Privacy Policy

Last updated: 28 May 2026

1. Who we are

KubeQuest is operated by Or Carmeli, a sole proprietor based in Israel ("we", "us"). For privacy questions or to exercise your rights described in this policy, email contact@kubequest.online.

2. What this policy covers

This policy explains what personal data we collect when you use kubequest.online, why we collect it, how we use it, who we share it with, how long we keep it, and what rights you have. It applies to all users worldwide.

3. What data we collect

3.1 Account data (when you sign up)

Email address
Username (you choose; may be derived from your email if not set)
Hashed password (never the plaintext)
Legal consent records (the version of these documents you accepted and when)

3.2 Usage data (when you use the service)

Quiz answers and scores
War Room incident attempts and best scores
Achievements, streaks, settings, language preference
Feature waitlist signups (e.g. Architecture Scenarios)
Bug reports and feedback you submit

3.3 Payment data (if you subscribe)

We do not store your credit-card details. Payment information is collected and processed directly by Paddle. We receive only metadata from Paddle (your subscription status, billing period, customer ID, transaction event timestamps).

3.4 Technical data (collected automatically)

Anonymous analytics events tied to a session ID, not to your user account
Server access logs (IP address, user agent, request path) via our hosting provider
Error reports including stack traces and minimal context (no passwords, no payment data) sent to Sentry

4. Why we use your data

Purpose	Legal basis (GDPR)
Provide the service (account, scores, progress)	Performance of a contract
Process subscription payments and tax compliance	Performance of a contract, legal obligation
Send service-related emails (verification, security, billing)	Performance of a contract
Investigate abuse, enforce these terms	Legitimate interest in platform integrity
Improve content and fix bugs	Legitimate interest in product quality
Comply with legal requests (court orders, etc.)	Legal obligation

We do not sell your personal data and we do not use it for cross-context behavioral advertising.

5. Who we share data with

Processor	What they receive	Where
Supabase	Account data, usage data, auth tokens	Database hosting (EU + US regions)
Vercel	Server logs (may include IP), static asset requests	Frontend + edge hosting (global)
Sentry	Error reports, performance metrics (no personal account data)	Error monitoring (US)
Paddle	Email, billing details, transaction history (only if you subscribe)	Payment processing (UK + EU + US)
Resend	Email address and message body for transactional emails	Email delivery

Each of the above is a contractually bound data processor and is permitted to use your data only for the specified purpose. We do not share your data with advertising networks or data brokers.

6. International data transfers

Some of the processors above are located outside the European Economic Area or your country of residence. Where required, we rely on Standard Contractual Clauses or other recognized transfer mechanisms to protect your data when it crosses borders.

7. How long we keep data

Account data: until you delete your account, then deleted within 30 days.
Usage data tied to your account: same as account data.
Anonymous analytics events: up to 12 months, then automatically purged. These cannot be re-linked to you.
Payment records: retained by Paddle and by us for the period required by applicable tax law (typically 7 years).
Error logs (Sentry): 90 days by default.
Server access logs: per our hosting provider's retention policy.

8. Your rights

Depending on where you live, you have some or all of the following rights:

Access a copy of the personal data we hold about you
Rectify inaccurate data
Delete your data ("right to be forgotten")
Object to or restrict certain processing
Portability - receive your data in a portable format
Withdraw consent where processing is based on consent
Complain to a data-protection authority (in Israel: the Privacy Protection Authority; in the EU: your national DPA)

To exercise any of these rights, email contact@kubequest.online. We respond within 30 days. We may ask you to verify your identity (typically by replying from the email address on the account) before actioning the request.

9. Cookies and similar technologies

We use a small number of cookies and similar technologies that are strictly necessary to run the service:

Session cookie for authenticated state (Supabase)
Local storage for user preferences (language, dark mode, draft progress)
Anonymous analytics session ID

We do not use third-party advertising cookies or cross-site tracking pixels.

10. Children

The service is not directed at children under 13. We do not knowingly collect personal data from anyone under 13. If we learn that we have collected such data, we will delete it. If you believe a child under 13 has provided us with personal data, please contact us.

11. Security

We protect your data with industry-standard measures: encrypted transport (TLS 1.2+), encrypted storage at our database provider, role-based access controls, signed webhooks, and regular dependency audits. No system is perfectly secure; if you discover a vulnerability, please report it to contact@kubequest.online.

12. Changes to this policy

We may update this policy from time to time. Material changes will be announced via email and via a notice on the site at least 14 days before they take effect.

13. Contact

For any privacy question, contact contact@kubequest.online.

KubeQuest is operated by Or Carmeli, Israel.