Privacy policy

In short

• The website sets no cookies of its own and does not track you; it only counts anonymous daily totals of page views and taps, without cookies or identifiers. The short test is scored in your browser; your answers are not sent anywhere. Only on the end screen of the web IQ test does the page load Google’s sign-in service for the Sign in with Google button; it may use Google’s own cookies.
• The full IQ test on the website stores your answers on our server without a name. When you save it with Google, it is added to your account; tests that are never added to an account are deleted after 30 days. Your score is never shown on the website and never stored in your browser.
• The app needs an account: you sign in with Apple, Google or a one-time code sent to your email. We ask for a nickname, your year of birth and your country; a display name is optional and visible to other players. We do not ask for your phone number or location. There are no ads and no advertising identifier, and we do not sell data.
• With usage analytics, the app records which screens you open, for how long, and key actions such as starting a test or a duel. It goes only to our own server – never to third parties or advertisers – and helps us improve the app, prevent abuse and answer support requests. It starts off for everyone in every country, Türkiye included, and runs only if you turn it on (during profile setup or in Settings → Privacy → Usage analytics); you can turn it off again there at any time. If you never choose, nothing is sent. Nothing is sent before you sign in.
• In duels and on your player profile, other players see your IQ result – a ten-point range if you are 13 to 17. Joining the IQ leaderboard is optional.
• The AI coach is optional. Only after you agree in the app are your coach messages and anonymised game statistics sent to Anthropic (Claude) to write the replies – never your name, nickname, email address or IDs. To write the short profile text, Claude receives only anonymous numbers.
• For Arion+ and other purchases, payment runs through the App Store or Google Play; we receive the store’s transaction data, never your payment details.
• You can download your data and delete your account at any time – in the app, or on the account deletion page.

Who is responsible

The controller is Ulaş İşibol, Türkiye. Contact for all privacy questions: hello@iqarion.com.

The website

Hosting, security and logs. The website and our server run on Cloudflare. To deliver pages and protect them against attacks, Cloudflare necessarily processes technical data such as your IP address, the time, the requested address and your browser type. Our server’s logs (Cloudflare Workers Logs) can contain such request data and technical error messages; they are kept for at most 7 days. Legal basis: our legitimate interest in a secure, working service (Art. 6(1)(f) GDPR).

Statistics. We use Cloudflare Web Analytics, which works without cookies and without identifying you and gives us only aggregate numbers such as page views per country. In addition, the website itself counts anonymous daily totals of page views and of taps on marked buttons and links: store buttons, starting the IQ test or the short test, links in the main navigation and the footer, the language switch and calls to action in blog posts. Each count holds only the page address without parameters, the page language, a rough screen size class (phone, tablet or desktop), for a tap the name of the button and, for a page view, the domain of the website that linked to it (never the full address) plus the campaign tags (utm_source, utm_medium, utm_campaign) if the link had them. We also count starting and finishing the short test and which store a store button leads to. Counts are only added up per day: no cookie, identifier, IP address or answer is stored with them, so they cannot be linked to you or to each other. To limit abuse, your IP address is held briefly in memory only and never stored. If your browser sends Do Not Track or Global Privacy Control, nothing is counted. Legal basis: legitimate interest in knowing which pages and languages are useful (Art. 6(1)(f) GDPR). The app’s usage analytics (see “Usage analytics in the app”) is not used on the website.

The short test. Questions and scoring run entirely in your browser. Your answers never leave your device.

The IQ test on the website. You can take the full adaptive test without an account. Sent to our server and stored there without any name or email: your answers and response times, how often and how long you left the tab during the test, the page language, a random token created by your browser (we store only a hash of it) and a hash of your IP address (to limit the number of tests per connection). Your browser keeps the token and the test’s ID in local storage so that you can continue after a reload; it never keeps a score.

At the end, you can save the test with Sign in with Google. Only then – on that end screen – does the page load Google Identity Services from accounts.google.com. Google processes your sign-in under its own privacy policy and may set or read its own cookies for it. We receive your Google account ID and email address and create or find your IQ Arion account with them (see “The app”); the test is added to that account, and the website’s short-lived sign-in is ended right away. If you sign in with Apple or email in the app instead, you can add the test there with the 8-character code from the end screen (valid for 30 days).

