iQuantize Download
  1. Home
  2. Legal
  3. IQuantize Privacy Policy

IQuantize Privacy Policy

This document covers the iQuantize app and its sync backend. If you are just browsing this website, see the Website Privacy Policy and the Website Terms of Use.

Last updated: November 8, 2026

This Privacy Policy explains how IQuantize collects, uses, stores, and deletes information when you use the IQuantize app and related backend services. The app and its backend services are provided by Relato Garrido - Unipessoal Lda ("IQuantize"), VAT PT516683152, Rua das Palmeiras, Lote 5, 244, Quinta da Marinha, 2750-005 Cascais, Lisboa, Portugal, which is the controller responsible for the processing described in this policy. If the student is under the age of majority, a parent or guardian should review this policy and accept the startup agreement for the student.

1. When Sync Starts

The app shows a startup agreement with links to the EULA and this Privacy Policy before account-backed sync begins. The app does not register, fetch a server token, or upload synced rows until the agreement is accepted.

After acceptance, the app creates a guest account-backed sync identity and sync runs automatically when a network connection is available. No name, email address, username, or password is required for guest sync. In the iPad app you may optionally enter an email address and ask IQuantize to confirm it. A name and email address are required to start a website-billed Pro subscription. Email verification is optional for the initial Stripe Checkout and is required to create or join the durable web account used for browser access and recovery across installations. Practice data is stored locally first. Core local practice features remain available without a network connection, while sync, remote content, account verification, deletion confirmation, and cross-installation entitlement continuity require connectivity. Queued changes sync later.

2. Information We Collect

We collect information needed to operate the app, keep progress consistent, support teacher/student features, diagnose problems, and improve the learning experience.

Account and Installation Data

We collect backend user IDs, public codes, installation IDs, setup IDs, local database IDs, profile type, optional display name, platform, app version, build number, operating system version, coarse device model, registration status, and timestamps. The app records on the device which version of the startup agreement was accepted and when; that record is not sent to our servers. When you start website billing or request account recovery, the app stores the name and email address you entered locally and sends them with the authenticated request. The backend stores the unverified name and normalized email as a pending account claim so it can deliver confirmation, support resend or correction, and recover an eligible paid purchase after reinstall. A pending claim does not by itself create account membership or grant Pro. After verification and same-installation completion, we store the name and verified email address, account and installation membership IDs, and verification timestamps. We also store bounded linked-installation metadata, such as platform, coarse device model, app version, and last-seen time, so the account holder can identify, unlink, or revoke an installation. Personal Pro allows up to three active installations and up to five counted new-installation links in a rolling 30-day period. The first account installation is not counted as a new link. We record successful links, removals, revocations, limit denials, and audited support-recovery overrides so we can enforce those limits, notify the account holder, and review suspicious device churn. We retain first-seen and last-seen app-version history per installation and use local database IDs to identify reinstall or database-recreation attempts without hardware fingerprinting.

When you ask the iPad app to confirm an email address, the app sends that email address, and the name you entered if any, with the authenticated installation request. The backend stores them as a contact-email claim owned by that installation and sends a single-use confirmation link so IQuantize can confirm the address and send service email about the student's installation. Confirming the link marks the address as confirmed for that installation only; it does not create a web account, browser session, account membership, or purchase, and it does not grant Pro. Entering a different address replaces the earlier one. Like other email links, confirmation records the IP address and a bounded user-agent string of the browser that opened it. We do not send marketing email to this address unless you have separately agreed to receive it.

For first-party product analytics, the app also creates a random app-device ID independently of the installation and local database IDs. It stores this value in nonsynchronizing Keychain storage (device-only on iOS and the user Keychain on macOS) and sends it with registration and authenticated device metadata after the startup agreement is accepted. It helps us count active devices and distinguish repeated installations from additional devices. It is not derived from hardware, an Apple Account, IP address, or device fingerprint, and cannot sign you in or recover an account. Recreating the app database or reinstalling can preserve the value while that Keychain item survives; clearing the item changes it. On macOS it is scoped to the operating-system user, so it is not a guaranteed count of physical computers. A macOS backup, migration, or clone can carry the same ID to another Mac and combine their analytics; a new operating-system user or cleared Keychain can split one Mac into separate IDs. An installation's existing practice history may be grouped under its first reported app-device ID. Older installations that never report it remain unidentified.

