Last updated: 5 October 2026

Privacy Policy

This policy covers the app “Noa” (listed in the app stores as “NoaIQ”), including its Alpha version on Apple TestFlight, the website noaiq.com and the public profile pages on noaiq.app (in the Alpha on staging.noaiq.app). Under Articles 13 and 14 of the General Data Protection Regulation (GDPR) it explains which personal data we process, for what, on which legal basis, who receives it, how long we keep it and which rights you have. This is a translation for convenience; the German version is authoritative.

1. The short version

• Noa is a wellness app and a game: a workout for your brain, like the gym. Your ratings describe how well you play our games. They are game data, not health data, and we never use them to say anything about your health (section 3).
• An account needs only your email address and a name you choose yourself. There is no password.
• Noa is a social app: your profile with your username and ratings is visible to others by default. You can make your account private at any time (section 5.3).
• No ads, no tracking across other companies' apps or websites, no selling of data.
• You can delete your account in the app at any time: Settings, “Delete account”.

2. Controller and contact

The controller responsible for processing is:

Noa Cognition GbR
Verdistraße 21
67227 Frankenthal (Pfalz)
Germany

Represented by: Timo Klemm, Franz Dieter, Lukas Strickler

Phone: +49 151 53820001
Email: hello@noaiq.com

For any privacy question and to exercise your rights, write to privacy@noaiq.com. We have not appointed a data protection officer.

3. Noa is a game, not a health service

Noa offers games that call for memory, logic, reaction and focus. The games get harder or easier with you. From your games we calculate ratings: one per game, one per category, and the Noa Score as the average of the categories. The Noa Score shows how well you do in Noa's games; it runs from 400 to 1,400 (shown as at most 1,399), starts at 400 for everyone and settles to you over about the first seven days on which you play. These numbers work like a chess rating or a rank in an online game: they describe your skill in our games and are used to play, to get better at the games, to compare yourself with friends and to build leaderboards.

Noa is a wellness app and a game, not a medical device and not a health service. The ratings are not a psychological or medical test, and not a statement about your mental or physical health. We do not process your game data for the purpose of drawing conclusions about your health, and we do not draw such conclusions. We do not ask for health data and we do not combine your game data with health data from other sources. We do not use your age to calculate or rank your ratings, and we compare you with no age-based or clinical norms, only with other Noa players. The ratings are not designed or validated to capture any trait of a person outside these games and are not suited to it: they also depend on practice, device, input and the day's form. No feature of Noa relates ratings to health, age, or medical or scientific norms. Please do not send us health information either, for example in messages to our support; if we receive it anyway, we use it only to handle your request and delete it afterwards.

4. The website noaiq.com

4.1 Serving the website

Our website is delivered through Cloudflare (Cloudflare, Inc., USA). When you visit, Cloudflare processes technically necessary data: your IP address, date and time, the page requested, browser and operating system, and the referring page. This is needed to deliver the site and protect it against attacks. The legal basis is our legitimate interest in secure and stable operation (Art. 6(1)(f) GDPR). Cloudflare keeps these logs only briefly.

4.2 Cookieless audience measurement

To understand how our website is used, we use PostHog (PostHog Inc., USA; stored in the EU, Frankfurt am Main). Measurement runs without cookies and without storing anything on your device. It records pages viewed, time on page, load times, aggregated click positions, technical errors, approximate country, browser, device type and language. You are not recognised across days. The data travels to PostHog through our own address n.noaiq.com. The legal basis is our legitimate interest in improving our website (Art. 6(1)(f) GDPR). You can object at any time (section 12).

4.3 Contact by email

If you write to us, we process your address and your message to answer you. Our email runs on Google Workspace (Google Cloud EMEA Limited, Ireland). The legal basis is the performance of our contract with you (Art. 6(1)(b) GDPR) or, for general enquiries, our legitimate interest in answering them (Art. 6(1)(f) GDPR).

5. The Noa app

5.1 Account and sign-in

You can try Noa without an account. For an account you enter your email address. We send you a six-digit code and a sign-in link; there is no password. We create your account the first time you sign in. We store:

• your email address, when the account was created, and an internal account ID,
• your sign-in sessions with IP address, device and app identifier (user agent) and expiry,
• a delivery log for the sign-in email with recipient, template, time and delivery status. We do not store the email's content, meaning the code and link; only a hash is kept to check them, and code and link expire after 10 minutes.

