1. Home
2. Legal
3. iQuantize Website Privacy Policy

iQuantize Website Privacy Policy

This policy covers visitors of the iqtz.app website. The iQuantize app and its sync backend are covered by the App Privacy Policy.

Last updated: November 8, 2026

This policy explains what information is processed when you visit the iqtz.app website, including the optional aggregate download-to-registration estimate described below. Use of the iQuantize app and its sync backend is covered by the separate IQuantize Privacy Policy, available at iqtz.app/privacy-policy/ and inside the app. Practicing in the app or acknowledging its privacy policy does not give consent to website analytics.

1. Who Is Responsible

The iqtz.app website is operated by Relato Garrido - Unipessoal Lda ("iQuantize"), the maker of the iQuantize drum-practice app, VAT PT516683152, Rua das Palmeiras, Lote 5, 244, Quinta da Marinha, 2750-005 Cascais, Lisboa, Portugal. Relato Garrido - Unipessoal Lda is the controller responsible for the processing described in this policy. For any privacy question or request about this website, contact privacy@iqtz.app.

2. What We Process When You Browse

This is a static website. You can browse it without creating an account, logging in, or entering any personal information.

When you request a page, the web server that hosts iqtz.app processes technical data that your browser sends automatically:

• the IP address of your device;
• the date and time of the request and the requested URL;
• browser type and version, operating system, and the referring page.

This data appears in standard server access logs and is used to deliver pages, keep the site secure, prevent abuse, diagnose technical problems, and produce aggregate visitor statistics — for example how many people read a page, which sites link to us, and which search-engine and AI crawlers index us. Access logs are retained for at most 30 days and then deleted.

The aggregate statistics we keep beyond that contain no IP addresses. To count visitors without identifying them, an address is converted into a one-way code that changes every day; a separate daily code combines the address with the browser type. These daily codes do not link the same visitor across days. We use declared crawler identifiers, vendor-domain checks where available, conservative request-pattern indicators, checks that the request headers a browser sends agree with the browser type it declares, and whether a page was actually displayed — every page's stylesheet asks for one tiny same-origin resource that is never cached and carries nothing beyond the request data above — to separate known or suspected automation from browser-like traffic. Those indicators are probabilistic and are not used to identify a person. We do not use server logs to build visitor profiles.

We also keep daily counts of how visits begin: the page where a visit entered the site, together with the host name of the referring site, the referring Android app's package name, or the campaign tags in links we publish (`utm_source` and `utm_campaign`). Campaign tags are kept only as short lowercase labels; any other tag value is recorded only as "invalid". These counts contain no IP address, no daily code, and no address of the referring page beyond its host name.

After you answer the analytics choice, the site sends a same-origin, cookieless page event containing the page path, whether the answer was granted or denied, the consent-choice version, and the external referring page without its query or fragment or, when an Android app opened the page, only that app's package name (for example `com.reddit.frontpage`). Changing a current accepted choice to Decline also sends a withdrawal signal; an initial declined choice does not. The path is accepted only when it matches a successful HTML page in the server's retained logs. This corrects for pages served from browser cache and lets us keep approximate, aggregate same-day page-to-page transition counts based on the rotating address-and-browser code. Shared networks and concurrent tabs can interleave those transitions; they are not treated as a proven individual journey, and no cross-day visitor identifier is stored.

If you click a Download button, the site records that a click happened, which allowlisted destination it was for, which server-observed page it came from, and the analytics-consent state. The page event, this click record and the landing-page events described below also carry a single flag when, and only when, the browser itself reports that it is under automated or headless control (for example the standard WebDriver signal); it contains no other information about the browser and is used only to keep automated traffic out of the aggregate statistics. For a direct Mac download it also records a tagged request that starts transfer of the DMG or ZIP. The server separately counts every successful DMG or ZIP request, including untagged updater and automated traffic, so that traffic can be audited without treating it as a human conversion. A transfer start is not proof that the file finished downloading, was installed, or was opened. These are first-party counts only and set no cookie.

When you arrive on one of our Google Ads landing pages from an ad, the link carries numeric identifiers of the ad campaign, ad group, ad and keyword, plus one letter for the keyword match type and one for the device type. The site's first-party counter reads only these numbers and letters, never the search text, the keyword text or Google's click identifier, and adds them to the Download button and landing-page events from that page view. On a landing page it also records which way the visit continued: the "Learn more" link, a header menu item from a fixed list, any other link (recorded only as "other"), or leaving before any click, with the time the page was visible in coarse ranges; if you return to a landing page you had switched away from, a further event cancels that "leaving". These landing-page events are sent whether or not you have answered the analytics choice: they set no cookie, store nothing in your browser, and carry no visitor identifier and no consent state. If you accept analytics, the identifiers and the landing page address can stay in this browser tab for up to 30 minutes so that a later Download click still names its ad group and landing page. We keep only daily aggregate counts by these identifiers. Like every request, the address of the landing page you arrive at, including the ad link's identifiers and Google's click identifier (`gclid`) when Google adds one, is also kept in the server access logs described above for at most 30 days, and later requests from that page can repeat it as their referring page; the counter does not read the click identifier there either.

