Privacy Policy

1. Overview

Knowledge Quest Studio ("KQS," "we," "us," or "our") operates three browser-based educational tools: KQ Studio (a SCORM content editor), KQ Live (a live quiz platform), and KQ Board (a collaborative bulletin board). This Privacy Policy describes how we collect, use, and protect information across all three tools at knowledgequeststudio.com and associated subdomains.

By using any of the Services you agree to the practices described here. If you do not agree, please discontinue use.

2. Who We Are

Knowledge Quest Studio is an independent educational technology project created and operated by Dr. Mary Lebens. For privacy inquiries contact:

• Email: mary@marylebens.com
• Subject line: "Privacy Inquiry"

3. Information We Collect

3a. Information You Provide (Teacher Accounts)

When you create a teacher account in KQ Live or KQ Board, we collect:

• Name and email address
• Password (stored as a one-way bcrypt hash - we cannot recover it)
• Quiz content, board content, and uploaded images you create

3b. Information Students Provide (Quiz Participants)

Students joining a KQ Live quiz session provide only a display name of their choosing. We do not require or collect student email addresses, passwords, or any other personally identifying information from quiz participants.

• Display name (student-chosen, may be a nickname)
• Quiz answers and response times (for session scoring only)

3c. Information We Collect Automatically

When you use the Services, our servers automatically log:

• IP address (used for rate limiting and security; not stored long-term)
• Browser type and operating system (standard web server logs)
• Pages visited and time of access
• Referring URL

We do not run analytics trackers or sell advertising. Standard server logs are the only automatic collection.

3d. Images

Images you upload to KQ Live or KQ Board are stored with Cloudinary (see Section 8). Do not upload images containing student faces or other student personally identifiable information.

3e. KQ Studio (SCORM Editor)

KQ Studio is a browser-based tool. SCORM packages are assembled in your browser and downloaded to your computer. We do not store your KQ Studio course content on our servers. Any content tracking (completion, scores) is handled entirely by your institution's Learning Management System (LMS), not by us.

4. How We Use Information

We use the information we collect to:

• Provide, operate, and improve the Services
• Authenticate teacher accounts and maintain session security
• Run live quiz sessions and display scores to participants
• Send password-reset emails when requested
• Detect abuse and enforce our Acceptable Use Policy
• Respond to support requests

We do not use student quiz data for advertising, profiling, or any purpose other than operating the live session in which the student participates.

Marketing Communications

We may occasionally send product update emails to teacher account holders. Every such email includes an unsubscribe link. We will not send marketing emails to student participants (we do not collect their email addresses).

5. Student Data & FERPA

Knowledge Quest Studio is designed as a teacher-facing tool. We understand that teachers may use KQ Live and KQ Board in contexts governed by the Family Educational Rights and Privacy Act (FERPA), 20 U.S.C. § 1232g.

What this means in practice:

• Teachers control what content is created and what quiz sessions are run
• We do not collect student names linked to institutional identifiers, grades, or other education records
• Quiz session display names and scores are transient and are not shared with third parties for any purpose
• Teachers who require FERPA compliance should ensure that students use pseudonymous display names during quiz sessions

If your institution has specific FERPA data processing agreement requirements, please contact us at mary@marylebens.com before use.

6. Children & COPPA

The Children's Online Privacy Protection Act (COPPA), 15 U.S.C. §§ 6501-6506, restricts online collection of personal information from children under 13. Knowledge Quest Studio's teacher account registration is intended for adults (educators). We do not knowingly collect personal information from children under 13.

• Students under 13 may participate in live quiz sessions using only a self-chosen display name
• No account registration or email address is required for student participation
• Teachers are responsible for obtaining any parental consent required by their institution or applicable law before using these tools with students under 13

If we learn that a child under 13 has created a teacher account, we will promptly delete that account and its associated data. To report such an account, email mary@marylebens.com.

7. Sharing Information

We do not sell, rent, or trade your personal information. We share information only in these limited circumstances:

Service Providers

We use a small number of third-party services to operate the platform (see Section 8). These providers access only the data necessary to provide their specific service and are not permitted to use it for other purposes.

Legal Requirements

We may disclose information if required by law, court order, or governmental authority, or when we believe in good faith that disclosure is necessary to protect our rights, protect your safety or the safety of others, or investigate fraud.

