Children's Privacy Notice

Authntech Inc. runs Kuest, an AI tutor. Many of our users are students, and some are under 13. This notice explains how we collect, use and share personal information from children under 13, as required by the Children's Online Privacy Protection Act (COPPA). It adds to our Privacy Policy, which applies to everyone.

Operator contact: Authntech Inc., 1007 N Orange St., 4th Floor, Ste 1382, Wilmington, DE 19801, USA. Email: support@kuestai.com.

During setup, every user tells us their age. If a child says they are under 13, the account becomes limited: the child can finish setup but cannot use the tutor or any other feature. There are two ways a parent or guardian can give consent:

• By email: the child enters a parent or guardian's email address. We email the parent a notice that explains what we collect from their child, how we use and share it and the parent's choices, with a link to our Privacy Policy and a secure, signed link that expires after 7 days. On the consent page, the parent confirms they are the child's parent or legal guardian and chooses to approve or decline. We send a confirmation email when a parent approves.
• From a parent's account: a parent who is signed in to their own Kuest account can set up Kuest for their child. Doing so is the parent's consent.

The child cannot use their own email address as the parent's. A child can send at most 3 consent emails in 24 hours. We use the parent's email address only to ask for and confirm consent and to contact the parent about it.

If a parent does not approve within 30 days, or declines, we delete the child's account and its information. While the account still exists, a parent who declined can change their mind before the link expires, or the child can send a new request.

Before a parent consents, we collect only what is needed to create the account and ask for consent: the child's email address and name (or the details from Google or Apple if the child signs in that way), the answers from setup such as age, grade, school type and country, and the parent's email address.

After a parent consents, we also collect:

• what the child types, says or uploads to the tutor, such as questions, homework photos and documents;
• the lessons, quizzes, flashcards, notes, images, podcasts and other materials they create, and their answers and scores;
• how they say they feel before studying, if they use the mood check-in (for example calm or stressed), to adapt their sessions;
• study time, streaks, points and progress;
• short learning facts the tutor saves, such as an upcoming test or a topic they find hard. We block contact details and names from these;
• technical data needed to keep the account signed in and secure, such as IP address and browser type, and error reports;
• fraud-prevention signals: keyed hashes of a device cookie, a browser fingerprint and the IP address, the country from the IP address, and the browser's user agent. These are used only to keep the Service secure and prevent fraud, never for advertising, profiling or analytics, as COPPA allows for supporting the internal operations of the Service. The record of each check is deleted after 180 days; the hashed device ID linked to the account is kept until the account is deleted.

Voice: if the child uses voice features or records a lecture, their speech is processed to understand them and is not stored as audio. A text transcript is kept only if the conversation is saved to a chat, or as the note made from a lecture recording.

We do not ask a child for more information than they need to use a feature. We use a browser fingerprint only for the security and fraud-prevention purposes described above.

• to tutor the child and adapt lessons to their age, level and curriculum;
• to run and secure the account;
• to show a linked parent summaries of the child's learning;
• to fix problems and keep the Service safe.

We do not show ads to children and do not use their information for behavioral advertising. We do not send the activity of users under 13 to our product analytics. The student app does not load advertising or social media trackers.

We do not sell children's information, and we do not make it public. Children under 13 cannot create public share links, and leaderboards never show a child's name.

We share children's information only with service providers that help us run Kuest, under contracts that limit their use of it to providing their service to us. They are: Vercel (hosting, file storage, the AI Gateway and the sandbox that runs code), Neon (our database), OpenAI and Google (the AI models that generate the tutor's answers, images, speech and transcriptions), Exa (web search queries), Resend (emails to the parent), Upstash (rate limiting), Sentry (error reports), Langfuse (technical details of AI requests, never their content) and push notification services if notifications are turned on; and Stripe, Apple, Google and RevenueCat if a parent buys a plan. The AI providers receive the content of the child's questions and learning context such as age and grade. We do not send them the child's name or email address. These disclosures are part of providing the tutor. We do not disclose children's information to advertising platforms or analytics providers. The full list of providers is in our Privacy Policy.

We may also disclose information if the law requires it or to protect a child's safety.

At any time, you can:

• review the personal information we have collected from your child;
• ask us to delete it;
• refuse further collection or use of your child's information, by withdrawing consent;
• agree to our collection and use of your child's information without agreeing to its disclosure to third parties, except where disclosure is part of providing the service.

To review your child's information or make any of these requests, email support@kuestai.com. We will verify that you are the child's parent or guardian before we act.

You can also act yourself from the consent link we emailed you. There you can withdraw consent, which locks the account right away and deletes it after 30 days, or delete the account and all its information immediately. Deletion removes the account, chats with the tutor, lessons, exam preps, uploads and progress, and cannot be undone.

If you link your own parent account to your child, you can see summaries such as study time, streaks, subjects and upcoming exams, turn the weekly email on or off, and require the tutor to teach step by step. Linked parents do not see the child's chats.

We keep a child's information only to tutor the child and run their account, for as long as the account is active and a parent's consent is in place. Chats, notes and other learning content stay until the child or parent deletes them or the account. We delete the account and its information when the parent or child deletes the account, and 30 days after consent is declined, withdrawn or never given; this includes the parent's email address if consent is never given. If a child's account has no activity for 12 months (no sign-in and no use of Kuest), we delete the account and its information; we email the parent who gave consent 30 days before, and signing in before that date keeps the account. Fraud-prevention check records are deleted after 180 days. Service providers' logs and backups are deleted on their own schedules.

We protect children's information with encryption in transit, private file storage, signed and expiring consent links, and limited staff access.

Students aged 13 to 17 do not go through the email consent process, but they must confirm that a parent or guardian knows they use Kuest and agrees to our Terms. Everything else in our Privacy Policy applies, including no ads and no selling or sharing of data.

If we make a material change to how we collect, use or share children's information, we will notify parents and ask for new consent before the change applies to their child.

Questions about your child's information: support@kuestai.com, or write to Authntech Inc., 1007 N Orange St., 4th Floor, Ste 1382, Wilmington, DE 19801, USA.