The legal basis for the account, sign-in and sending is providing your account under our Terms of Use (Art. 6(1)(b) GDPR). We keep IP address and user agent in your sessions so that misuse of your account can be detected. To prevent abuse we also limit how often codes can be requested and entered and how often our interface can be called from one IP address, using IP address and email address for that; the legal basis is our legitimate interest in the security of our service (Art. 6(1)(f) GDPR). Sign-in emails are sent by Scaleway SAS (France) from data centres in Paris. On our websites that offer sign-in we also protect sign-in with Cloudflare Turnstile, which checks that a human is requesting the sign-in; Cloudflare processes technical details about the device and browser and the IP address for this (Art. 6(1)(f) GDPR). The app does not use Turnstile. Our server interfaces at Cloudflare also log requests with IP address, time and the address requested, so that we can detect errors and attacks; these logs are deleted after at most 7 days (Art. 6(1)(f) GDPR).

5.2 Playing, ratings and adaptive training

When you play, we process:

• per round: game, mode, time, points, results and the inputs you make in the game (which tile you tapped and when), together with the round's starting value,
• derived from that: your ratings per game, per category and your Noa Score, their history, your personal bests and your streak (how many days in a row you played).

We use this data to run the game: to calculate points and ratings, to fit the difficulty of your next round to your skill (adaptive training), to show your progress and to keep your account up to date on all your devices. The legal basis is performing our Terms of Use (Art. 6(1)(b) GDPR), because that is exactly the service you use.

We also replay rounds on our server from the inputs to detect manipulation. Results that fail this check count neither for leaderboards nor for your ratings. The legal basis is our legitimate interest in fair leaderboards and ratings (Art. 6(1)(f) GDPR). We delete a round's inputs once they are no longer needed for this check, at the latest three months after the round; the round's result stays part of your game history until you delete your account.

Difficulty and ratings are calculated automatically: from your results a statistical method (similar to chess ratings) estimates which difficulty you master in a game. That is an evaluation of how you play and so profiling within the meaning of Art. 4(4) GDPR. It only decides how hard your next game is and where you stand on a leaderboard, though. It is not an automated decision with legal or similarly significant effect within the meaning of Art. 22 GDPR.

5.3 Profile, friends and leaderboards

Noa is a social app. You choose a username (handle) and a display name; both may be made up. We never show your email address to anyone.

By default your profile is public: other Noa users see your username, display name, your Noa (the character you wear as your avatar), since when you have been a member, your ratings and Noa Score, your streak and your leaderboard positions. Through the link noaiq.app/u/<username> (in the Alpha staging.noaiq.app/u/<username>), anyone who has it can also see your display name, username and Noa, without ratings. The page asks search engines not to index it.

You decide: in Settings you can make your account private at any time. Then only your friends see your ratings, Noa Score and streak, and on leaderboards you appear without a name. The page behind your link then shows only your username and the default Noa. Anyone signed in to the app who enters your exact username still sees your username, display name, Noa and since when you have been a member, even for a private account, so that you can add each other as friends; feel free to pick a made-up name.

In the Alpha: in the Alpha version, the app's visibility settings do not yet take effect on our server; the app keeps your choice only on your device. The same goes for the one-time question whether your profile should be public, which the app asks the first time you open the leaderboards. What counts is your choice before the invitation: Alpha testers decide beforehand whether their profile should be public or private, and we set it for them. If you want to change it, write to privacy@noaiq.com; we switch your account without undue delay and confirm by email.

Link preview: when the link to your profile is shared, for example in a chat, our server renders a preview image for it with your display name, username and Noa, without ratings and without Noa Score; for a private account it shows only your username and the default Noa. Cloudflare caches the preview image for up to 24 hours and the profile page for up to one minute. Apps and services where the link is shared fetch the page and image and keep them under their own rules. After a name change or after your account was made private, an old preview may therefore stay visible there for a while.

Calculating your ratings and showing them to you and your friends is part of the service under our Terms of Use (Art. 6(1)(b) GDPR). Showing your profile publicly to all users and through the profile page on noaiq.app relies on our legitimate interest in a player community with open leaderboards (Art. 6(1)(f) GDPR). Only a name you choose yourself, which may be made up, and information from the game are public, never your email address. You can change this at any time; making your account private is also your objection under Art. 21 GDPR. We record when you changed your visibility so that we can show that we honour your choice.

5.4 Settings

We store your settings, such as language, vibration and the installed app version, so the app works the same on all your devices (Art. 6(1)(b) GDPR).