Account Authentication and Billing Data

For purchase confirmation, email verification, passwordless sign-in, installation recovery, linked-installation use, and account security actions, we record bounded request, delivery, retry, confirmation, expiry, consumption, and security-event state. Delivery jobs store the destination email, timestamps, attempt state, and limited failure information needed to retry delivery; mail-provider response bodies are not retained. A successful installation link queues an email to the verified account with the coarse model/platform, link time, and a fixed Account Management link so the holder can review or revoke it.

When an authenticated installation is used, an email link is confirmed, or a browser account session is used, we record the IP address and a bounded user-agent string for security, abuse prevention, and session operation. For linked-installation use, we aggregate these data into at most one updated record per installation per hour. We also create a pseudonymous keyed correlation code from a coarse network prefix (IPv4 `/24` or IPv6 `/56`) and normalized browser/platform family. This code helps support correlate recent origins without storing an additional hardware identifier. It does not identify a person, and IP addresses, shared networks, VPNs, proxies, and user-agent spoofing can make it inaccurate. We do not use an IP address, user-agent, or this correlation code by itself to deny access automatically. We also compare the IP address of an app registration with the current address of IQuantize's own network. An installation that registers from that network is treated as our own and stays out of product statistics until corrected; that mark is stored, the address is not stored for this purpose. We do not collect serial numbers, MAC addresses, Apple Account identifiers, canvas/font/audio probes, or similar covert fingerprint inputs for this purpose.

Single-use email-link, same-installation completion, and browser-session secrets are random values; the backend stores one-way hashes rather than the usable secrets. Opening a confirmation link proves control of the mailbox, not the identity of the human who clicked it, and creates a browser account session. The requesting installation is attached only after that installation presents the separate short-lived completion secret with its existing bearer. Browser account sessions last up to 120 days. We use a separate anti-forgery value and may require a new email link before a payment or security-sensitive action.

Website payments are hosted and processed by Stripe. IQuantize stores a Stripe customer reference and the minimum subscription status needed to grant Pro, such as plan, active status, current period end, cancellation-at-period-end state, and last verification time. For an installation without a verified account, IQuantize may send the entered display name when creating the Stripe customer but does not set the unverified app-entered email; Stripe Checkout collects the authoritative billing email. A verified account's name and email may be used for its Stripe customer. IQuantize does not receive or store full card numbers. Stripe collects the billing name, email, address, country, tax information, and payment details required for Checkout and the Billing Portal, and makes invoices and receipts available there.

IQuantize also reads Stripe's subscription events to keep a subscription history: each subscription start, scheduled or withdrawn cancellation, end, failed payment, and refund, with the plan, subscription status, Stripe event times, refund amount and currency, and any cancellation reason, feedback choice, and optional free-text comment you give in Stripe's cancellation form. We use this history to understand why subscriptions end and to improve the product.

The website macOS build lets you redeem an IQuantize Pro code. To bind a code to one person, we store the email address you enter with it in normalized form (trimmed and lowercased), the backend user that first redeemed it, and its redemption, expiry, and later restore times. Redeeming the same code with the same email on another installation restores the same Pro period without extending it; the code cannot be used with a different email. We do not send email to this address or verify it, and neither the code nor the email is included in analytics.

Practice and Progress Data

We collect practice attempts and progress data, including song or groove references, attempt start/end times with your device's time zone, duration, completion state, tempo, combined accuracy, matched/missed/extra counts, per-bar metrics, per-axis metrics, timing error metrics, velocity metrics, weak-bar training references, skill checkup results, learning plans, and current per-song practice state.

For each practice take, the app also uploads two stored files, separately from the structured practice rows. A performance evidence document is a compressed record of how the take was scored. A MIDI input capture is a compressed recording of the MIDI events the app received during the take. Both files are stored on our backend servers, are linked to your account, and are kept as part of your practice history until the account is deleted. Deletion of the account removes them as described under Retention and Account and Data Deletion.

Settings and Library State

We collect latest app settings, practice preferences, calibration settings, MIDI pad maps, MIDI threshold settings, favorites, tombstones, content import/cache state, remote catalog cursor state, and library visibility state.

