Last updated: August 21, 2026
See also our Terms of Use, which govern your use of KinFAST.
KinFAST is operated by Joshua Nederveen, in connection with a McMaster University Kinesiology course. KinFAST is not an official service of McMaster University.
We collect the information you give us directly when you create an account: your username, email address, and password. Your password is stored only as a one way hash, not as readable text, so we can never see or recover your actual password.
Some accounts are created by an instructor instead, who generates a PIN and password for you rather than you signing up yourself. We do not collect an email address for these accounts, and password recovery isn't available for them.
When you use KinFAST, we automatically record your activity on the platform: your ability estimates on each topic and subtopic, your test session timestamps, and your answers to individual questions, including which option you chose, whether it was correct, and how long you took. We also temporarily record IP addresses for login and password reset attempts, as an anti-abuse measure, described further under Security below.
We use this information to run the adaptive testing algorithm itself, choosing which question to show you next based on your current ability estimate, and to let instructors see how their class is doing.
Your test history, ability estimates, and individual question responses are associated with the courses you are enrolled in.
Instructors and teaching assistants can view and export performance data, including individual response history, for students enrolled in their own course. They cannot see data from courses they are not enrolled in or do not manage.
We share information with third-party service providers only as needed to operate KinFAST. Email is sent through Gmail's SMTP service. Instructors may optionally use Google's Gemini API to get AI-assisted suggestions for topic and subtopic names. We do not sell your information, and we do not share it with anyone else or use it for advertising.
We use your email address to send you an account verification code when you sign up, and, if requested, a password reset email containing your username and a temporary password, sent only to your own registered address. We may also use your email address to communicate with you about KinFAST, including changes to these policies.
The optional AI-assisted topic and subtopic naming feature only ever sends course, topic, and subtopic names to Google's Gemini API. It never sends student data. If an instructor supplies their own Gemini API key to use this feature, that key is used only for that request and is never stored by KinFAST.
We use only the cookies required to keep you logged in and to protect against cross site request forgery. We do not use advertising or tracking cookies, and we do not use analytics services.
We keep your information for as long as your account exists. If you delete your account, see Account deletion below for how long that data is kept before it is permanently removed. We do not have an automated process for deleting accounts that are simply dormant but have not been deleted.
Passwords are hashed, not stored as readable text. Login and password reset attempts are rate limited by IP address to reduce abuse. These rate limit counters are temporary, expiring automatically within about an hour, and are not kept as a permanent log.
You can delete your account at any time from your account menu. Doing so deactivates your account immediately, and you will not be able to log in normally. For 30 days after that, your account and data are kept, and logging back in during this time automatically reactivates your account. After 30 days, your account and all associated data are permanently deleted and cannot be recovered.
To request a copy of the information we hold about you, or to correct inaccurate information, email us at the address below.
KinFAST is intended for use by university students, instructors, and staff, and is not directed at children.
Our service providers, Gmail and Google's Gemini API, may process information outside of Canada. We only share the limited information described above with them, for the purposes described above.
If you have a question or concern about how we handle your information, email us at the address below.
If this policy changes, we will notify all users by email and update the date at the top.
kinfastmcmaster@gmail.com