Privacy Policy

Effective date: 24 October 2026

In short: IQora works on your device. Your test answers, IQ estimates, game records, streaks, training progress and the name you enter for your certificate stay on your iPhone and are never sent to us. IQora has no accounts and no servers that store your data. The only data the app sends out is limited purchase and subscription information, which Apple and our subscription analytics provider RevenueCat process so that we can sell and manage IQora Pro. We do not sell or share personal data, we show no ads, we use no advertising or tracking SDKs and we do not track you across apps or websites.

1. Who we are

IQora is published by Emre Keskin, an individual developer based in Türkiye ("we", "us"). We are the data controller (in Türkiye, the "veri sorumlusu" under KVKK) for the limited personal data described in this policy. Contact: plustekno1@gmail.com. You can use this address for every request in this policy, including requests from the EU, UK, US, Brazil and other regions. We have not appointed an EU or UK representative because we do not systematically process personal data of people in those regions beyond the purchase data described below; you can still contact us directly.

2. Data that stays on your device (we never receive it)

Tests and results: your answers to the quick (15-question) and full (30-question) adaptive tests, response times, estimated IQ scores, percentiles, category scores and test history are stored in the app's private database on your device.
Brain training: daily puzzle results, streaks and streak shields, badges, brain game records, 30-day program progress and monthly report data are stored on your device.
Profile and preferences: the optional name you enter for your IQ certificate, your onboarding answers (for example your goal, focus area and own estimate), your reminder time and other settings are stored on your device.
Home Screen widget: your streak and daily puzzle status are shared with the IQora widget through an App Group container that only IQora and its widget can access on the same device.
Certificate and share card: the certificate PDF and the share image are created on your device. They leave your device only if you choose to share or save them with the iOS share sheet, and then go to the app or person you choose under their own terms.
Reminders: the daily puzzle reminder is a local notification scheduled on your device. No push notification server is used.

Because this data never reaches us, we cannot access, read, recover or delete it for you. Settings > Reset All Data deletes your test results, streak, badges, game records, program progress, name and reminders from your device; deleting IQora removes everything it stored. If you back up your device to iCloud or a computer, IQora's data may be included in that backup under Apple's terms.

3. Data that leaves your device

Apple (App Store and payments). Purchases, free trials, renewals, cancellations and refunds are processed by Apple under Apple's own privacy policy. We never receive your name, email address, payment card or Apple Account details. The app checks your subscription status on your device with Apple's StoreKit. Apple gives us aggregated, anonymous sales and usage statistics, and crash reports only if you have chosen to share analytics with app developers in iOS Settings.
RevenueCat (subscription infrastructure and analytics). To validate and restore purchases and understand trials, conversions, renewals and cancellations we use RevenueCat, Inc. (USA) as a service provider/processor. When you open the app or make or restore a purchase, RevenueCat receives a random app user identifier generated by RevenueCat (not linked to your name or Apple Account), your purchase and subscription transactions (product, price, currency, dates, trial and renewal status, App Store transaction identifiers), the App Store country, app version, operating system version, device model and the IP address of the request. Your test answers, IQ estimates, game records, streaks, name and other app data are never sent to RevenueCat. RevenueCat processes this data only on our behalf. See revenuecat.com/privacy.
Our website. If you open our website (for example this policy or the support page), our hosting provider Netlify, Inc. (USA) processes your IP address and basic request data in server logs to deliver the page and keep it secure. The website uses no cookies, analytics or tracking.
Support emails. If you email us, we receive your email address and whatever you choose to send, and use it only to answer you.

We do not use advertising SDKs, advertising identifiers (IDFA) or tracking technologies, and we do not ask for App Tracking Transparency permission. RevenueCat is used only for subscription infrastructure and analytics on our behalf, never for advertising or tracking.

4. Why we process data and our legal bases

Providing IQora Pro (purchase validation, restoring purchases, managing your subscription through Apple): performance of a contract (GDPR/UK GDPR Art. 6(1)(b); KVKK Art. 5(2)(c); LGPD Art. 7(V)).
Subscription analytics, fraud prevention and improving the app using pseudonymous purchase data (RevenueCat): our legitimate interests in running a sustainable app (GDPR Art. 6(1)(f); KVKK Art. 5(2)(f); LGPD Art. 7(IX)). You can object at any time (see section 7).
Accounting and tax obligations on aggregated sales: legal obligation (GDPR Art. 6(1)(c); KVKK Art. 5(2)(ç)).
Website hosting logs: our legitimate interest in delivering and securing the website (GDPR Art. 6(1)(f); KVKK Art. 5(2)(f); LGPD Art. 7(IX)).
Answering your messages: your request and our legitimate interest.
Notifications permission is requested only when you turn on the daily puzzle reminder, and only to show that reminder. You can withdraw it anytime in iOS Settings.