Deletion: unfinished tests 30 days after their last activity; finished tests that are not added to an account 30 days after they were finished; after a test has been added to an account, the remaining web copy (without answers) 30 days later. Legal basis: providing the test you asked for (Art. 6(1)(b) GDPR).

Account deletion page. You sign in with a code sent to your email; what we process is described under “The app”.

Email. If you write to us, we use your message and address only to reply and delete them when they are no longer needed.

Cookies and local storage

The website sets no cookies of its own and uses no tracking or advertising technology. It keeps a few items in your browser’s storage, only for functions you use:

Item	Where	Purpose	How long
Puzzles and tutorials already seen (short test, IQ test)	local storage	Not showing the same puzzle or tutorial twice; never leaves your browser	until you clear it
Web IQ test token and test ID	local storage	Continuing your test after a reload	until the test is saved or you clear it
Random device identifier	local storage	Signing in on the IQ test and account deletion pages	until you clear it
Sign-in session	session storage	Saving your test or deleting your account	until the tab is closed or the task is done

Google cookies. On the web IQ test page, Google’s sign-in service is loaded only when you reach the end screen, and from then on Google may use its own cookies (for example to recognise that you are signed in to Google). These cookies are Google’s; see Google’s privacy policy. If you do not want them, use the 8-character code in the app instead.

The app

Playing as a guest. You can also start without signing in: the app then creates a guest account on our server, linked to a random identifier of your device, with an automatic nickname (such as guest_4821) that you can change. We still ask for your year of birth and country, and the same age rules apply. Everything else in this section applies to guest accounts as well. A guest account cannot make purchases. If you later sign in with Apple, Google or email from the guest account, it becomes a normal account and keeps all its data. A guest account with no activity for 180 days is deleted automatically, in the same way as when you delete your account.

What we process, and why

Data	Purpose
Sign-in: email address; with Apple or Google, your account ID there and the email (or Apple relay address) they pass on; sessions and a random device identifier	Creating your account and signing you in
Profile: nickname, optional display name (with Apple, the name you choose to share is suggested and can be changed or removed), year of birth, country, language, time zone, notification settings and quiet hours	Showing you to other players, applying the age rules, finding fair opponents, respecting your quiet hours
Test: answers, response times, scores and their confidence intervals, leaving the app during the test, your age at the time of the test	Calculating and protecting your result, issuing certificates, calibrating questions
Optional questions after the test: year of birth, education level, country	Only for computing our norms (see how scoring works)
Certificate: the name you enter on it	Issuing a certificate that anyone with its code can verify
Play: duels and your answers in them, daily puzzles, practice and Bağla progress, daily training (your training sets, answers with response times, streaks), puzzles you have already seen (kept up to a year), points, league, badges, leaderboard positions	Running duels, the daily puzzle, leaderboards and the weekly cup; not repeating puzzles
Activity: the days you open the app and solve puzzles, and how often you open it at each hour of the day	Your activity calendar and choosing the time of your daily reminder
Social: players you follow or block; reports you send (reason and an optional note)	Following friends, protecting you, handling abuse
Invites: invite codes and who redeemed them	Unlocking results and preventing abuse (for example the same device or connection)
Purchases and Arion+: store, product, store transaction and subscription IDs, platform, status (for example trial, active or expired), dates such as start, renewal and expiry, and any refund – verified with Apple or Google; never your payment details	Unlocking results, providing Arion+, handling renewals and refunds, accounting
AI coach, only after your consent: your messages to the coach, its replies, a short summary of older messages, and usage records (date, type of request, AI model, amount of text processed, cost)	Answering your questions as a training coach; quotas, cost control and preventing abuse
Security: a hash of your IP address (rate limits, invite abuse checks)	Protecting the service against abuse
Notifications: push token, platform, the notifications we sent you	Sending the notifications you allowed
A parent’s email address, only where parental consent is required	Requesting and recording consent
Usage analytics, only while it is switched on (see “Usage analytics in the app”): the screens you open and how long you stay on them, key actions, a random installation ID and session ID, platform, app and system version, language, the country from your profile and your account ID	Improving the app, preventing abuse and fraud, support and moderation
Error reports from the app: technical details such as the error message, app version and platform – no name, email or account ID	Finding and fixing bugs

Who sees what. Other players see your nickname, your display name if you set one (this can be your real name – for example the name shared through Sign in with Apple – so you can change or remove it in the settings), your country, league badge, level and points. In duels and on your player profile, other players see your IQ result: the exact score if you are 18 or older, a ten-point range (for example 110–119) if you are 13 to 17, and “—” if you have no main result yet. The app tells you this before your first duel. Your IQ appears on the IQ leaderboard only if you choose to join it. Your email address, year of birth and answers are never shown to other players. Anyone with a certificate’s code can see what is printed on it: the name you entered, the test date, the score and its interval, the percentile, the area profile, the norm version and the attempt.