Hardware and Environment Data

We collect a redacted latest hardware configuration and capability summary, including MIDI source count, channel mask, velocity floor, calibration status, app session reference, and timestamps. We do not collect serial numbers, MAC addresses, Apple ID subjects, push tokens, or exact persistent hardware identifiers.

Analytics and Diagnostics

We collect app analytics sessions and events such as app session start/end, screen names, practice started/completed/stopped events, subject references, event sequence, and redacted event properties. This includes categorical billing-funnel interactions such as showing or dismissing a paywall, selecting an upgrade, requesting or opening checkout, returning from Stripe, opening subscription management, redeeming a Pro code, and the app later observing Pro starting or ending. A Pro change records its billing source (Stripe, App Store, or code) and, when Pro ends, a coarse reason category (cancelled, refunded, payment failed, or unknown). These client-observed events do not include card details, receipts, Stripe customer/session identifiers, checkout URLs, Pro codes, names, or email addresses. They are used for app functionality, diagnostics, analytics, and product improvement inside IQuantize.

Analytics events also describe how setup and practice go, so we can see where students get stuck. They include the steps of first-time kit setup and the buttons used there; whether you reported hearing the test click; calibration starts, results, and abandoned runs; the first MIDI note received in a session and MIDI notes that lit no pad (note and channel numbers only); the category of the audio output in use, such as built-in speakers, wired headphones, Bluetooth, or a USB interface; and the MIDI sources the system shows, with each source's connection type (USB, Bluetooth, network, or virtual), whether it is online, its driver identifier, and, for USB devices only, the manufacturer and model the device reports. We do not record device names, because you may have chosen them. They also include which settings changed, with new values only for settings that identify nothing, such as click volume or display options; when a setting could not be saved, which settings it was and the error's category and number, never the error text; whether profile fields changed, never what you typed; Library browsing, such as sections, sort, skill filters, favorites, collections, the list position of an opened groove, and the length and result count of a search in ranges, never the search text; your device's language, region setting, time zone name (such as Europe/Lisbon), and offset from UTC; how long the app stayed open and in the foreground; whether the previous app session ended without closing normally; and, in the macOS app downloaded from iqtz.app, whether an update was offered, its version, and whether you chose to install, skip, or postpone it. Our team also receives a daily summary of app use with counts of students, minutes played, device models, and drum kit models; it carries no identifiers but can describe very few students.

macOS Update Checks

The macOS app downloaded directly from iqtz.app installs its own updates, so it asks iqtz.app for an update feed. It sends that request when you choose Check for Updates and, if you allow automatic checking when the app first asks, whenever you open the app and about once a day while it remains open. The request carries your IP address, the app version and build number, and the macOS version. It carries no device identifier, no account, installation, or setup identifier, and no practice data, and the website cannot link it to an IQuantize account. The website's server access log keeps these requests for up to 30 days. We use them to deliver updates and keep that service working, and they are included in the aggregate, non-identifying download and update counts described under Marketing and Usage Measurement; we never use them for advertising or to track an individual. The App Store version of the app does not check for updates this way; Apple delivers its updates.

Server Access Logs

When the app or a browser contacts our backend at cnc.iqtz.app, the web server records a standard access-log entry: IP address, date and time, requested path, response status, user-agent string, and referring page. Cookies, authorization headers, and sign-in secrets are removed before the entry is written. These logs are retained for up to 30 days and are used to operate and secure the Service, investigate abuse and errors, and produce the aggregate measurements described below.

Marketing and Usage Measurement

We measure, in aggregate, how people find and start using IQuantize so we can decide where to spend on marketing and which parts of the product to improve. This measurement uses only first-party data described in this policy:

The resulting statistics are aggregate and do not identify you; we may keep them for as long as they remain useful. We do not use this measurement to build a profile of you, make decisions about you, or show you advertising. We do not use third-party advertising or attribution SDKs, Apple's advertising identifier (IDFA), cross-app tracking, or advertising networks, and we do not sell personal data or share it for cross-context behavioral advertising. We do not send you marketing email unless you have separately agreed to receive it, and every such email would contain an unsubscribe link. You may object to this measurement at any time by emailing privacy@iqtz.app; see Your Choices and Privacy Rights.

