Privacy Policy

Authntech Inc. ("Kuest", "we", "us") runs Kuest, an AI tutor for students at kuestai.com, app.kuestai.com and in our apps for iOS and Android. This policy explains how we handle personal information when you use our website, apps and emails (the "Service"). For children under 13, also read our Children's Privacy Notice. For cookies, read our Cookie Policy.

For people in the European Union, the European Economic Area and the United Kingdom, Authntech Inc. is the controller of your personal information. You can reach us at support@kuestai.com or 1007 N Orange St., 4th Floor, Ste 1382, Wilmington, DE 19801, USA.

Information you give us:

• Account details: your email address and name. If you sign in with Google or Apple, we receive your name, email address and, from Google, your profile photo.
• Setup answers: your role (student, parent, teacher or other), age, country and region, school type and grade or education level, school name if you add it, goals, what you find hard, interests, upcoming exam details, daily study goal and time zone. For adults: your profession and employment status, if you add them. For parents: your child's first name, age and, if you invite or buy for them, their email address.
• Parental consent: for a child under 13, the parent's email address and the consent decision.
• Learning content: what you type, say or upload to the tutor, including photos, PDFs and documents; the chats, lessons, quizzes, flashcards, podcasts, images, notes, mock exams, study plans and code you create; your answers and scores.
• Voice: when you use voice features, your speech is processed to understand you. We do not store the audio. If you save a voice conversation, we keep the text transcript in your chat.
• Lecture recordings: when you record a lecture, the audio is transcribed in short clips and not stored. We keep the transcript and the notes made from it.
• Mood check-ins: if you tell Kuest how you feel before studying (for example calm, low on energy or stressed), we save it to adapt your sessions and show it on your activity page.
• Tutor memories: short learning facts the tutor saves to personalize lessons, such as an exam date or a topic you find hard. We block contact details and names from these. You can see and delete them in Settings.
• Preferences: tutoring mode, reading and accessibility options, tutor voice, league participation and reminder settings.
• Support: messages you send to our support assistant or our team.
• Payments: your plan, subscription status and purchase history. Stripe collects your card or other payment details; we do not see your full card number. Stripe gives us a fingerprint of the card you pay with, which identifies the card without revealing its number. If you buy in our iOS or Android app, Apple or Google process the payment, and RevenueCat tells us your plan and purchase history; we do not receive your payment details.
• Legal acceptance: a record of when you accepted our Terms of Service and Privacy Policy, which version you accepted, and the country you were in.
• Cookie choices: a record of what you chose in the cookie banner, when, and the country you were in.

Information collected automatically:

• Sign-in and security data: session records with IP address and browser user agent, and the sign-in method you last used.
• Fraud-prevention signals: a keyed hash of a random device cookie, a keyed hash of a browser fingerprint, a keyed hash of your IP address, the country from your IP address, and your browser's user agent. Section 5 explains these.
• Usage data: study time, streaks, points, badges, progress and usage against your plan's allowance.
• Product analytics (users 13 and over only): pages viewed and actions taken in the Service, with device and browser information, linked to a random user ID, never your email or name.
• Diagnostics: error reports, performance data and server logs, which can include IP address, device and browser details.
• Push notification tokens, if you turn on notifications in your browser or in our app.
• Campaign information: which link, campaign, creator or website brought you to Kuest (the kuest_attr cookie), and, only if you allow marketing cookies, the click ID an ad platform added to the link (the kuest_click cookie). We save these on your account when you sign up.

We use a browser fingerprint only for security and fraud prevention, as described in section 5. We do not buy information about you from data brokers.

• To provide the tutor: answer your questions, adapt lessons to your age, level, country's curriculum and interests, and remember your progress.
• To run your account: sign you in, send sign-in codes, keep you secure, and apply your plan and usage limits.
• To process payments and manage subscriptions.
• To protect children: ask for a parent's consent for users under 13, and limit those accounts until a parent approves.
• To connect families and classes when both sides agree: parents see learning summaries of a linked child, and teachers see results of the work they assign.
• To send service emails, the reminders and push notifications you turn on, emails about Kuest features to users 13 and over, and marketing emails to adults. Every product or marketing email has an unsubscribe link. We do not send product or marketing emails to children under 13. Linked parents get a weekly summary email unless they turn it off.
• To measure our advertising: for adults who allow marketing cookies only, as described in section 6.
• To keep the Service safe: prevent abuse of free accounts and the referral program, prevent payment fraud and chargebacks, enforce our Terms, and respond to payment disputes.
• To fix problems and improve Kuest, including checking the quality of AI answers.
• To comply with the law.

