Privacy Policy

TokIQ: AI Prompt Quiz (“TokIQ”, formerly PromptIQ) is a quiz app that teaches how to write prompts for AI language models. This policy explains what personal data the TokIQ iOS and Android apps, our servers and this website process, why, who receives it, how long it is kept and how you can use your rights. It does not cover third-party apps, websites or ads that you open from TokIQ.

1. Who is responsible

The controller of your personal data is Olaasoft MMC (“OlaaSoft”, “we”, “us”), 28,73 Rizvan Teymurov str., Baku AZ1002, Azerbaijan. Contact for every privacy question or request: choicy.appstore@gmail.com.

We process personal data in line with the Law of the Republic of Azerbaijan “On Personal Data” and, where they apply to you, the EU and UK General Data Protection Regulation (GDPR / UK GDPR), the California Consumer Privacy Act as amended by the CPRA (CCPA) and similar laws.

2. Summary

• You can start as a guest without giving us your name or email. To keep playing after two questions you create an account with email and password, Google or Apple.
• We store your quiz progress, preferences and ranking data on our server so the app works across sessions and devices.
• Quiz questions and explanations are generated by AI (OpenAI). We do not send your email, name, user ID, answers or score to the AI provider.
• Free users see ads from Google AdMob. Personalised ads and tracking depend on your choices in the consent form and, on iPhone, in Apple’s tracking prompt. Premium removes ads.
• Product analytics (Mixpanel) runs only with your consent and can be switched off in Settings.
• You can delete your account in the app at any time. A small amount of hashed data is kept afterwards so the free period cannot be claimed again (section 9).
• We do not sell your personal data for money. Personalised advertising may count as “sharing” under California law; section 11 explains how to opt out.

3. What we collect

3.1 Account and sign-in

TokIQ uses Firebase Authentication (Google). When you first open the app it creates an anonymous guest account with a random user ID. If you register, the guest account is linked to your chosen sign-in method and keeps its history. Depending on the method, Firebase processes your email address, whether it is verified, a display name and profile photo supplied by Google or Apple, and sign-in times. Passwords are handled by Firebase; our server never sees or stores them. Firebase sends the email-verification and password-reset emails. With Sign in with Apple you can use Apple’s “Hide My Email” relay address.

3.2 Profile, quiz and progress data

Our server identifies you by your Firebase user ID and stores:

• your app language, the AI tools you use, your learning purposes and experience level (used to choose questions that suit you);
• quiz sessions, the questions shown to you, the answers you selected and the results;
• points, answer totals, results by topic and difficulty, streaks, completed sessions, articles you have read and the explanations generated for you;
• counters for daily limits and the free period, rate-limit counters and records that stop duplicate requests;
• your subscription status (received from the app stores through Adapty) and any Premium access granted by our support team;
• records of rewarded ads you completed, identified by your user ID and a random one-time code, so the reward can be credited.

This data is stored in a PostgreSQL database hosted by Railway.

3.3 Ranking, nickname and visibility

Registered users who answer ranked questions appear in the global ranking with their points, answer totals and rank. You choose how you appear:

• with an optional nickname you choose, visible to all users;
• otherwise with a masked label that shows at most the three characters before the “@” of your email, the rest blurred (nothing at all for Apple “Hide My Email” addresses);
• with your full email only if you switch on “Show my full email in the ranking” yourself and your email is verified. You can switch it off at any time.

You can also hide your nickname so others see only a blurred label. Other users never see your user ID. Guests do not appear in the ranking.

3.4 Free period and abuse prevention

New registered users get a free period (currently 3 days; the length may change). It is granted once per device and once per verified email address. To enforce this:

• We normalise your email address (for example lower-casing it and removing “+tags”) and keep only a keyed one-way hash (HMAC) of it, not the address itself, in a separate free-period record.
• On iPhone the app asks Apple’s DeviceCheck service for a one-time token. Our server uses it to read and set two bits that Apple stores for this device and our app (“free period already used”). We do not receive a hardware identifier.
• On Android the app sends the Android ID (an identifier Android generates for our app on your device). Our server immediately turns it into a keyed one-way hash and stores only that hash.
• Email addresses from disposable-email services may not receive a free period.