What we do not collect: your phone number, precise location, contacts or advertising identifier. We do not show ads and we do not sell or rent data. The app contains no third-party analytics, advertising or tracking tools, and we do not track you across other companies’ apps or websites.

Legal bases. Performance of our contract with you – your account, the test, duels, unlocks and purchases (Art. 6(1)(b) GDPR); legal obligations such as keeping accounting records (Art. 6(1)(c) GDPR); our legitimate interest in fair play, security, fixing errors and better questions (Art. 6(1)(f) GDPR); and your consent for push notifications, the optional questions after the test, the IQ leaderboard, usage analytics and the AI coach (Art. 6(1)(a) GDPR), which you can withdraw at any time in the settings.

Automated decisions. Your score is calculated automatically by a fixed measurement model, and tests with unusual patterns (for example many very fast answers) are automatically kept off the IQ leaderboard. This has no legal or similarly significant effect on you. If you think a result was handled wrongly, write to us and a person will look at it.

Usage analytics in the app

To see where the app works well and where people get stuck or give up, the app can record how it is used. These records (“events”) go only to our own server.

What is recorded. The screens you open – only the kind of screen, such as “test” or “player profile”, never which test or whose profile – and how long you stay on them, plus key actions: steps of the onboarding and the test, purchases started and completed, duel searches, games started and solved, your answer to the notification prompt and similar. Events contain no name, email address, nickname, IQ score or text you type.

What each event carries. A random installation ID created by the app (not your device’s advertising identifier), a random ID for the current session, the platform (iOS or Android), the app and operating-system version, your language, the country from your profile and your account ID.

Before you sign in. The app sends nothing. Events wait on your device and are sent only once you are signed in and your choice is known; otherwise the app deletes them within 24 hours.

What we use it for.

• Improving the app – for example, finding the step at which many people give up.
• Preventing abuse and fraud – for example cheating, or misuse of invites and purchases.
• Support and moderation – in our admin panel, the IQ Arion team can see a timeline of a player’s events, for example when you write to us or when a player is reported. Other players never see it.

What we do not do. We do not pass the events on to third parties, use them for advertising, sell them or combine them with data from other companies’ apps or websites. The app contains no third-party analytics or advertising SDK and does not use your device’s advertising identifier.

Your choice. You can switch usage analytics off or on at any time in Settings → Privacy → Usage analytics. While it is off, the app sends no events, and our server discards any that still arrive for your account. It starts switched off for every player in every country, Türkiye included, and stays off until you turn it on during profile setup or in the settings; if you never choose, nothing is sent. In the EU/EEA, players below their country’s age of digital consent can turn it on only with a parent’s consent.

Legal basis. In every country: your consent (Art. 6(1)(a) GDPR; in Türkiye, explicit consent under Article 5(1) KVKK; where relevant together with the national rules on storing information on your device) – or, below the age of digital consent, a parent’s consent (Art. 8 GDPR) – which you can withdraw at any time by switching it off.

How long we keep it. Individual events are deleted after 90 days. After that we keep only aggregated counts – for example how many people opened a screen on a given day – that can no longer be linked to you.

Export and deletion. Every event is linked to your account, so your data export (Settings → Export my data) includes all of them and deleting your account deletes them all. To have your usage data deleted without closing your account, write to hello@iqarion.com.