Teacher and Student Linking

Teacher/student linking is not available in the current release. The backend is capable of storing link requests, accepted/revoked link state, student public codes, teacher/student user identifiers, and teacher-visible progress summaries for controlled testing or a later enabled release. Automatic sync does not grant teacher access, and progress reads require an accepted link.

3. How We Use Information

We use collected information to:

We do not use collected data for third-party advertising or tracking.

4. Legal Bases

Where data-protection law requires a legal basis, IQuantize processes data needed to create and operate the guest or verified Pro account, deliver sync, provide and administer a requested subscription, preserve progress, provide requested features, and perform account deletion because that processing is necessary to provide the Service under the EULA. IQuantize processes limited IP address, user-agent, security, fraud-prevention, reliability, diagnostic, and product-improvement data where necessary for its legitimate interests in keeping the Service secure and reliable, preventing fraud and abuse, diagnosing problems, and improving the product, and where those interests are not overridden by the user's rights. The aggregate marketing and usage measurement described above relies on our legitimate interest in understanding, in aggregate and without profiling individuals, how our product and marketing perform; you may object to it at any time. The website analytics choice that enables the download-to-registration estimate is consent given by the website visitor and is described in the Website Privacy Policy. Payment, tax, invoice, and accounting records may also be processed to comply with legal obligations. Where consent is the required legal basis, IQuantize will request it separately, and it may be withdrawn without affecting processing already performed lawfully.

5. Linked Data

Synced data is linked to a guest backend account and installation because the Service needs stable identities to store progress, settings, teacher links, and account-deletion requests. A verified Pro account can link several installation-backed users to one email and Stripe entitlement without merging their practice histories. App Store privacy answers and privacy manifests treat these sync payloads as linked to the user.

6. Retention

Account-backed product projections, including practice attempts, progress, skill checkup results, learning plans, settings, MIDI maps, favorites, current library state, analytics, installation version history, and database-incarnation history, are retained until the account is deleted. Latest-value rows are replaced as newer values arrive except for the disclosed version and incarnation histories. Practice takes (with their performance evidence documents and MIDI input captures), plan item attempts, skill checkup runs, and profile snapshots are never removed on a schedule; they are kept until the account is deleted.

Verified account name, email, installation memberships, linked-installation metadata, and current billing references are retained while the account exists. Installation-link security events, minimal account-only rolling-limit entries, support-override records, hourly linked-installation usage-origin records, and browser-session origin metadata containing IP address, user-agent, or the pseudonymous correlation code are scheduled for deletion or clearing after 30 days. A link event keeps the bounded model and platform that were shown during linking so a queued owner notice and account-level churn evidence can still be delivered or reviewed if only that local installation is unlinked and deleted before email delivery. A rolling-limit entry contains only the account reference, internal link-source kind and row number, and time; it does not contain email, network, device, or practice data. These account-security records can remain after deletion of an already-unlinked local installation so that deleting that installation does not suppress the owner notice or reset the account security limit, and they are deleted with the verified account. The browser session itself may remain active after its older origin metadata is cleared. Superseded or canceled pending claims and dead delivery jobs are also scheduled for deletion after 30 days. A confirmed iPad contact email is retained with its installation until it is replaced or the installation is deleted; a replaced contact email follows the same 30-day rule as other superseded claims. A pending claim associated with a recoverable paid purchase may be retained while recovery or a billing-ownership conflict remains unresolved. Expired or consumed email-link records are scheduled for deletion after they have been inactive for more than 1 day; expired same-installation completion records follow the same short-lived retention policy. Expired or revoked web-session records are scheduled for deletion after 7 days. An active browser session expires after 120 days unless it is revoked earlier. Stripe and IQuantize may retain transaction, invoice, tax, refund, and accounting records for the period required by applicable law or dispute handling.