We do not show ads in Kuest, we never use the information of anyone under 18 for advertising, and we do not use your information to make decisions that have legal or similarly significant effects on you.

Kuest uses AI models to generate answers, lessons, quizzes, images, speech and transcriptions. Your requests are sent through the Vercel AI Gateway to the model provider that handles that task, currently OpenAI and Google. For each request we send the content needed for the answer: your message and recent conversation, files you attached, and learning context such as your age, level, country, subject and saved tutor memories. We do not send your name or email address with these requests.

When the tutor searches the web to answer a question, the search query is sent to our search provider, Exa. Code you run in Kuest is executed in an isolated sandbox run by Vercel.

These providers act on our behalf and may use the data only to provide their service to us. We do not allow them to use your content to train their models. To check quality and cost, we record technical details of each AI request (the model, timing, token counts, cost and errors) in our AI monitoring tool, Langfuse, under a pseudonymous ID. We do not send Langfuse the content of your messages or of the AI's replies.

To keep Kuest fair and secure, we collect a small set of signals about the device and connection you use:

• a keyed hash of a random ID stored in a device cookie (kuest_device);
• a keyed hash of a browser fingerprint. The fingerprint is computed on your device by the open-source FingerprintJS library from characteristics of your browser and device, and kept in a cookie (kuest_fp) so our server can hash it;
• a keyed hash of your IP address, and the country your IP address is in;
• your browser's user agent;
• the fingerprint Stripe gives us for the card you pay with. It never includes the card number;
• records of your acceptance of our Terms of Service and Privacy Policy, with the time, the version and your country.

A keyed hash turns a value into a code that cannot be reversed without our secret key, so we can tell whether two accounts share a device or connection without storing the original value.

We use these signals only to stop abuse of the referral program and of multiple free accounts, to prevent payment fraud and chargebacks, to keep accounts secure, and to respond to payment disputes. The kuest_device and kuest_fp cookies are strictly necessary security cookies, as explained in our Cookie Policy.

For children and teens, these signals are used only for security and fraud prevention, never for advertising, profiling or analytics, consistent with the exception in the Children's Online Privacy Protection Act (COPPA) for supporting the internal operations of the Service.

If you dispute a payment, we share the information needed to respond with Stripe, our payment processor, and through Stripe with your card issuer: account and purchase details, your acceptance of our Terms, and sign-in and usage records. We never share the content of your chats.

The record of each check (hashed device cookie, hashed browser fingerprint, hashed IP address, IP country and user agent) is deleted after 180 days. The hashed device ID linked to your account, card fingerprints and acceptance records are kept while your account exists, and for as long as an open dispute or a legal obligation needs them. They are deleted with your account.

We never sell your personal information. We share it only:

• with service providers that help us run Kuest (listed below), under contracts that limit their use of the data;
• with people you choose: a linked parent sees learning summaries, never your chats; a teacher sees your first name, last initial and results on their assignments; anyone with a share link you create can see what you shared;
• with Stripe and your card issuer, only when we respond to a payment dispute, as described in section 5;
• with advertising platforms (Meta, Google and TikTok), only for adults 18 and over who allow marketing cookies: when someone who came from one of our ads or links signs up or pays, we send that platform the event, a hashed (SHA-256) version of the email address, and the click or browser ID the platform set, so we can measure our ads. The platforms may also use this information under their own terms. You can stop this at any time by turning off Marketing in Cookie settings, and we treat a Global Privacy Control signal as a no. Some US state laws may treat this as sharing for cross-context behavioral advertising or as targeted advertising;
• if the law requires it, or to protect the safety of a child or anyone else;
• as part of a merger, acquisition or sale of assets, in which case this policy continues to protect your information.