5.5 Storage on your device

The app stores on your device only what it needs to work: your sign-in session, game results not yet uploaded, a copy of your last game state for starting without a network, your settings (such as language and sound), which hints you have already seen, the state of today's training, and for at most one hour the email address a code is on its way to. This is strictly necessary to provide the service you asked for (§ 25(2) no. 2 of the German Telecommunications Digital Services Data Protection Act, TDDDG). The Alpha version adds the analytics files, which your consent under section 5.9 covers. When you sign out we delete the account data on the device.

5.6 Crash and error reports

If the app crashes or hits an error, it sends a technical report to Sentry (Functional Software, Inc., USA; stored in the EU, Frankfurt am Main). The report contains the error message, the technical trace, app version, device model and operating system. The app also uses Sentry to measure how long starting a game and showing its result take. Errors on our servers are reported to Sentry as well. We do not send your email address, account ID or name, and automatic sending of personal data is switched off. The legal basis is our legitimate interest in a stable, working app (Art. 6(1)(f) GDPR); keeping a report on the device until it can be sent is strictly necessary for that purpose (§ 25(2) no. 2 TDDDG). Sentry deletes reports automatically, at the latest after 90 days.

5.7 Measuring launch time and performance

The app is built with Expo (650 Industries, Inc., USA). Expo delivers app updates and measures how fast the app starts and loads screens. This sends a random installation identifier, app version, operating system, network type, load times and the device's power and thermal state. We do not link the identifier to your account, and our own app code never reads it. The legal basis is our legitimate interest in delivering updates and offering a fast app (Art. 6(1)(f) GDPR; for keeping the identifier on the device, § 25(2) no. 2 TDDDG, because updates cannot be delivered without it). The transfer to the USA relies on the adequacy decision for the EU-US Data Privacy Framework.

5.8 Alpha testing on Apple TestFlight

We distribute the Alpha of Noa through TestFlight, a service by Apple. Apple (Apple Distribution International Ltd., Ireland) is itself responsible for TestFlight; Apple's TestFlight privacy notice applies. Apple gives us your name and email address from the invitation, information about installing and using the Alpha, crash reports, and feedback and screenshots you send us through TestFlight. We use these to run the Alpha and fix bugs (Art. 6(1)(b) and (f) GDPR).

To organise the Alpha we also keep a list of testers with name, email addresses, invitation status, your consents (date and version of the text), your choice of profile visibility and feedback from conversations with you (Art. 6(1)(b) and (f) GDPR). We keep the proof of your consents for three years after the Alpha ends, because we must be able to show that you consented (Art. 7(1), Art. 6(1)(c) and (f) GDPR). We delete everything else on this list when the Alpha ends.

5.9 Usage analytics and optional screen recording in the Alpha

Only in the Alpha version on TestFlight and only with your consent, we use PostHog (PostHog Inc., USA; stored in the EU, Frankfurt am Main) to record how you use the app: which screens you open, which games you start and finish, your results and taps on controls. We link this data to your account through your account ID, email address and username, so we can match feedback to a person. We never capture codes or sign-in links. The purpose is to find bugs and improve the app. For this, PostHog stores an identifier and data not yet sent on your device. The legal basis is your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG), which you give us when you join the Alpha. Usage analytics is a condition of taking part in the Alpha.

Screen recording is optional and a separate consent. Only if you agree to it separately do we use PostHog to record what is visible on the app's screen while you use it, together with the app's technical logs and metadata about the app's network requests (address, duration, status, no content). You can take part in the Alpha without recording. Recording starts only after you have signed in. While it runs, the app shows the label “Alpha · recording” at the top of the screen. The sign-in screens with your email address and the code are masked in the recording or not in it at all. Anything else visible in the app, such as your email address in Settings, and anything you type into other fields, such as your username or feedback, is visible in the recording. The legal basis is your separate consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG). PostHog deletes recordings after 30 days.

You can withdraw either consent at any time with effect for the future, informally by email to privacy@noaiq.com. If you withdraw only the recording, we switch it off and delete your recordings so far within one month; you stay in the Alpha. If you withdraw usage analytics, we remove you from the Alpha group and delete the analytics data and recordings collected within one month. We confirm either by email. We delete your account only if you ask us to or the Alpha ends. The App Store version of Noa contains neither the usage analytics nor the recording. We delete other analytics data once we no longer need it to improve the app, at the latest three months after the Alpha ends.

5.10 Reporting, blocking and name rules

Blocking: on another person's profile you can block them through “Report or block”. We then store who blocked whom and when. The blocked person is not told. While the block stands, neither of you can find the other or send friend requests; an existing friendship and pending requests between you end. You can lift a block again.