These signals are used only to prevent repeated free periods and fraud, never for advertising or tracking. They are kept after you delete your account (section 9).

3.5 Question reports

If you report a question or explanation, we store the question, the reason you chose, your optional comment and your user ID, and use them to review and correct content. Please do not put personal information in the comment. Reports are deleted when you delete your account.

3.6 Support messages and this website

If you email us we receive your email address and whatever you write, and use it to answer you; support email is currently handled through a Google (Gmail) mailbox. This website has no accounts and does not use analytics or advertising cookies. When you send a message through the Support or Feedback forms we receive what you enter (email address, optional name, subject, message type, device platform, rating and message) and use it only to reply and to improve TokIQ. The message is delivered to our team by email through Resend and/or to a private team channel. Railway, our host, keeps standard server logs (such as IP address and browser type) for security, and a short-lived counter per IP address limits form spam.

To decide which ideas deserve an article on this website, we may count for each question how many learners answered it wrong and then opened “Why?”. Each learner is counted through a one-way fingerprint, not your user ID, email or name, and only the question and its explanation are used for an article; nothing about you is published.

3.7 Data kept only on your device

The app keeps your language, sound and haptics settings, reminder choice, consent choices, a local copy of your profile and progress, and a cached subscription status on your device. Account-specific data is cleared when you sign out or delete your account. Uninstalling the app removes this local data but does not delete data held by us or our providers.

3.8 Technical data

Our providers receive technical data when the app connects to them: IP address (from which an approximate location such as country or city can be inferred), device model, operating system and app version, language and the identifiers described below. Our own API logs record only the route, status code and response time, not your user ID, email or IP address; our hosting provider keeps standard network logs for security.

4. AI-generated content (OpenAI)

Questions, explanations and articles are generated and reviewed on our server with models from OpenAI. Requests contain the language and topic, our own editorial instructions, recent question titles (to avoid repeats), general content tags and, for an explanation, the quiz question being explained. We do not send your email address, name, user ID, password, selected answers, score, ranking, nickname, report comments or profile preferences to OpenAI. Our requests are sent with OpenAI’s response-storage option switched off.

Under OpenAI’s API data usage policy, data sent through the API is not used to train OpenAI’s models by default and may be retained by OpenAI for a limited period for abuse monitoring. That is OpenAI’s policy, not a promise by us; see also OpenAI’s Privacy Policy.

5. Advertising

If you do not have Premium, TokIQ shows ads (full-screen ads between questions and optional rewarded ads) served by Google AdMob, which may run an auction among the mediation partners Unity Ads and Pangle. Ad providers may process your device’s advertising identifier (IDFA on iOS, Advertising ID on Android), IP address and approximate location, device and app information, and ad interactions to show and measure ads, limit how often you see them and prevent fraud. For rewarded ads the app passes your TokIQ user ID and a random code to Google so our server can check that the reward was earned. Ad providers act under their own privacy policies and, for personalised ads, as independent controllers.

• Consent (EEA, UK, Switzerland): the app shows Google’s consent form (User Messaging Platform) before the ad SDK starts. If no consent answer is available, no ads are requested in that session.
• iPhone: Apple’s App Tracking Transparency prompt is shown as part of this flow. If you choose “Ask App Not to Track”, your IDFA is not shared and ads are not personalised with it.
• Change your choice: in the app, Settings → Ad privacy options (where offered in your region); on iPhone, Settings → Privacy & Security → Tracking; on Android, Settings → Google → Ads (delete or reset your advertising ID).
• Premium subscribers do not see ads.