• Vercel — hosting, serverless computing, file storage, server logs, AI Gateway, the sandbox that runs code, and cookieless page-speed measurement — all Service data passes through it; uploads are kept in private storage, and images and audio generated for lessons are stored at unlisted links
• Neon — our database, hosted in the United States — account, setup, learning and billing records
• OpenAI — AI answers, image generation, voice conversations, speech, transcription and search embeddings — the content of your requests, files and speech
• Google — AI answers, voice conversations and speech for some features, and Sign in with Google if you choose it — the content of requests and speech; name, email and profile photo for sign-in
• Apple — Sign in with Apple, if you choose it — name and email (which may be a relay address)
• Exa — web search — search queries
• Stripe — payments, billing, the customer portal and payment disputes — email address, user ID, payment details, purchase history, and the dispute information described in section 5
• Apple App Store and Google Play — payments for purchases made in our iOS and Android apps — payment details and purchase history, which they collect under their own privacy policies
• RevenueCat — managing purchases made in our iOS and Android apps — user ID, plan and purchase history
• Resend — email delivery — email address and the content of our emails
• Upstash — rate limiting — user ID or IP address and request counts
• PostHog — product analytics, for users 13 and over only — random user ID, pages, actions, device and browser information
• Sentry — error and performance monitoring — error details and device and browser information; we do not use session replay
• Langfuse — AI quality and cost monitoring — a pseudonymous ID and technical details of AI requests (model, timing, token counts, cost, errors), never their content
• Browser push services (such as those run by Google, Apple and Mozilla), Expo and Firebase Cloud Messaging — delivering notifications you turned on in your browser or in our apps — push token and notification content
• Expo — delivering updates to our iOS and Android apps — device and app version information
• Meta, Google (Google Ads, Google Analytics and Google Tag Manager) and TikTok — measuring our advertising, only for adults who allow marketing cookies — the sign-up or purchase event, a hashed email address and ad click or browser IDs (section 6)
• PayPal and Wise — paying creators in our creator program (adults only) — the creator's payout email and payout amounts

Our marketing site at kuestai.com uses Google Analytics to understand visits, for every visitor, also after a no in the cookie banner, with Google's advertising features off unless you allow marketing, and Google Tag Manager to load ad measurement tags (Meta, TikTok, Google Ads) only if you allow marketing. The student app at app.kuestai.com uses Google Analytics only for accounts 13 and over that allow analytics, never for a child under 13. In a web browser it also loads Google Tag Manager and those ad measurement tags, but only for accounts 18 and over that allow marketing. Our iOS and Android apps never load Google Tag Manager or any ad tag, and do not track you across other companies' apps and websites.

• Account and learning data: while your account is open. Chats, notes and other learning content stay until you delete them or your account; we do not delete them on a fixed schedule. When you delete your account, we delete your chats, lessons, progress, memories, uploads, generated media and other account data right away. A few records we need for accounting, payment disputes and proof of consent are kept without your user ID.
• Payment records: Stripe's records of charges, and our log of billing events without your user ID, are kept as long as tax and accounting law requires.
• Children's accounts without consent: deleted 30 days after sign-up, a decline or a withdrawal of consent, unless a parent approves.
• Children's accounts with no activity: an account of a child under 13 with no sign-in or use for 12 months is deleted with its information. The parent who gave consent gets an email 30 days before, and signing in before then keeps the account.
• Fraud-prevention signals: the record of each check (hashed device cookie, hashed browser fingerprint, hashed IP address, IP country and user agent) is deleted after 180 days. The hashed device ID linked to your account, card fingerprints and records of accepting our Terms and Privacy Policy are kept while your account exists, and as long as an open dispute or a legal obligation needs them, then deleted with your account.
• Sign-in codes expire after 5 minutes. Sessions last up to 60 days unless you sign out.
• Service providers' logs, diagnostics and backups are kept for a limited time under their retention settings and then deleted.

• Delete your account in Settings. If you have an active subscription, cancel it first.
• Delete individual chats and tutor memories in the app.
• Turn off reminders, push notifications, leagues and the parent weekly email in the app, and product or marketing emails with the unsubscribe link in each email.
• Change your analytics and marketing cookie choices at any time with "Cookie settings" at the bottom of our website.
• End a parent or teacher connection at any time.
• Ask us for a copy of your data, a correction, or anything else by emailing support@kuestai.com.

Depending on where you live, including California, Colorado, Connecticut, Virginia, Texas, Oregon and other states with privacy laws, you may have the right to:

• know what personal information we collect, use and disclose, and get a copy of it;
• correct inaccurate information;
• delete your information;
• opt out of the sale of personal information, which we do not do;
• opt out of sharing for cross-context behavioral advertising and of targeted advertising: the only such use is the ad measurement for consenting adults in section 6, which you can turn off with "Cookie settings" or a Global Privacy Control signal;
• opt out of profiling that produces legal or similarly significant effects, which we do not do;
• not be treated differently for using your rights.

