Cookie Policy
Effective date: August 25, 2026 · Companion to our Privacy Policy
This page explains what QuantegyAI stores in your browser, why, and how to change it. It is written to be read, not to be survived: if anything here is unclear, email support@quantegyai.com and we will explain it.
The short version. Almost everything we store is on your own device and serves you directly — keeping you signed in and remembering your practice progress. We set very few actual cookies. We do not use advertising or marketing-analytics technologies unless you accept them, and we never send your exam answers, scores, or mastery estimates to any advertising or analytics company.
1. Cookies, and the more accurate word for what we mostly use
"Cookies" is the usual shorthand, but most of what QuantegyAI keeps in your browser is not a cookie. It is local storage — a store your browser gives each website, which never travels with your requests the way a cookie does and is not visible to other sites. We use it because a practice session holds a lot of state (which questions you have seen, your per-skill mastery estimates, your streak) and cookies are the wrong tool for that.
This policy covers all of it: cookies, local and session storage, the offline cache, and the one place we use a browser database. Where the law says "cookies and similar technologies", it means this whole list.
2. The three categories, and your three choices
Everything below falls into one of three groups:
- Strictly necessary. The Services cannot work without these. They keep you signed in, protect the sign-in form from automated attacks, remember your learning progress, and record your cookie choice itself. These are set without asking, which is what data-protection law permits for this category — and only for this category.
- Analytics. Counts page views and shows us which pages people find useful. Never receives your answers or scores.
- Advertising. Measures which advertisement brought someone here, and lets the advertising platforms show our adverts to people who have visited before.
The last two are off until you turn them on, and you can answer them separately. The banner offers:
- Accept — analytics and advertising both on.
- Essential Only — both off; only the strictly necessary group remains.
- Manage preferences — choose each one individually. Accepting analytics while refusing advertising is a real setting, not a rounding of one into the other: the advertising technologies genuinely do not load.
Declining costs you nothing. Every feature of the product behaves identically either way — you are not shown a worse product, a smaller free tier, or more prompts for saying no.
3. Cookies we set
Two, and only if you reach us through your school's learning-management system (Canvas or similar). If you use QuantegyAI through the website, we currently set no cookies of our own at all.
| Name | Category | What it does | Lifetime |
|---|---|---|---|
lti_oidc |
Strictly necessary | Holds the one-time security values that prove an LMS launch request is genuine while the handshake completes. | 5 minutes |
lti_session |
Strictly necessary | Keeps you signed in for the rest of your session after your LMS hands you over to us. | 24 hours |
Both are first-party, HttpOnly and Secure, meaning no script can read them and they are only ever sent over an encrypted connection.
4. Cookies other companies set
Two services we rely on set their own cookies on their own domains. We do not control them and cannot read them.
| Service | Category | When it appears | Why |
|---|---|---|---|
| Cloudflare Turnstile challenges.cloudflare.com |
Strictly necessary | On the sign-in and sign-up forms. | Distinguishes real people from automated scripts, so that stolen-password attacks cannot be run against our accounts at scale. It is a privacy-preserving alternative to a CAPTCHA and is not used for advertising. |
| Stripe checkout.stripe.com |
Strictly necessary | Only after you click to buy and are taken to Stripe's payment page. | Completes the payment and detects card fraud. These cookies are set on Stripe's own checkout page, not on quantegyai.com. Your card details are entered on Stripe's page and never reach us. |
5. What we keep in your browser's storage
This is the bulk of it, and it is all first-party: it stays on your device, and it is what makes the product work offline and remember where you left off. We have grouped it by purpose rather than listing several hundred individual keys, which would obscure rather than inform. Every key is visible to you in your browser's developer tools, and you can clear all of it at any time (Section 10).
| Group | Category | What it holds | How long |
|---|---|---|---|
| Sign-in session | Strictly necessary | Your access and refresh tokens, issued by our authentication provider. This is what keeps you signed in between visits. | Until you sign out or the token expires. |
| Learning progress and adaptive state | Strictly necessary | Which questions you have been shown and how you answered, per-skill mastery estimates, spaced-repetition schedules, mock-exam history, bookmarks, your own written notes, and your saved study plan. For signed-in users this is also synced to your account so it follows you between devices. | Until you clear it or delete your account. |
| Progress towards a purchase | Strictly necessary | How many free questions you have left, which plan you selected, and the identifier of a checkout you started, so that returning from Stripe applies the right entitlement. | Session, or until the purchase completes. |
| Preferences | Strictly necessary | Your chosen exam and exam date, sound and voice settings, accessibility options, which tips and prompts you have dismissed, and whether you installed the app. | Until you change or clear them. |
| Motivation features | Strictly necessary | Experience points, streaks, achievements, and league standing. Your display name is stored here so leaderboards can show it. | Until you clear it or delete your account. |
| Your cookie choice | Strictly necessary | Whether you accepted or declined analytics and advertising, and when. We keep this so we do not ask you again on every page. It deliberately survives signing out, so your choice is not silently reset. | Until you change it or clear your browser storage. |
Two things worth calling out
Voice recordings in one activity. One pronunciation activity lets you record your own voice and play it back. Those audio clips are stored in a browser database (IndexedDB) on your device only. They are never uploaded to us or to anyone else. Clearing site data removes them.