Your IQ estimate is calculated on your device for your own information only. We do not make decisions based solely on automated processing that produce legal or similarly significant effects, and we do not profile you.

5. Sharing, selling and international transfers

We do not sell personal data and we do not "share" it for cross-context behavioral advertising (as defined in the California CCPA/CPRA). We disclose the limited data in section 3 only to our service providers Apple, RevenueCat and Netlify, which process it under their own terms and contracts that restrict its use. We may disclose information if required by law or to protect our rights.

Apple, RevenueCat and Netlify may process data in the United States and other countries. Where data protection law requires it, transfers are protected by appropriate safeguards such as the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, the EU-US Data Privacy Framework where applicable, and, for transfers from Türkiye, the standard contracts and procedures under KVKK Article 9.

6. How long we keep data

On-device data stays until you reset it, delete it or delete the app. Pseudonymous purchase records at RevenueCat are kept while your subscription history is needed for analytics and validation, and are deleted on request (section 7) or when we close our RevenueCat project. Support emails are kept for up to 2 years. Website server logs are kept by Netlify for a limited period under its own policy. Apple keeps transaction data under its own policy.

7. Your rights

Depending on where you live, you have some or all of these rights: to know and access the personal data we hold about you, to correct it, to delete it, to receive it in a portable format, to restrict or object to processing (including processing based on legitimate interests), to withdraw consent, and not to be subject to solely automated decisions. You will not be treated differently for exercising your rights.

EU/EEA, UK and Switzerland (GDPR, UK GDPR, FADP): all rights above, plus the right to complain to your data protection authority (for example your national DPA, the UK ICO or the Swiss FDPIC).
Türkiye (KVKK Art. 11): to learn whether your data is processed and request information, to learn the purpose and whether it is used accordingly, to know third parties in Türkiye or abroad to whom it is transferred, to request correction or deletion and notification of these to third parties, to object to a result against you arising from exclusively automated analysis, and to claim compensation for damage from unlawful processing. You may also complain to the Personal Data Protection Board (KVKK Kurulu).
United States (California CCPA/CPRA and the privacy laws of Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Iowa, Delaware, New Hampshire, New Jersey, Tennessee, Minnesota, Maryland, Indiana, Kentucky, Nebraska, Rhode Island and other states): right to know/access, delete, correct, portability, and to opt out of sale, sharing, targeted advertising and profiling. We do none of these, so there is nothing to opt out of; we also honor Global Privacy Control signals. In the last 12 months we collected the categories "identifiers" (random app user ID), "commercial information" (purchase history) and "internet or network activity" (request IP address) from your device through RevenueCat, and other personal information only if you emailed us (category "identifiers": your email address, and the content of your message) or opened our website (category "internet or network activity": request IP address, in hosting logs), for the business purposes in section 4, and disclosed it only to service providers. We do not collect sensitive personal information for inferring characteristics. You may use an authorized agent; we may ask you to verify the request. If we deny a request you can appeal by replying to our answer.
Brazil (LGPD): confirmation of processing, access, correction, anonymization, blocking or deletion, portability, information about sharing, and revocation of consent; you may complain to the ANPD.
Canada (PIPEDA, Quebec Law 25), Australia (Privacy Act and APPs), New Zealand, Japan (APPI), South Korea (PIPA), India (DPDP Act 2023), Singapore, Malaysia, Thailand, the Philippines, Indonesia, Vietnam, South Africa (POPIA), Saudi Arabia (PDPL), the UAE, Israel and other countries: you have the access, correction, deletion and complaint rights provided by your local law, which you can exercise as described here.

How to exercise your rights: email plustekno1@gmail.com. Because IQora has no accounts and we do not know who you are, please include the App Store order date and product if you can, so we can find the matching pseudonymous purchase record at RevenueCat. We answer within 30 days (KVKK: within 30 days; GDPR: within one month, extendable by two months for complex requests; US: within 45 days). Data that exists only on your device can be deleted by you at any time in Settings > Reset All Data or by deleting the app. Purchase records are held by Apple; you can request them from Apple at privacy.apple.com.

8. Children

IQora is a general-audience app and is not directed to children under 13 (or under 16 in the EEA, or the higher age set by your country). We do not knowingly collect personal data from children. Purchases by minors are handled by Apple's Family Sharing and Ask to Buy controls. If you believe a child has sent us personal data, contact us and we will delete it.

9. Security

On-device data is protected by iOS app sandboxing and data protection; the App Group container is accessible only to IQora and its widget. Connections to Apple, RevenueCat and our website are encrypted in transit (HTTPS/TLS). No method is perfectly secure; if a breach affecting your personal data occurs, we will notify you and the authorities as required by law.

10. Changes

We may update this policy when the app or the law changes. We will post the new version here with a new effective date and, for material changes, tell you in the app or in the App Store release notes.

11. Contact

Emre Keskin, IQora · plustekno1@gmail.com