The website operator can exclude exact addresses it owns, such as an office or home address. The dashboard immediately converts such an address into a keyed one-way digest and never stores or redisplays the raw address. Retained access-log days are recomputed after an exclusion is added. This cannot remove historical information already processed by Google Analytics.

If you accept analytics, we also keep a coarse acquisition-source category in this browser tab for up to 30 minutes. It is selected from a fixed list of search engines, social platforms, email, direct, and other traffic, using the referring host or an allowlisted `utm_source` value. Page events, Download button events and tagged transfer requests carry this category. We retain only daily aggregate counts by category; arbitrary campaign text and a stable visitor or download identifier are not stored. Declining analytics clears the tab entry and stops sending the category. Existing website aggregates may still be compared with app registration totals; they are not retroactively linked to individual app installations.

2a. Optional Aggregate Download-to-Registration Estimate

Accepting the current analytics choice (version 4, and version 3 before it) also permits an approximate estimate of whether Mac downloads are followed by first app registrations from the same network within 6 hours. Earlier analytics choices do not cover this purpose, so we ask again. Declining or leaving the choice unanswered does not affect browsing or downloading.

Only successful Mac DMG or ZIP transfer requests explicitly tagged with a granted version-3 or version-4 choice enter this estimate. A short-lived group combines repeated requests for the same artifact with the same reported browser type and network within 30 minutes, including retries and partial transfers. The estimate compares those groups with existing first-registration observations in server access logs, looking forward for 6 hours from the transfer. Neither a transfer start nor this comparison proves an installation, a completed download, or that a particular person registered.

On the app side, the comparison uses the network address that our backend server log records when an app installation first registers; the IQuantize Privacy Policy describes that processing for app users. During each processing pass, network addresses are compared using HMAC codes held only in memory and keyed with a fresh random key for that pass. The key and codes are discarded after processing. The new attribution tables retain only daily counts by coarse source: probable, ambiguous, unmatched, or canceled. They do not retain raw IP addresses, address hashes, user identifiers, installation identifiers, or a durable visitor profile. This does not change the existing operational access-log retention described above.

Shared networks, NAT, VPNs, and Apple's Private Relay can make different people appear to share an address or make one person's address change. These conditions can create false matches, ambiguous results, or missed matches. Counts therefore describe probable network-level outcomes, not individual download or installation histories.

Choosing Decline in Cookie settings immediately stops future consented tagging and source collection in that browser tab. Its withdrawal signal conservatively cancels downloads from the current network that are still awaiting a final result within the 6-hour matching window. This can also cancel another consenting visitor's pending download on a shared network. If your network changed, earlier downloads from the previous network may no longer be recognizable as yours. Completed anonymous aggregates cannot be reversed for one individual, and we do not keep an identifier to enable that reversal.

3. Cookies

This website sets no cookies unless you accept analytics.

The first time you visit, and when a materially different analytics purpose needs a new choice, we ask whether you consent to analytics. Your answer is kept in your browser's local storage under a versioned key. That entry holds nothing but the word "granted" or "denied" and is not a cookie. The state is sent to iqtz.app with the first-party aggregate page and Download button events described in section 2; it is sent to Google only when it is "granted" and Google Analytics is loaded.

If you accept, Google Analytics sets cookies in your browser, named `_ga` and `_ga_` followed by an identifier, which let it recognize a returning browser and group requests into a single visit. They expire after up to two years. Google may also set an ad-measurement cookie named `_gcl_au` on any page and, if you arrived from one of our Google ads, cookies named `_gcl_aw` and `_gac_` followed by an identifier, and keep a similar `_gcl_ls` entry in local storage; they store the ad click so a later Download click can be counted for that ad, and expire after up to 90 days. If you decline, or simply never answer, no analytics cookie is set, Google Analytics is not loaded, and no consented download-to-registration tag is added. The first-party aggregate scripts described in section 2 still run.

You can change your answer at any time through the "Cookie settings" control at the bottom of any page. Choosing Decline there stops further optional analytics collection and deletes the analytics and ad-measurement cookies and local-storage entries already stored in your browser. The pending network-estimate cancellation and its limits are described in section 2a; ordinary aggregate server-side counts continue.

4. Analytics

With your consent, this website uses Google Analytics 4, a service provided by Google Ireland Limited, to count visits and understand which pages are actually useful to drummers. With the same consent, Google Analytics and Google Ads measure whether visits from our own Google ads lead to Download clicks (conversion measurement).

