Cookie Policy

Cookies are small text files a website stores in your browser. Similar technologies, such as local storage, work in a similar way. This policy covers both and explains what Authntech Inc. uses on kuestai.com and app.kuestai.com.

These are needed for Kuest to work. They cannot be switched off in the app.

• Sign-in session (better-auth.session_token): keeps you signed in. Lasts up to 60 days, or until you sign out.
• Last sign-in method (better-auth.last_used_login_method): remembers whether you last used an email code, Google or Apple, so we can suggest it next time. Lasts 30 days.
• Google sign-in (g_state): set by Google when the Google One Tap sign-in prompt is shown, to remember whether you closed it.
• Referral (kuest_ref): when you open a friend's invite link, remembers the invite code until you sign up, so both of you get the bonus. Lasts 30 days.
• Payments (Stripe cookies such as __stripe_mid and __stripe_sid): set by Stripe during checkout to process payments and prevent fraud.
• Device (kuest_device): a first-party cookie set by the app with a random ID for this browser, so we can link accounts created or used on the same device and stop abuse and fraud. Strictly necessary for security. Lasts 400 days.
• Browser fingerprint (kuest_fp): a first-party cookie set by the app that holds the browser fingerprint visitor ID computed on your device by the open-source FingerprintJS library, so our server can hash it. Used only for security and fraud prevention. Strictly necessary. Lasts 180 days.
• Security: our hosting provider may set cookies to protect the site from attacks and abuse.

• Language (kuest_locale): remembers the language you chose on our website or in the app. Shared by kuestai.com and app.kuestai.com. Lasts 1 year.
• Cookie choice (kuest_consent): remembers whether you accepted or rejected analytics, and when, so we don't ask on every visit. Shared by kuestai.com and app.kuestai.com. Lasts 6 months, then we ask again.
• Time zone (kuest_tz): remembers your time zone so dates, reminders and the nightly credit refill match your clock. Lasts 1 year.
• Sidebar (sidebar_state): remembers whether you keep the app's side menu open. Lasts 7 days.
• Website question (kuest_handoff): keeps a question you asked on our website so the app can answer it after you sign up. Deleted once used, and lasts at most 1 day.
• Campaign (kuest_attr): remembers which link, campaign, creator code or website brought you to Kuest, so we can credit creators and partners. It describes the link, not you. Lasts 90 days.
• Local storage: remembers settings on this device, such as your light or dark theme, dismissed notices, and a random ID that lets a guest resume a challenge quiz after refreshing the page.

• PostHog (cookies and local storage starting with ph_): measures how people use Kuest so we can improve it, using a random ID. In your browser it stores nothing and sends nothing until you accept analytics. In the student app, it also stays off for accounts under 13, and for children whose parent has not yet consented, whatever the cookie choice. Our servers also record some account events, such as finishing setup or starting a plan, in PostHog under your user ID, for users 13 and over.
• Google Analytics (cookies starting with _ga): helps us understand visits to kuestai.com and how people use the student app. On kuestai.com it runs from your first page, also after you reject cookies or your browser sends Global Privacy Control; its advertising features stay off unless you allow marketing. In the student app it loads only after you accept analytics, for accounts 13 and over, never for a child. For anyone under 18, and everywhere in our iOS and Android apps, Google's advertising features stay turned off.
• Sentry: helps us find and fix errors. It does not record replays of your session.
• Vercel Speed Insights: measures page speed without cookies.

We never use advertising or social media tracking cookies for anyone under 18, and never in our iOS and Android apps.

• Ad measurement tags (Google Tag Manager, the Meta Pixel and the TikTok pixel): only after you accept marketing cookies, on our website at kuestai.com and, for accounts 18 and over, in the student app in a web browser. They tell the ad platforms we advertise on which pages were visited, so we can measure our ads. They can set their own cookies, such as Meta's _fbp or TikTok's _ttp. They never load for anyone under 18 or in our iOS and Android apps, which do not track you across other companies' apps and websites.
• Ad click IDs (kuest_click): when you arrive from an ad, keeps the click ID the ad platform added to the link (Google, Meta or TikTok). Only stored if you accept marketing cookies. Lasts 30 days.

If you are 18 or older and accepted marketing cookies, we tell the ad platform that sent you when you sign up or buy, with a hashed version of your email address, so we can measure our ads. We never do this for anyone under 18, and we never sell information collected through cookies. Our Privacy Policy explains this in section 6.

• Cookie banner: on your first visit you choose Accept or Reject, or open Choose to decide on analytics and marketing separately. Rejecting is as easy as accepting, and Kuest works the same either way.
• Change your mind: use "Cookie settings" at the bottom of any page. Withdrawing stops analytics and marketing at once and clears PostHog's identifiers from your browser. On kuestai.com, Google Analytics keeps counting visits, with its ad features off.
• Global Privacy Control: if your browser sends this signal, we treat it as a no to analytics and marketing and don't show the banner. On kuestai.com, Google Analytics still counts visits, with its ad features off.
• Browser settings: you can also block or delete cookies and local storage in your browser. If you block essential cookies, you will not be able to sign in.

Questions about cookies or your choice? Email support@kuestai.com and we will help.

If we add or change cookies, we will update this page and its effective date.

Questions about cookies: support@kuestai.com, or write to Authntech Inc., 1007 N Orange St., 4th Floor, Ste 1382, Wilmington, DE 19801, USA.