A redeemed Pro code keeps its email and user link while the code record exists, so the same email can restore its Pro period. Subscription history is kept while the account or installation exists. When an account or installation is deleted, we remove the email and user link from every Pro code it redeemed or that is bound to the deleted verified account's email; the code stays marked as used. We also remove the account and user link, the Stripe customer and subscription identifiers, and the free-text cancellation comment from its subscription history, and replace the Stripe event reference with a one-way hash that is itself replaced with a random identifier within 31 days, once Stripe no longer lists the event. What remains is a churn record of plan, provider, event type and times, status, refund amount, and categorical cancellation reason and feedback (with the reason recorded as account deletion when the deletion cancelled the subscription). It is no longer linked to you or your account and may be kept without a fixed limit for business reporting.

**Retained Aggregates.** We compute frozen daily aggregate statistics about how the app is used. Examples are the number of active users, practice takes, completed takes, and practice minutes per day and platform; the number of takes, completions, and passes for a groove or lesson per day and coarse student-level band; the number of users from a given sign-up week who are still active; and the number of users who reach each step of the sign-up and subscription funnel. These aggregates contain no user ID, installation ID, account reference, email address, IP address, device identifier, or other per-user identifier. Any figure that would describe fewer than 5 distinct users is suppressed and is not reported. Once an aggregate is written, it is not recalculated or removed when an account is deleted, so aggregates survive deletion of your account and may be kept without a fixed limit. Because they contain no identifier, we cannot find or remove one person's contribution to them, and deleting your account does not remove you from aggregates already produced. They are not personal data, and we do not use them to build a profile of you or to make decisions about you.

**Backups.** We keep backups of our database and stored files for 30 days. Data removed by account deletion disappears from live systems as described under Account and Data Deletion and is erased from backups when those backups expire, within 30 days after the deletion.

Operational records use shorter limits:

Successful account deletion removes the deleted installations and their app-device mappings on the server and clears the local app-device ID before creating fresh local state. It does not recover or combine the deleted account through that ID.

After account deletion, the Service keeps a one-way fingerprint of the deletion request token for up to 7 days so a retry can confirm that a request whose response was lost already succeeded. This receipt is not linked to a user or device and contains no synced payload. Non-identifying operational event counts and aggregate data-flow totals may remain after account-linked rows are removed.

Records required by law may be retained only for the period the law requires.

7. Sharing

We do not sell personal data or share it with third-party advertising networks. The current release does not expose teacher/student linking. If linking is enabled in a later release, teacher-visible progress will be shared only for an accepted link.

We use these service providers:

Stripe, Apple, and (for website analytics) Google decide for themselves how they process data within their own services and are responsible for that processing. Questions or requests about it, such as access to Apple purchase records, Stripe payment data, or Google Analytics data, should be sent to them; we will forward a request we receive by mistake where we reasonably can, but we cannot act on data that only they hold.

IQuantize requires service providers that process user data on its behalf to provide the same or equivalent protection described in this policy and applicable law, and may disclose data where required by law or to protect the rights and safety of users and the Service.

International Transfers

Because our servers are in the United States, and some providers operate in other countries, your data is transferred outside the European Economic Area, the United Kingdom, and Switzerland. Where the destination does not have an adequacy decision, we rely on the safeguards provided for by data protection law, such as the European Commission's Standard Contractual Clauses (and the UK and Swiss equivalents) in our providers' data processing terms, or a provider's certification under the EU-US Data Privacy Framework where applicable. You can request more information about these safeguards, or a copy of them, by emailing privacy@iqtz.app.

8. Security

Server tokens are stored in Keychain on Apple platforms and are bound to one backend installation. Web account authentication uses a Secure, HttpOnly browser cookie rather than browser local storage; usable email-link, installation-completion, and session secrets are not stored in the database. Account-changing forms use origin and anti-forgery checks, and payment details remain on Stripe-hosted pages. ImprovMX delivery requires authenticated STARTTLS. Sync payloads are allowlist-redacted before upload. Removing Pro from one Mac removes only its account membership; revoking an installation additionally invalidates its server token while preserving the other linked installations. The app is designed to keep local practice working if sync is paused, offline, or unavailable.

9. Children and Guardians

IQuantize is designed for student learners and may be used by minors with parent or guardian support. A parent or guardian should accept the startup agreement for a minor student and may delete the student's guest account-backed data in the app. A child below the age at which they can consent to online services in their country (between 13 and 16 in the European Union; 13 in Portugal and the United States) must use the app only with a parent's or guardian's agreement, and a parent or guardian must start any paid subscription. We do not knowingly collect personal data from a child without that involvement, and we do not use children's data for marketing measurement beyond the aggregate counts described above. A parent or guardian who believes we hold such data can ask us to delete it at privacy@iqtz.app.