Business Transfers

If Knowledge Quest Studio is ever transferred to another operator, user information may be part of that transfer. We will provide notice before any such transfer and will require the new operator to honor this Privacy Policy or notify users of any material changes.

With Your Consent

We may share information for any other purpose with your explicit consent.

8. Third-Party Services

We use the following third-party services. Each has its own privacy policy:

Cloudinary

Images uploaded in KQ Live and KQ Board are stored on Cloudinary's content delivery network. Cloudinary may store and cache images on servers in multiple geographic locations. Do not upload images containing student personally identifiable information. See Cloudinary's Privacy Policy.

Hosting & Infrastructure

The Services are hosted on cloud infrastructure. Server logs are retained for a limited period for security and debugging purposes.

Email (Password Reset)

Transactional emails (password resets) are sent via SMTP. Email addresses used for resets are not shared with third parties for marketing.

Learning Management Systems (KQ Studio)

SCORM packages exported from KQ Studio are deployed in your institution's LMS (such as D2L Brightspace). Any data collected by your LMS - completion, scores, time-on-task - is governed by your institution's privacy policies, not ours. We have no access to LMS tracking data.

Music (KQ Live)

KQ Live may link to royalty-free music tracks from Jamendo or CCMixter. Accessing those links is subject to those platforms' privacy policies.

9. Cookies & Local Storage

Authentication Tokens

When a teacher logs in, an authentication token is stored in your browser's localStorage (if "Remember me" is selected) or sessionStorage (for the current session only). This token is used to authenticate API requests. It is not a tracking cookie.

Recent Image Cache

KQ Live and KQ Board store recently uploaded image URLs in localStorage for convenience. This data stays in your browser and is not transmitted to us.

No Advertising or Analytics Cookies

We do not use advertising networks, cross-site tracking pixels, or third-party analytics cookies (such as Google Analytics). We do not track you across other websites.

Browser Storage Controls

You can clear localStorage and sessionStorage at any time through your browser settings. Doing so will log you out of teacher accounts.

10. Security

We take reasonable technical and organizational measures to protect information against unauthorized access, alteration, disclosure, or destruction. These include:

• Passwords stored using bcrypt (one-way hashing; we cannot see your password)
• HTTPS encryption for all data in transit
• JWT authentication with token versioning (password changes immediately invalidate all sessions)
• Rate limiting on authentication endpoints
• HTTP security headers (via Helmet)
• Input validation and parameterized database queries to prevent injection attacks

If you discover a security vulnerability, please report it responsibly to mary@marylebens.com before public disclosure.

11. Your Rights

As a teacher account holder, you have the following rights:

Access & Correction

You can view and update your name and email address at any time through the Account Settings page in KQ Live or KQ Board.

Data Deletion

You may request deletion of your teacher account and all associated data by emailing mary@marylebens.com. We will process deletion requests within 30 days. Note that quiz session logs (which contain only pseudonymous display names and scores) may be retained in anonymized form for service improvement.

Data Portability

You may request a copy of your account data (quiz decks, board content) by emailing us. We will provide it in a machine-readable format within 30 days.

Withdrawal of Consent

Where we process data based on consent, you may withdraw consent at any time without affecting the lawfulness of prior processing.

California Residents

If you are a California resident, you may have additional rights under the California Consumer Privacy Act (CCPA). We do not sell personal information. To exercise any CCPA rights, contact us at mary@marylebens.com.

12. Data Retention

We retain information for as long as necessary to provide the Services and fulfill the purposes described in this policy:

• Teacher account data - retained until you request deletion
• Quiz session data - retained for the life of the associated quiz deck, or until you delete it from your dashboard
• Board content - retained until you delete the board or your account
• Password reset tokens - expire after 1 hour and are automatically cleared
• Server logs - retained for up to 90 days for security purposes, then deleted
• Uploaded images - retained on Cloudinary until you delete them or your account is deleted

13. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will post the updated policy on this page and update the effective date at the top. For significant changes, we will also send a notice to registered teacher account email addresses at least 14 days before the changes take effect.

Your continued use of the Services after the effective date of any changes constitutes your acceptance of the updated policy.

14. Contact

For questions, concerns, or requests related to this Privacy Policy, please contact:

• Email: mary@marylebens.com
• Subject line: "Privacy Inquiry"

We aim to respond to all privacy-related inquiries within 5 business days.

These Services and this Privacy Policy are governed by the laws of the State of Minnesota, without regard to its conflict-of-law provisions. See our Terms of Service for full legal terms.