Children and teenagers

IQ Arion is for people aged 13 and over; under-13s cannot create an account, and if someone enters a birth year that makes them younger than 13, we do not store it. In EU and EEA countries, players below the national age of digital consent (between 13 and 16) need a parent’s consent: we send a request to the parent’s email address, and until it is granted, duels, leaderboards, cups and the public profile stay closed – the test and the daily puzzle still work. For players aged 13 to 17, others only see a ten-point IQ range, and results are compared with people of the same age using preliminary norms. There is no chat between players; the only contact between players is the duel itself. The AI coach, which talks only about training in IQ Arion, has a minimum age that depends on the country: 18 if the country in your profile is in the EU/EEA, the UK or Switzerland, or if your country is unknown, and 13 everywhere else, Türkiye included (see “AI”). Usage analytics stays off for every player until they turn it on; in the EU/EEA, players below the age of digital consent can turn it on only with a parent’s consent.

AI

AI coach. The coach is an optional chat in the app that answers questions about your training and progress. It works only after you have agreed on an in-app screen that explains what is sent. Then, to write each reply, we send Anthropic, PBC (USA) your message, the recent messages of your conversation (with a short summary of older ones) and anonymised statistics from your play: accuracy and speed per area, your training history, streaks, your duel record, a summary of your test result only if it is unlocked, your age group and your language. A short automatic check, also by Claude, first decides whether a message is about training. Arion+ members also receive a weekly summary written from the same statistics. We never send your name, nickname, email address, account ID or other identifiers – but what you type in a message is sent as written, so please do not include personal details. Anthropic acts as our processor (service provider) and uses the data only to produce the replies. The coach’s answers are general training tips written by AI: they can contain mistakes and are not medical, psychological or other professional advice. The coach’s minimum age is 18 if the country in your profile is in the EU/EEA, the UK or Switzerland (or if your country is unknown) and 13 everywhere else, Türkiye included; players below that age do not see the coach and cannot use it.

Separate explicit consent to the transfer abroad. The coach’s consent screen has a separate checkbox, not pre-ticked, in which you explicitly consent to your coach messages and anonymised statistics being transferred to Anthropic, PBC in the USA. The coach does not work without it. We store the time of your consent and the version of the consent text.

Your conversation is kept for 30 days and then deleted automatically; it is included in your data export and deleted with your account. You can withdraw your consent at any time in Settings; your conversation is then deleted at once and nothing more is sent. Usage records (date, type of request, AI model, amount of text processed, cost) are kept for 180 days for quotas, cost control and abuse prevention; if you delete your account, they are kept until then without any link to you. Legal basis: your consent (Art. 6(1)(a) GDPR; in Türkiye, explicit consent under Article 5(1) KVKK). Anthropic processes the data in the USA. For this transfer we rely on your explicit consent (in Türkiye, explicit consent under Article 9 of Law No. 6698). If you are in the EU/EEA, the UK or Switzerland, the transfer relies on the standard contractual clauses in Anthropic’s data processing terms and, in addition, as a fallback, on your explicit consent given after being informed of the possible risks of a transfer to a country without an adequacy decision (Art. 49(1)(a) GDPR) (see “Service providers”).

Profile text. When your result is unlocked, we send Anthropic, PBC (USA) only anonymous values: the levels of your four areas, a rough percentile band (for example “top 25 %”), the norm status and your language. Its AI model Claude writes a short profile text from them. We never send your name, email address, nickname, account ID or score, and the text does not change your score.

Under Anthropic’s commercial terms, data sent through its API is not used to train its models by default.

Reporting a coach answer. If you tap “Report” under a coach answer, we store a copy of that answer, the message it replied to, the reason you chose and the time, linked to your account, so that our team can review it. Nothing more is sent to Anthropic. Reviewed reports are deleted after 12 months at the latest, and all reports are deleted with your account. Legal basis: our legitimate interest in keeping the coach safe (Art. 6(1)(f) GDPR; in Türkiye, Article 5(2)(f) KVKK).

Arion AI, the duel opponent, is our own program; it uses nothing but the duel itself. Your score is calculated by our program, never by AI.