6. Diagnostics, analytics and app integrity

• Crash reporting (Firebase Crashlytics and Sentry): crash reports and errors with stack traces, device model, OS and app version and an installation identifier. We do not attach your email, user ID, answers or article text. Sentry data is stored in Sentry’s EU (Germany) region.
• Product analytics (Mixpanel): app events such as screens viewed, quizzes started and answered, paywall views and purchase steps, with device and app information and a one-way hash of your user ID. Mixpanel runs only after you consent in the app, and you can turn it off at any time with the analytics switch in Settings.
• Firebase Analytics: included with the Firebase toolkit; it may record basic app events (such as first open and session start) with an app-instance identifier, used only for aggregate statistics.
• Firebase App Check: uses Apple App Attest / DeviceCheck and Google Play Integrity to confirm that requests come from the genuine app.
• Firebase Remote Config delivers settings such as update notices. Firebase Cloud Messaging may create a push token; the app does not ask for notification permission when it starts.

7. Notifications

Learning reminders are optional. The app asks for notification permission only after explaining the reminder, either after you have answered a question or when you turn it on in Settings. Reminders are scheduled locally on your device; turning the setting off, signing out or deleting your account cancels them.

8. Subscriptions and payments

Subscriptions are sold and billed by the Apple App Store or Google Play. We never receive your card or payment details. We use Adapty to read the store’s purchase records and tell our server whether your subscription is active. For a registered user, Adapty receives your Firebase user ID so the subscription follows your account; our Adapty setup does not collect advertising identifiers. Deleting your TokIQ account or uninstalling the app does not cancel a subscription; manage it in your store account.

9. How long we keep data

• Account, profile, progress, sessions, articles, ranking, nickname, question reports, rewards and subscription status: kept while your account exists. When you delete your account in the app, they are deleted from our live database immediately and your Firebase sign-in identity is deleted (by the app at once, and by our server again about 10 minutes later as a safeguard). Your Adapty profile is deleted too.
• Free-period records (hashed email, hashed Android ID, Apple DeviceCheck bits): kept after account deletion, for as long as we offer a free period, so the same email or device cannot claim it again. They contain no raw email address or device ID and are not linked to the deleted account’s data.
• Deletion marker: a record containing only “deleted: true”, stored under a one-way hash of your former user ID, so delayed requests cannot recreate your data.
• Admin audit log: if our team changed your account (for example granted Premium), the log entry is kept with your user ID replaced by a pseudonym.
• Hashed rewarded-ad transaction IDs are kept so the same reward cannot be credited twice; they contain no personal details.
• Guest accounts: a guest’s progress is stored under a random user ID without contact details. Guests have no in-app delete button; to delete it, register and then delete the account (this deletes the guest history too), or email us. We may delete inactive guest data at any time.
• Backups: if database backups exist they are encrypted, kept for a limited period and then overwritten; deleted accounts are not restored from them, and deletions are re-applied before any recovery.
• Providers: crash, analytics and advertising providers keep data for the periods set in their policies and our account settings. Apple and Google keep store transaction records under their own policies.
• Support and website messages: kept as long as needed to handle your request and any follow-up.

10. Purposes, legal bases and recipients

“Contract” means the processing is needed to provide the app you asked for (GDPR Art. 6(1)(b)); “legitimate interests” means our interest in security, abuse prevention and a reliable service, balanced against your rights (Art. 6(1)(f)); “consent” can be withdrawn at any time (Art. 6(1)(a)).

Service providers

Most providers act as our processors under data-processing terms. Advertising networks, and Apple and Google as app stores and sign-in providers, also act as independent controllers under their own policies.