10. Your Choices and Privacy Rights

You may stop using the app at any time. Account-backed collection begins only after startup agreement acceptance. Teacher/student linking is not available in the current release. If a release kill switch or backend policy pauses sync, local practice data remains on the device and pending rows are not deleted solely because sync is paused.

You can update the name on a verified account and manage payment information, cancellation, invoices, and receipts through Stripe's hosted Billing Portal. The verified email is the account identifier and cannot be edited; contact support if it must be replaced. You can review the personal account's linked installations, remove Pro from one without deleting its independent practice history, revoke an installation so its existing server token can no longer be used, sign out one browser, or, after recent email authentication, sign out all browsers. If a legitimate recovery reaches the rolling new-link limit, support can review the opaque denial reference and may grant one target-bound attempt; support cannot override the three-active-installation limit.

**Right to object.** You may object at any time to processing based on our legitimate interests, including the aggregate marketing and usage measurement described above; we will stop unless we have compelling legitimate grounds or need the data for legal claims.

Depending on where you live, you may also ask to access, correct, delete, or receive a portable copy of personal data, and you may object to or restrict certain processing. Where processing relies on consent, you may withdraw consent at any time without affecting earlier lawful processing. We do not make decisions about you based solely on automated processing that have legal or similarly significant effects. You may also complain to a data protection authority. Our lead authority is the Portuguese Comissão Nacional de Proteção de Dados (CNPD, www.cnpd.pt), and you may also contact the authority where you live or work. Email privacy@iqtz.app to exercise a privacy right; we answer within one month, which may be extended where the law allows. We may ask for information that confirms your identity or your connection to the installation or account concerned, and we act only on data we hold. Where the law allows, we may refuse, or charge a reasonable fee for, a request that is manifestly unfounded or excessive, for example because it is repetitive, and we will explain why. IQuantize may need to verify the request before acting and may retain or continue processing data where applicable law permits or requires it.

11. Account and Data Deletion

Start deletion in Settings > About > Delete Account. Deleting an installation that is not part of a verified account also deletes its contact email and confirmation records. A verified paid account shared by multiple installations requires a fresh email sign-in and explicit whole-account confirmation at cnc.iqtz.app; an installation credential alone cannot delete every linked device. Deletion expires open Checkout sessions, cancels non-terminal Stripe subscriptions, and then removes the verified account, its installation memberships, browser sessions, backend identifiers, installation records, synced practice/progress, settings, hardware snapshots, analytics, library/cache state, and teacher/student links as one customer account. If Stripe cancellation fails, deletion stops so the subscription is not orphaned. Returning to each linked app within 7 days completes its local practice-data purge and resets it to a fresh local identity; after that confirmation window, contact privacy@iqtz.app for help completing the local purge. Deletion also removes the account's performance evidence documents and MIDI input captures: they are queued for deletion and removed from our storage by a background process, and copies in backups are erased within 30 days as described under Retention. Bundled or downloaded lesson content that is not account data remains available. Stripe or IQuantize may retain legally required transaction and invoice records. The Retained Aggregates described under Retention are not deleted, because they contain no per-user identifier and are suppressed below 5 users. Deletion also removes the email and user link from redeemed Pro codes and the identifying parts of subscription history, keeping only the unlinked churn record described in Retention. A nonidentifying deletion receipt may be retained for up to 7 days as described above.

Email privacy@iqtz.app for privacy questions or help with deletion.

12. Changes

We may update this Privacy Policy as the app and Service change. The date above shows the current version. We will tell you about material changes in the app before they take effect, and material legal changes may require renewed acceptance before account-backed sync continues.

13. Contact

For privacy questions or help, contact privacy@iqtz.app, or write to Relato Garrido - Unipessoal Lda, Rua das Palmeiras, Lote 5, 244, Quinta da Marinha, 2750-005 Cascais, Lisboa, Portugal.

Requires an electronic drum kit or MIDI drum module.