How long we keep data

• Account, results and play data (including daily training): as long as your account exists. Deleting your account removes them at once; removal from backups is complete within 30 days.
• Duels: your opponents keep the duel in their history; you appear there as “deleted player”.
• Purchase and Arion+ subscription records: after account deletion, kept without any link to you for refunds and for as long as tax and commercial law require (in Türkiye up to 10 years). Apple and Google keep their own payment records. Deleting your account does not cancel an Arion+ subscription – cancel it in the App Store or Google Play settings.
• AI coach: conversations 30 days (sooner if you withdraw your consent or delete your account); usage records 180 days, without any link to you after account deletion. Reports of coach answers: until reviewed, then at most 12 months.
• Login codes: valid for 10 minutes, then deleted. Sign-ins expire after 90 days without use.
• Security records: hashed IP addresses 30 days; rate-limit counters (which can contain the email address a login code was requested for) 2 days.
• Sent notifications: 30 days. Puzzles you have already seen: up to a year.
• Web IQ tests: see “The IQ test on the website” above.
• Usage analytics: individual events 90 days; after that only aggregated counts that cannot be linked to you.
• Server logs: at most 7 days. Error reports from the app: samples of the error messages at most 7 days, daily error counts 90 days.
• Answer statistics used to calibrate questions: only in an anonymous form that can no longer be linked to you.

Service providers

We work with these providers, each under a data processing agreement or the provider’s data processing terms:

Provider	Purpose	Location
Cloudflare, Inc.	Hosting of the website and the server, database (including the app’s usage analytics and error reports), logs, website statistics	worldwide / USA
Resend	Sending login codes and parental consent emails (the email contains your nickname)	USA
Anthropic, PBC	AI coach replies (your coach messages and anonymised statistics, only with your consent); writing the profile text (anonymous values only)	USA
Apple	Sign in with Apple, App Store purchases, Arion+ subscriptions and refunds, push notifications	worldwide / USA
Google	Sign in with Google (also on the web IQ test page), Google Play purchases, Arion+ subscriptions and refunds, push notifications	worldwide / USA
Expo (650 Industries, Inc.)	Delivering push notifications	USA

The app’s usage analytics and error reports go to no provider other than Cloudflare, which hosts our server.

Where data leaves the EU/EEA or Türkiye, the transfer relies on the European Commission’s standard contractual clauses or another lawful mechanism (such as the EU–US Data Privacy Framework), and for Türkiye on the standard contract under Article 9 of Law No. 6698.

Your rights

Under the GDPR you have the right to access your data, to correct it, to have it deleted, to restrict or object to its processing, and to data portability (Art. 15–21 GDPR). In the app you can download your data (Settings → Export my data, a JSON file) and delete your account (Profile → Settings → Delete account). The export includes your usage analytics events and your AI coach conversation, and deleting your account deletes them; to delete only your usage data, write to hello@iqarion.com. You can withdraw your consent to usage analytics at any time in Settings → Privacy → Usage analytics. Without the app, use the account deletion page. For anything else – for example data that is not in the export, such as hashed security records – write to hello@iqarion.com from the email address of your account. We answer within one month.

You can withdraw consent – for example for push notifications, usage analytics, the AI coach or the IQ leaderboard – at any time in the settings; this does not affect processing that took place before.

You also have the right to complain to a data protection authority – in the EU, usually the one in your country; in Türkiye, the Personal Data Protection Authority (KVKK).

Notice for users in Türkiye (KVKK)

Under Article 10 of Law No. 6698 on the Protection of Personal Data (KVKK): the data controller is the person named above. Your personal data is collected electronically through the website and the app for the purposes described on this page – providing the account, the test, duels, daily training, the AI coach, purchases and Arion+, security, improving the app through usage analytics, support, and calibrating questions – on the legal grounds in Article 5(2)(c) (performance of a contract), (ç) (legal obligation) and (f) (legitimate interest), and, for push notifications, the optional questions, the IQ leaderboard, the AI coach and usage analytics for all players, your explicit consent (Article 5(1)). We do not process special categories of personal data. Data is kept for the periods under “How long we keep data” (usage analytics events: 90 days) and is transferred abroad to the service providers listed above in line with Article 9; your coach messages and anonymised statistics go to Anthropic, PBC in the USA only on the basis of the explicit consent you give with a separate checkbox on the coach’s consent screen (Article 9), and we store the time of that consent and the version of its text; usage analytics goes only to Cloudflare, which hosts our server. You can exercise your rights under Article 11 – including learning whether your data is processed, requesting correction or deletion, objecting, and claiming compensation – by writing to hello@iqarion.com; we answer within 30 days, free of charge. The Turkish version of this page contains the full notice.

Changes

If we change how we process data, we will update this page and its date. For significant changes we will also inform you in the app.