• Google Firebase — Authentication, App Check, Crashlytics, Analytics, Remote Config, Cloud Messaging (USA)
• Google AdMob and User Messaging Platform — ads and consent (USA)
• Unity Ads — ad mediation partner (USA)
• Pangle (Bytedance Pte. Ltd.) — ad mediation partner (Singapore)
• OpenAI — AI question and explanation generation (USA)
• Railway — server, database and website hosting (USA / EU)
• Mixpanel — product analytics, with consent (USA)
• Sentry (Functional Software, Inc.) — error reporting (data stored in the EU)
• Adapty — subscription status (USA)
• Apple — App Store, Sign in with Apple, DeviceCheck, App Attest (USA)
• Google Play and Google Sign-In — store, billing and sign-in (USA)
• Resend — delivery of website form messages (USA)

International transfers

We are based in Azerbaijan and our providers process data in the United States, the European Union, Singapore and other countries. When personal data from the EEA, the UK or Switzerland goes to a country without an adequacy decision, we rely on the European Commission’s Standard Contractual Clauses (with the UK Addendum where relevant) or, where the provider is certified, the EU–US Data Privacy Framework. You can ask us for more information about these safeguards.

11. Your rights

Depending on where you live, you have the right to:

• access the personal data we hold about you and receive a copy (portability);
• correct inaccurate data;
• delete your data: use Profile → Delete account in the app, or see how to delete your account;
• object to processing based on legitimate interests, and ask us to restrict processing;
• withdraw consent at any time (ads: Settings → Ad privacy options; analytics: the analytics switch in Settings; reminders: Settings), without affecting earlier processing;
• complain to a data-protection authority, for example in the EU country where you live or work, or the UK Information Commissioner’s Office.

How to use them: email choicy.appstore@gmail.com from the address linked to your account (or tell us your sign-in method). We may ask for information to confirm the request is yours. We answer within one month (GDPR) or 45 days (CCPA), extendable where the law allows. Requests are free unless they are manifestly unfounded or excessive.

California and other US state residents

• In the last 12 months we collected the categories in section 10: identifiers (user ID, email, advertising ID), commercial information (subscription status), internet or other electronic network activity (app and ad interactions), approximate geolocation, and inferences limited to your learning level. We do not collect sensitive personal information as defined by the CCPA.
• We do not sell personal information for money. However, letting Google AdMob and its mediation partners use your advertising identifier and ad interactions for personalised (cross-context behavioural) advertising may be “sharing” or a “sale” under the CCPA and similar state laws.
• Opt out of sale or sharing: on iPhone, choose “Ask App Not to Track” or turn off Settings → Privacy & Security → Tracking; on Android, delete your advertising ID or opt out of ads personalisation in Settings → Google → Ads; use Settings → Ad privacy options in the app where offered; or email us with the subject “Do Not Sell or Share” and we will apply the opt-out to your account where we can.
• You have the right to know, delete and correct, to opt out of sale and sharing, and not to be discriminated against for using these rights. You may use an authorised agent; we will verify the request with you.
• We do not knowingly sell or share personal information of consumers under 16.

12. Children

TokIQ is not directed at children. You must be at least 13 years old, or older if your country sets a higher age for consenting to the processing of personal data (for example 16 in some EU countries); below that age you may use TokIQ only with the consent of a parent or guardian. We do not knowingly collect personal data from children under 13. If you believe a child under 13 has used TokIQ, contact us and we will delete the account.

13. Security

Data is encrypted in transit (HTTPS/TLS). Our server accepts requests only with a verified Firebase sign-in token and, in production, an App Check token from the genuine app. Administrative access is limited to a few verified staff accounts and is logged. No system is perfectly secure, but we work to protect your data and will notify you and the authorities of a breach where the law requires.

14. Automated decisions

We do not make decisions with legal or similarly significant effects about you solely by automated means. Question selection, daily limits and free-period checks are automated features of the service; contact us if you think one was applied to you by mistake.

15. Changes to this policy

We may update this policy when the app or the law changes. The new version is published on this page with a new “Last updated” date. If a change materially affects how we use data you have already given us, we will tell you in the app or ask for your consent where required.

16. Contact

Olaasoft MMC, 28,73 Rizvan Teymurov str., Baku AZ1002, Azerbaijan. Email: choicy.appstore@gmail.com. You can also use the Support page.