, and reasonable expectations of the child.

Consent may be withdrawn at any time. Withdrawal does not affect processing lawfully completed before consent was withdrawn.

5. Children’s Privacy

Oyster is designed for children, including users who may be under the age of 13. We recognize that children’s personal information requires enhanced protection.

We apply privacy safeguards intended to comply with applicable children’s privacy laws, including the U.S. Children’s Online Privacy Protection Act and relevant UK and European data protection requirements.

5.1 Parental Notice and Consent

Where required by law, Oyster will:

  • Provide parents or guardians with notice of our information practices;
  • Obtain verifiable parental consent before collecting, using, or disclosing personal information from a child;
  • Obtain parental authorization when consent is used as the legal basis for a child below the applicable age of digital consent;
  • Limit collection to information reasonably necessary for the educational activity;
  • Allow parents to review information collected from their children;
  • Allow parents to request correction or deletion;
  • Allow parents to refuse further collection or use; and
  • Delete information if the required parental consent is not received or is withdrawn.

The method used to obtain parental consent may depend on the information involved, the feature being used, legal requirements, and the level of privacy risk.

5.2 Registration by Children

When a child attempts to register, Oyster may request limited information necessary to:

  • Determine whether parental involvement is required;
  • Contact a parent or guardian;
  • Obtain consent;
  • Create a child profile; and
  • Provide access to educational activities.

A child may be prevented from using certain features until the required parent, guardian, teacher, or school authorization has been completed.

If you believe that a child has provided personal information without the required consent, contact us at support@getoyster.app.

5.3 School and Teacher Use

Schools, teachers, or educational institutions may use Oyster in an educational setting.

Where permitted by applicable law, a school may provide authorization for the collection and use of a child’s information when:

  • Oyster is used solely for an educational purpose;
  • The information is used for the benefit of the school and learner;
  • The information is not used for unrelated commercial purposes; and
  • The school is authorized to act on behalf of the parent or guardian.

Schools and teachers are responsible for providing required notices and obtaining any necessary parental permissions before providing children’s personal information to Oyster.

Parents may contact their child’s school or Oyster to ask how information is managed in a school-based account.

5.4 Information Collected from Children

Depending on the features used and the consent provided, we may collect limited child-related information such as:

  • First name, nickname, or display name;
  • Age range or grade;
  • Mathematics answers and scores;
  • Learning progress;
  • Gameplay history;
  • Achievements;
  • Application usage information; and
  • Device and technical information.

We do not knowingly collect sensitive personal information from children unless it is necessary for a clearly explained feature, legally permitted, and subject to the required authorization.

5.5 No Sale or Targeted Advertising to Children

Oyster does not sell children’s personal information.

Oyster does not use children’s personal information for behavioral or targeted advertising based on activity across unrelated websites or applications.

We do not require a child to disclose more personal information than is reasonably necessary to participate in an educational activity.

5.6 Parental Rights and Controls

A parent or legal guardian may request to:

  • Review personal information collected from their child;
  • Correct inaccurate information;
  • Delete the child’s personal information;
  • Withdraw consent;
  • Stop further collection or use;
  • Close the child’s account; or
  • Ask for information about the service providers with whom the child’s information has been shared.

Requests may be sent to support@getoyster.app.

We may take reasonable steps to verify the identity and authority of the person submitting the request before providing access to or deleting a child’s information.

Deleting required account or learning information may result in loss of progress, termination of the account, or loss of access to certain Oyster features.

6. Sharing Information with Third Parties

We do not disclose personal information to third parties except as described in this Privacy Policy.

6.1 Service Providers

We may share information with trusted service providers that perform services on our behalf, such as:

  • Cloud hosting;
  • Database storage;
  • Authentication;
  • Application analytics;
  • Crash reporting;
  • Security monitoring;
  • Customer support;
  • Email and notification delivery;
  • Subscription management;
  • Payment processing; and
  • Application distribution.

Service providers are permitted to process information only for contracted purposes, subject to confidentiality, security, and data protection obligations.

We seek to use service providers appropriate for services directed to children and limit the information provided to them.

6.2 Application Stores and Payment Providers

Information may be shared with or received from Apple, Google, payment processors, or other application marketplaces when necessary to:

  • Complete purchases;
  • Validate subscriptions;
  • Process refunds;
  • Prevent fraud; and
  • Manage subscription status.

These providers may independently process information under their own privacy policies.

