Cubic Consulting LLC · Colorado, United States
Privacy Policy
Effective September 5, 2026
1. Who handles your information
Cubic Consulting LLC, based in Colorado, United States, operates Question23 and is responsible for the personal information described in this policy. Contact justin@question23.com with privacy questions or requests. This policy covers our website, research workspace, parent view, and related support and communications. It does not govern independent websites you visit through a link.
2. Information we collect
Account information: your name, email, account identifiers, preferences, time zone, parent connections, and records of agreement to our policies. Authentication uses one-time links and session credentials. We record policy versions, acceptance times, and the account-eligibility confirmations you provide, rather than requiring your full date of birth.
Research information you provide or generate: topic ideas, saved papers and links, dataset descriptions and files, notes, mentor messages, conversation summaries used for context, daybook entries, experiments, code, execution logs and outputs, manuscript drafts and revisions, reviews, schedules, commitments, and postponement explanations. Files or text may contain personal information if you include it. Avoid uploading personal information about other people or sensitive records.
Purchase and support information: plan and subscription status, customer and transaction identifiers, payment period, cancellation and usage records, checkout invitations, support correspondence, and feedback. Our payment processor collects payment-card details; Question23 does not store full card numbers or security codes.
Technical and usage information: pages and features used, clicks and signup or checkout events, timestamps, session or account identifiers, referral information, and diagnostic or security logs. Our servers and providers may process IP addresses, browser and device information, request metadata, and delivery information. We do not need precise location or your device's contacts to provide the workspace.
3. Why we use it
We use information to create and protect accounts; save and retrieve your work; provide contextual mentor responses, analysis, and code features; track usage allowances; process subscriptions; provide authorized parent progress; deliver sign-in links and relevant reminders; answer support requests; diagnose failures; understand feature use; prevent abuse; comply with law; and establish or defend legal claims. Research content is used to provide your research features, not to publish your work as marketing.
Where a law requires a legal basis, we rely as applicable on performing a contract or taking requested steps before it, our legitimate interests in operating and securing the service, legal obligations, and consent where required. We do not treat agreement to this policy as blanket permission for unrelated uses of your information. If we seek a materially different use requiring consent, we will ask separately.
4. Providers and disclosures
We share the information needed for a service with providers that help us deliver it. These include Amazon Web Services for hosting, databases, object storage, and compute; OpenAI for mentor responses, generated code, and analysis; Stripe for payments; and email delivery providers, including Pair and Google services used for communications. Providers can process information under their agreements with us and may retain limited records for security, legal, and operational purposes.
When you request a mentor response or analysis, relevant messages, notes, dataset context, manuscript text, files, or file excerpts can be sent to the model provider. We try to select relevant context, but you should not upload a file on the assumption that no part of it will leave our hosting provider. OpenAI's API data is not used for training by default unless an organization opts in; provider retention and endpoint behavior vary. This is not a promise of zero retention. We do not authorize use of your private research to train general-purpose models as part of providing Question23.
Authorized personnel may access information when necessary to operate, secure, troubleshoot, or support the service. We may disclose relevant information when legally required, to address fraud or a credible safety or security threat, to protect rights, or in connection with a merger, financing, reorganization, or transfer of the business subject to appropriate protections. We may also disclose information at your direction. We do not sell personal information or share it for cross-context behavioral advertising, and we do not use private research content for targeted advertising.
5. Parents and private work
A connected parent can see selected progress markers, meeting schedules, commitments, due dates, completion status, and postponement reasons. Treat explanations you enter in those fields as information that may be visible in the parent view. Connecting a parent does not give the parent unrestricted access to private mentor conversations, research files, or drafts through that view. Statutory rights or a legal process may require us to handle a specific request differently.
A student-to-parent checkout link shares the information needed to identify and purchase the requested plan. It does not grant research access. Share invitation and checkout links only with the intended person. Contact us if a connection is unauthorized or you need help disconnecting it. We may verify identity and authority before handling requests involving another person's account.
7. Retention and deletion
Keep an independent copy of work you want to retain. The Terms of Service explain the research-data deletion deadline at the end of a paid subscription and the absence of any promised recovery period. Actual removal from live systems, backups, and providers may happen at different times; temporary retention is not a promise of continued access or restoration.
We retain information only for the purposes described in this policy and as needed for the service, legal obligations, security, fraud prevention, billing, disputes, and enforcing agreements. Retention depends on the kind of record, account and subscription status, operational needs, provider schedules, and legal requirements. Account and agreement records may outlast research content. De-identified information that cannot reasonably identify you may be retained for aggregate analysis.
You can request deletion by contacting us. We will verify the request as appropriate and explain any applicable exception. Limited records may need to remain for tax, transaction, security, dispute, or legal-hold purposes. Backup and provider copies can remain until their applicable retention cycles end and should not be used as active research storage. We do not promise that canceling a subscription instantly erases every record from every system.
8. Your choices and privacy requests
You can request access, correction, deletion, or a portable copy of your personal information by emailing justin@question23.com. Use the account email if possible and tell us what you want to change or obtain. We may need proportionate information to verify identity or an authorized agent's permission. Do not email passwords, full card numbers, or identity documents unless we have arranged a secure, necessary verification method. We will respond within applicable legal deadlines.
Depending on where you live and which laws apply, you may also have rights to restrict or object to processing, withdraw consent for processing based on consent, opt out of sale, targeted advertising, or certain significant-decision profiling, or appeal a denied request. We do not use mentor guidance to make legally binding or similarly significant eligibility decisions about you. To appeal a privacy decision, reply with "Privacy appeal" and explain your concern; we will review it and explain the outcome. You may complain to your state attorney general, the Colorado Attorney General, or another relevant privacy regulator. We will not unlawfully discriminate against you for exercising your rights.
Withdrawing consent does not invalidate prior lawful processing. Some information is necessary to provide an account or a requested feature, so deletion or restrictions may mean that feature can no longer work. This policy does not claim that every jurisdiction-specific privacy law applies to Question23, and it does not restrict rights that do apply.
9. Young researchers
Question23 is for people at least 13, not children under 13. A researcher below the age of majority must have a parent or legal guardian's permission and agreement as described in the Terms. We do not knowingly collect personal information from children under 13. If you believe someone under 13 has provided personal information, contact justin@question23.com so we can investigate and remove it as required.
A signup confirmation is not an identity check or a claim of verified parental consent under children's privacy laws. We do not sell minors' information, target advertising using their private research, or require unrelated marketing to use the service. Parents with a privacy concern may contact us; we will consider the researcher's rights and verify appropriate authority before disclosing information.
10. Security and international processing
We use measures designed to protect information, including encrypted connections, account access controls, restricted file access, and limits on code execution. No internet service is completely secure. Protect your email, avoid sharing sign-in links, and report suspected unauthorized access promptly. If a security incident requires notice, we will provide it as required by applicable law.
Question23 operates from the United States and information may be processed in the United States and other locations where our providers operate. Privacy laws may differ from those in your location. Where legally required for an international transfer, appropriate safeguards must apply; using the service does not waive those requirements.
11. Policy updates and contact
We will update the effective date when this policy changes and give additional notice of material changes through email or the service where required. Where a new use requires consent, we will request it before that use. Earlier acceptance records are retained so we can identify the policy version presented at signup.
Contact Cubic Consulting LLC, Colorado, United States, at justin@question23.com. Put "Privacy request" in the subject to help us route your message.