The offline cache. We register a service worker that caches pages, fonts, images and study materials so the app keeps working on a poor connection. It caches published course content only. It is explicitly prevented from caching any response from our account or session endpoints, so personal data is not left behind in the cache after you sign out.
6. Analytics
In use today: we use Umami to count page views on our public marketing pages and understand which pages people find useful. Umami is a privacy-focused analytics service: it sets no cookies and stores nothing in your browser. It does not follow you to other websites and does not build a profile of you.
It is a third-party service, so your page view and browser type do reach Umami's servers. We therefore treat it as requiring your consent, and it does not load until you accept. It is never used inside the signed-in learning application.
We use Google Tag Manager to load Google Analytics (GA4). These record pages visited, time on site, device and browser type, and whether a visitor went on to start a free diagnostic. Like Umami, they load only after you accept analytics cookies. Cookie names and durations will be added to this page as soon as they're confirmed live.
We also use Google Search Console, which tells us how our pages appear in Google Search. It sets no cookies on your device and is not part of the consent choice.
7. Advertising
QuantegyAI runs paid advertising campaigns to reach teachers and students preparing for certification exams. If you accept advertising cookies, the platforms we advertise on may set cookies or similar identifiers that let us see which advertisement brought you to the site and whether you went on to start a diagnostic or buy a pass, and let those platforms show our advertisements to people who have visited us.
The platforms we use are Google Ads and Meta (including the Meta Pixel), deployed through Google Tag Manager, for advertising measurement and retargeting. They appear on our subprocessor list; institutional customers receive at least thirty days' advance notice of a new subprocessor.
8. Email
We use Mailchimp to send marketing email to people who have given us their address for that purpose. Mailchimp embeds small tracking images and tagged links in those messages, which tell us whether an email was opened and whether a link was clicked. We use that to judge whether our emails are worth sending and to stop sending to people who never open them.
This applies to marketing email only. Transactional messages — account verification, password resets, purchase receipts, security notices — are sent through a separate system and are not tracked this way. Every marketing email carries an unsubscribe link, and unsubscribing stops both the messages and the tracking.
Where the address comes from. One source is the free diagnostic's results screen: a separate, unticked-by-default checkbox lets you opt in to send your name and email to Mailchimp, along with which exam you're preparing for, your timeframe, and first-attempt/retake answer. We also attach which advertisement or link brought you to the site, the page you first landed on, whether you were on mobile or desktop, and your sign-up date, so we can tell which campaigns reach people who want to hear from us — never your answers, score, or diagnostic results. We may use this, inside Mailchimp's own tools, to build lookalike or similar-audience segments for future campaigns — we do not upload it to Google Customer Match or Meta Custom Audiences. Declining still unlocks your results. See Privacy Policy §2.1 for the full description.
The limits we hold ourselves to, whatever you consent to:
- We never send an advertising platform your exam responses, scores, mastery estimates, or diagnostic results. Advertising measurement sees only which page was viewed and whether a purchase happened.
- We do not run advertising technologies inside the signed-in learning application, with one narrow exception: the start of checkout and a completed purchase are reported so we can measure whether advertising is working, carrying only a plan name, exam, amount, and order reference — never anything about what you studied or how you performed.
- We do not run them at all where students reach us through an institutional or school cohort.
- We do not run behavioural advertising to anyone we know to be under eighteen, and we do not let advertising platforms build profiles from their activity — regardless of any consent recorded on that device.
9. If you decline
Nothing changes about the product. You get the same free diagnostic, the same questions, the same explanations, the same guarantees, and the same price. We will not re-prompt you on every visit, and we do not treat declining as a reason to give you a worse experience. The only difference is that we learn less about which of our advertisements worked.
10. Changing your mind, at any time
- Our controls. Use the Cookie settings link in the footer of any page. It opens the same per-category panel, already showing what you chose last time — so you can see your current answer before changing it, and withdraw by unticking a box and saving. You can do this as often as you like, and no account is required.
- Global Privacy Control. If your browser or an extension sends a GPC signal, we honour it as a valid opt-out from targeted advertising and from any "sale" or "share" as those terms are defined in United States state privacy laws. You do not need to do anything else.
- Your browser. Every major browser lets you block or delete cookies and clear site data for a specific site. Clearing our site data also clears your saved progress on that device — if you are signed in, it will restore from your account the next time you sign in; if you are not, it is gone.
- The advertising platforms themselves. You can also opt out at the industry level through the Digital Advertising Alliance or the European Interactive Digital Advertising Alliance.
11. Changes to this policy
When we add or remove a technology described here, we update this page and the effective date at the top. If a change materially affects your rights — for example, adding a new category of tracking — we will ask for your consent again rather than relying on a choice you made about something else.
12. Contact
Questions, or a request to exercise any privacy right: support@quantegyai.com or 903-705-9703 (Mon–Fri, 9 am–6 pm CT). Our full Privacy Policy describes every other way we handle your information.