6.3 Parents, Guardians, Teachers, and Schools

Learning progress and account information may be made available to an authorized:

  • Parent;
  • Legal guardian;
  • Teacher;
  • School administrator; or
  • Educational institution.

Access is limited to information reasonably necessary to manage the learner’s account and educational progress.

6.4 Legal and Safety Disclosures

We may disclose information when we reasonably believe disclosure is necessary to:

  • Comply with applicable law;
  • Respond to a valid subpoena, court order, or lawful government request;
  • Investigate fraud, misuse, or security incidents;
  • Protect the safety of a child or another person;
  • Protect the rights and property of Bulvar.co Limited;
  • Enforce our agreements and policies; or
  • Establish, exercise, or defend legal claims.

Where legally permitted, we will seek to notify the affected user or parent before responding to a legal request.

6.5 Business Transactions

If Bulvar.co Limited is involved in a merger, acquisition, financing, restructuring, sale of assets, or similar transaction, information may be disclosed to advisers and potential transaction participants.

Any successor receiving personal information will be required to handle it consistently with applicable law and the commitments described in this Privacy Policy.

6.6 With Consent

We may disclose personal information for another purpose when the parent, guardian, account holder, or other authorized person has provided informed consent.

7. Aggregated and Anonymized Information

We may combine or transform information so that it no longer reasonably identifies an individual user.

Aggregated or anonymized information may be used to:

  • Evaluate learning outcomes;
  • Understand general application usage;
  • Improve educational content;
  • Conduct internal research;
  • Prepare statistical reports; and
  • Support product development.

We take reasonable measures intended to prevent anonymized information from being used to re-identify an individual.

8. User and Parent Controls

Depending on the account type and applicable law, authorized users may be able to:

  • Access account information;
  • Update or correct account details;
  • Manage a child profile;
  • Review learning progress;
  • Change notification preferences;
  • Cancel a subscription;
  • Download certain information;
  • Delete an account;
  • Withdraw consent; and
  • Request restrictions on processing.

Some controls may be available directly in the application. Other requests may be submitted to support@getoyster.app.

When an account is deleted, certain information may be retained where required for legal, accounting, fraud-prevention, dispute-resolution, or security purposes.

9. Data Protection Rights

Depending on location and applicable law, individuals may have the right to:

  • Request access to their personal information;
  • Request correction of inaccurate or incomplete information;
  • Request deletion;
  • Request restriction of processing;
  • Object to certain processing;
  • Withdraw consent;
  • Request data portability;
  • Ask for information about recipients of personal information;
  • Lodge a complaint with a competent data protection authority; and
  • Appeal certain decisions relating to a privacy request.

These rights may be subject to legal limitations and exceptions.

Parents and guardians may exercise applicable rights on behalf of their children. We may request information necessary to verify identity, parental responsibility, account ownership, or authority to act.

Privacy requests may be submitted to support@getoyster.app.

Individuals in the United Kingdom may also have the right to submit a complaint to the UK Information Commissioner’s Office. Individuals in the European Economic Area may contact the data protection authority responsible for their country or region.

10. Data Security

We use reasonable technical, administrative, and organizational safeguards intended to protect personal information against:

  • Unauthorized access;
  • Loss;
  • Theft;
  • Misuse;
  • Alteration;
  • Accidental disclosure; and
  • Destruction.

These safeguards may include, where appropriate:

  • Encryption in transit;
  • Encryption at rest;
  • Access controls;
  • Authentication measures;
  • Restricted employee and contractor access;
  • Security monitoring;
  • Logging;
  • Backup procedures;
  • Vulnerability management;
  • Service-provider assessments; and
  • Incident-response procedures.

Access to children’s personal information is limited to individuals and service providers that reasonably require access to perform authorized duties.

No method of electronic transmission or storage is completely secure. Therefore, while we work to protect personal information, we cannot guarantee absolute security.

Parents and users should protect their passwords, devices, and account credentials and should notify us promptly if they suspect unauthorized account access.

11. Data Retention

We retain personal information only for as long as reasonably necessary to:

  • Provide the Oyster Services;
  • Maintain an active account;
  • Preserve learning progress;
  • Fulfil the purposes described in this Privacy Policy;
  • Comply with legal and accounting obligations;
  • Resolve disputes;
  • Prevent fraud;
  • Enforce agreements; and
  • Protect users and the Oyster Services.

Retention periods depend on the type of information, the account status, the purpose of processing, legal requirements, and whether continued retention creates a privacy risk.

Children’s personal information will not be retained longer than reasonably necessary for the purpose for which it was collected.