To make a request, email support@kuestai.com from the email address on your account. We will confirm your identity by checking that you control that address. An authorized agent can make a request for you with your signed permission. A parent or guardian can make requests for a child. If we deny your request, you can appeal by replying to our answer, and we will respond within the time the law requires.

In the last 12 months we collected these categories of personal information under the California Consumer Privacy Act, for the purposes described in section 3:

• Identifiers: name, email address, user ID, IP address, hashed device and browser identifiers used for fraud prevention, and, for adults who allow marketing cookies, a hashed email address and ad click IDs.
• Characteristics of protected classifications: age.
• Commercial information: plans, purchases, card fingerprints from Stripe, and records of accepting our Terms.
• Internet or other electronic network activity: pages viewed and actions in the Service, sign-in records, diagnostics.
• Audio information: speech in voice features, processed and not stored.
• Education information: grade, school, subjects, learning content, answers and progress. This is not from school records under FERPA unless a school directs our use.
• Inferences: learning facts saved as tutor memories, such as topics you find hard.
• Sensitive personal information: account sign-in details. We use it only to provide the Service and not to infer characteristics about you.

We disclose each category only to the service providers and people listed in sections 6 and 7, for business purposes. We do not sell personal information. For adults who allow marketing cookies, we disclose identifiers and commercial information (a hashed email address, ad click IDs and sign-up or purchase events) to advertising platforms, as described in section 6; this may be sharing under California law, and you can opt out with "Cookie settings" or a Global Privacy Control signal. We do not do this for anyone under 18, and we do not sell or share the personal information of consumers under 16. We keep each category for the periods in section 8.

If you are in the European Union, the European Economic Area or the United Kingdom, we rely on these legal bases:

• Contract: to provide the Service you asked for, run your account and process payments.
• Legitimate interests: to keep the Service secure, prevent abuse, fix problems and improve Kuest, including product analytics for users 13 and over. We balance these interests against your rights.
• Legitimate interests in preventing fraud and securing the Service (GDPR article 6(1)(f)): for the fraud-prevention signals in section 5. For records we use to answer a payment dispute, we also rely on establishing, exercising and defending legal claims.
• Consent: where the law requires it, such as a parent's consent for a child, push notifications, analytics and marketing cookies, and the ad measurement in section 6. You can withdraw consent at any time.
• Legal obligation: to keep tax and accounting records and to answer lawful requests.

You have the right to access, correct, delete, restrict or object to our use of your information, and to data portability. Email support@kuestai.com to use these rights. You can also complain to your local data protection authority.

In some EU countries, a child needs a parent's consent for online services up to age 16. If that applies where you live, a parent or guardian must agree before you use Kuest.

International transfers: our servers and most of our providers are in the United States. When we transfer personal information from the EU, EEA or UK, we rely on the EU-US Data Privacy Framework and its UK extension where the provider is certified, or on the European Commission's Standard Contractual Clauses and the UK Addendum.

Students and families can use Kuest on their own. When a school or teacher directs students to use Kuest, for example through a class assignment, we act for the school regarding the education records involved. We use that information only to provide the Service to the school and its students, do not use it for advertising, and handle requests about it as the school directs, consistent with the Family Educational Rights and Privacy Act (FERPA). Schools can contact support@kuestai.com.

Kuest is used by students of all ages. Children under 13 can use Kuest only with verifiable consent from a parent or guardian. Accounts under 13 are limited until a parent approves, and we do not send their activity to our product analytics. The fraud-prevention signals in section 5 are used for children only to keep the Service secure and prevent fraud, never for advertising, profiling or analytics. Our Children's Privacy Notice explains what we collect from children, how consent works, and how parents can review or delete their child's information.

For students 13 to 17, we keep the same protections that apply to everyone: no ads, no selling or sharing of data, and a parent or guardian's permission to use Kuest.

We protect your information with encryption in transit, private storage with short-lived access links for your uploads, passwordless sign-in, fraud-prevention checks on devices and payments, signed and expiring links for consent and family invitations, and access controls for our staff. No system is perfectly secure. If a breach affects your personal information, we will notify you and the authorities as the law requires.

We will post any update on this page with a new effective date. If a change is important, we will tell you in the app or by email before it takes effect, and ask you to accept the new version in the app before you continue. We will ask a parent for new consent before we change how we collect or use a child's information in a material way.

Privacy questions or requests: support@kuestai.com. Other questions: support@kuestai.com. Mail: Authntech Inc., 1007 N Orange St., 4th Floor, Ste 1382, Wilmington, DE 19801, USA.