Reporting: when blocking, you can report the person at the same time (“Report and block”). We then store who reported whom and when, the reason you pick from a list, and the reported person's username and display name as they stood at that moment. There is no field for your own text. Only people on our team read reports. We do not tell the reported person who reported them, unless the law requires us to.

Name rules: when you save a username or display name, we check it automatically against word lists and refuse it if it breaks the name rules in our Terms of Use. The check runs in the app and on our server; we pass nothing to third parties for it. If a visible name breaks the rules anyway, for example after a report, a person on our team can reset it. We then store the removed name, the reason, the decision with its time and who on the team made it, and when we informed you. While this record stands, nobody can choose the removed name again. If we overturn the decision after you contest it, the name is free again.

The legal basis is our legitimate interest in a safe and fair player community (Art. 6(1)(f) GDPR). Recording the reasons for a decision and telling you them also rests on our duty to state reasons under Article 17 of the Digital Services Act (DSA; Art. 6(1)(c) GDPR). We delete blocks, reports and records of reset names as soon as one of the accounts involved is deleted, and for Alpha accounts at the latest when the Alpha ends.

6. Recipients and service providers

We do not sell data and do not share it for advertising. We use the following service providers, who process data only on our behalf and on our instructions (Art. 28 GDPR), unless stated otherwise:

Every service provider that receives personal data from us is contractually bound to protect it at least as well as this policy describes. Beyond that we only disclose data where the law requires us to, for example on the order of an authority or court.

7. Transfers outside the EU

Some providers are based in the USA. Even where data is stored in the EU, access from the USA cannot be ruled out. Transfers rely on the European Commission's adequacy decision for the EU-US Data Privacy Framework (Art. 45 GDPR) where the provider is certified under it, and otherwise on the Commission's Standard Contractual Clauses (Art. 46(2)(c) GDPR). You can get a copy of the safeguards by writing to privacy@noaiq.com.

8. How long we keep data

Deleting your account: in the app under Settings, “Delete account”. We then immediately delete your account with profile, ratings, game history, friendships, leaderboard entries, blocks and reports you are part of, sign-in sessions and the delivery log of your sign-in emails. All that remains is a note, with no link to you, that a deletion took place; while a deletion step at a service provider is still pending, the note holds your internal account ID until that step is done. The data leaves backups as they are overwritten, at the latest after 30 days. We delete Alpha analytics data at PostHog within one month. We keep the proof of your Alpha consents as described in section 5.8. You can also ask for deletion by email to privacy@noaiq.com.

9. Minimum age

Noa is for people aged 16 and over; the Alpha version is open to adults only. If we learn that an account was created by someone younger, we delete it. If you believe that is the case, write to privacy@noaiq.com.

10. No advertising and no tracking

Noa shows no ads. We do not combine your data with other companies' data for advertising, we do not track you across other companies' apps or websites, and we give no data to data brokers.

11. Do you have to give us data?

There is no legal obligation. Without an email address, though, we cannot set up an account, and without the data from your games we cannot offer ratings, progress or leaderboards. Usage analytics in the Alpha is voluntary but a condition of taking part in the Alpha. Screen recording is voluntary and not a condition of taking part (section 5.9).

12. Your rights

You have the right

• of access to the data we process about you (Art. 15 GDPR),
• to rectification of inaccurate data (Art. 16 GDPR),
• to erasure (Art. 17 GDPR),
• to restriction of processing (Art. 18 GDPR),
• to data portability, receiving your data in a common machine-readable format (Art. 20 GDPR),
• to withdraw consent at any time with effect for the future (Art. 7(3) GDPR), for example for usage analytics or screen recording in the Alpha (section 5.9).

Right to object (Art. 21 GDPR): where we process data based on our legitimate interest (Art. 6(1)(f) GDPR), you may object at any time on grounds relating to your particular situation. We then stop, unless we can demonstrate compelling legitimate grounds that override your interests, or the processing serves the establishment, exercise or defence of legal claims. You object to your profile being public by making your account private; in the Alpha version, while the app's setting does not yet take effect on our server, by email (section 5.3).

Write to privacy@noaiq.com for any of this. We reply within one month; in complex cases this can be extended by two months, and we tell you if so (Art. 12(3) GDPR).

13. Complaints to a supervisory authority

You can complain to any data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information Rhineland-Palatinate, Hintere Bleiche 34, 55116 Mainz, Germany, www.datenschutz.rlp.de.

14. Security

All connections between the app, the website and our servers are encrypted (TLS). Only the people on our team who need access to user data for their work have it.

15. Changes

We update this policy when Noa or the law changes, and show the date of the current version at the top. We tell you about material changes in the app or by email.