When information is no longer required, we will take reasonable steps to delete, anonymize, or securely isolate it, subject to legal requirements and technical limitations relating to backups.

Following an account deletion request, some information may remain temporarily in secure backup systems before being overwritten or deleted through standard retention processes.

12. International Data Transfers

Bulvar.co Limited is established in the United Kingdom. Oyster’s service providers may operate in the United Kingdom, European Economic Area, United States, or other countries.

As a result, personal information may be transferred to, stored in, or processed in a country outside the user’s country of residence.

Where international data transfer laws apply, we use appropriate transfer mechanisms and safeguards, which may include:

  • An adequacy regulation or adequacy decision;
  • European Commission Standard Contractual Clauses;
  • The United Kingdom International Data Transfer Agreement;
  • The United Kingdom Addendum to the European Commission Standard Contractual Clauses;
  • Contractual, organizational, and technical safeguards;
  • A legally permitted exception; or
  • Explicit consent where appropriate and permitted.

We also assess transfer risks and implement supplementary safeguards when reasonably necessary.

Regardless of where information is processed, we seek to protect it consistently with this Privacy Policy and applicable data protection law.

13. Purchases and Subscriptions

Some Oyster features may be free, while other features may require a subscription or one-time purchase.

Before a purchase is completed, the applicable application store or payment provider will display the price, billing period, renewal terms, and cancellation conditions.

Subscriptions may automatically renew unless canceled through the relevant application store or payment-provider account settings before the renewal date.

Purchases, cancellations, and refunds made through an application store are generally governed by that store’s applicable terms and procedures.

Questions concerning an Oyster subscription may be sent to support@getoyster.app. We may need transaction information, but users should not send complete payment-card details by email.

14. Third-Party Links and Services

The Oyster Services may include links to third-party websites, application stores, or services.

Bulvar.co Limited does not control the independent privacy practices of those third parties. This Privacy Policy does not apply to information collected directly by an unrelated third party.

Parents and users should review the privacy policies and terms of any third-party service before providing information or allowing a child to access it.

Where Oyster integrates a third-party service, we seek to select services appropriate for the relevant educational and child-directed context.

15. Changes to This Privacy Policy

We may update this Privacy Policy to reflect:

  • Changes to Oyster’s features;
  • Changes in data-processing practices;
  • New technologies;
  • Security improvements;
  • Regulatory requirements; or
  • Other operational or legal developments.

The updated policy will display a revised “Last Updated” date.

If a change materially affects how personal information is collected, used, or disclosed, we will provide additional notice where appropriate. Where required by law, we will obtain new consent before applying the change to information previously collected.

Parents and users are encouraged to review this Privacy Policy periodically.

16. Contact Information

Questions, comments, complaints, parental requests, and data-protection requests may be submitted using the following contact details:

Data Controller
BULVAR.CO LIMITED
61 Bridge Street
Kington, HR5 3DJ
United Kingdom

Product: Oyster
Email: support@getoyster.app

When contacting us about a child’s account, please do not include unnecessary sensitive information. We may request limited information to verify identity, parental responsibility, account ownership, or authorization before completing a request.

17. Definitions

Account Holder: The parent, guardian, teacher, school representative, or other authorized person who creates or manages an Oyster account.

Aggregated Information: Information combined across multiple users or activities that does not reasonably identify an individual.

Anonymous or Anonymized Information: Information processed so that an individual is no longer reasonably identifiable.

Application: The Oyster mobile application and any related program, website, platform, or service operated by or on behalf of Bulvar.co Limited.

Child or Children: A person who has not reached the age at which they may independently consent to the relevant processing of personal information under applicable law.

Data Controller: The organization that determines why and how personal information is processed. For the Oyster Services, the data controller is BULVAR.CO LIMITED unless otherwise stated.

Data Processor or Service Provider: An organization that processes personal information on behalf of and under the instructions of a data controller.

Learning Information: Information generated through mathematics questions, answers, activities, progress, scores, achievements, recommendations, and related educational interactions.

Parent: A parent, legal guardian, or other person legally authorized to act on behalf of a child.

Personal Information: Information that identifies, relates to, describes, or can reasonably be linked to an identifiable individual.

Oyster Services: The Oyster application, websites, educational activities, support services, subscriptions, and related features operated by or on behalf of Bulvar.co Limited.

Processing: Any operation performed on personal information, including collection, storage, organization, use, analysis, disclosure, transfer, deletion, or anonymization.