Consent comes first, technically and not just as a promise: the pages we serve contain no Google code and no reference to any Google address. The Google Analytics script is fetched only after you press Accept and after iqtz.app confirms that the current address is not on the operator's exclusion list. If you decline, never answer, or use an excluded address, this website makes no analytics request to Google.

When analytics is active, Google processes your IP address, the pages you view, an approximate location derived from that IP address, and technical details such as device type, browser, screen size, language, and the page that referred you. Google Analytics 4 does not retain your IP address, and we do not use analytics to build profiles of individual visitors or to identify you. For conversion measurement we grant Google's ad storage and ad user data consent signals only after you accept; ad personalization stays denied. We do not use remarketing, personalized advertising or Google Signals, and we do not sell your data.

Google may process this data on servers outside your country, including in the United States, relying on the European Commission's Standard Contractual Clauses and on its certification under the EU-US Data Privacy Framework.

If your browser sends a Global Privacy Control signal, we treat that as a declined answer and do not ask again unless you open "Cookie settings" yourself.

Everything else on this website — fonts, scripts, images, and sounds — is served from iqtz.app itself and involves no third party.

5. Contacting Us

If you email support@iqtz.app or privacy@iqtz.app, we process your email address and the content of your message in order to answer you. We keep this correspondence for up to 24 months after the last message in that conversation, or longer where the law requires it.

6. Legal Bases

Where the EU or UK General Data Protection Regulation applies, we process server-log and security data — including the ordinary aggregate visitor statistics described in section 2 — based on our legitimate interest in operating, protecting, and understanding the use of the website, and correspondence data in order to answer the request you sent us. Google Analytics, Google Ads conversion measurement and the optional download-to-registration estimate in section 2a are processed on the basis of the current analytics consent. We ask before Google Analytics is loaded or a download is tagged for this estimate. Declining leaves the ordinary aggregate server-side counts described in section 2 in place; they set no cookie and are not intended to identify you. You may withdraw that consent at any time through "Cookie settings" at the bottom of any page, without affecting the lawfulness of processing carried out before you withdrew it.

7. Sharing and International Transfers

We do not sell personal information and do not share it for third-party advertising. The website is hosted by Hostinger International Ltd on servers located in the United States; Hostinger processes the technical data described above only to host, secure, and operate the website. Emails to iqtz.app addresses are received and forwarded by ImprovMX. If you consented to analytics, Google also processes the data described in section 4 for those purposes alone: analytics and measuring our own ads.

Because the server is in the United States, server-log data is transferred outside the European Economic Area, the United Kingdom, and Switzerland. For these transfers we rely on the safeguards provided for by data protection law, such as the European Commission's Standard Contractual Clauses (and the UK and Swiss equivalents) in our providers' data processing terms, or a provider's certification under the EU-US Data Privacy Framework where applicable. You can request more information about these safeguards at privacy@iqtz.app. Google decides how it processes Google Analytics data and is responsible for that processing; requests about data held only by Google should be sent to Google.

8. US State Privacy Rights

We do not sell or share personal information as defined by the California Consumer Privacy Act and similar US state laws, and we do not use it for targeted advertising or profiling. Global Privacy Control is honored as a declined analytics choice as described in section 4. You may exercise access and deletion rights by emailing privacy@iqtz.app.

9. Your Rights

Depending on where you live, you may ask to access, correct, delete, or receive a copy of personal data, and you may object to or restrict certain processing. You may object at any time to processing based on our legitimate interests, including the aggregate visitor statistics in section 2. Email privacy@iqtz.app to exercise a right; we may need to verify the request before acting and answer within one month, which may be extended where the law allows. Because the aggregate statistics described above contain no identifier, we usually cannot find or act on them for one visitor. Aggregate statistics about use of the iQuantize app are described in the IQuantize Privacy Policy: they contain no per-user identifier, omit any figure covering fewer than 5 distinct users, and survive deletion of an app account. Where the law allows, we may refuse, or charge a reasonable fee for, a request that is manifestly unfounded or excessive. You may also complain to a data protection authority: our lead authority is the Portuguese Comissão Nacional de Proteção de Dados (CNPD, www.cnpd.pt), and you may also contact the authority where you live or work.

10. Children

This website does not knowingly collect personal information from children. Use of the iQuantize app by students, including minors, is covered by the IQuantize Privacy Policy and the app's startup agreement.

11. Changes

We may update this policy as the website changes. The date above shows when it was last revised, and material changes will be visible on this page.

12. Contact

For privacy questions about this website, contact privacy@iqtz.app, or write to Relato Garrido - Unipessoal Lda, Rua das Palmeiras, Lote 5, 244, Quinta da Marinha, 2750-005 Cascais, Lisboa, Portugal.