Legal Documents

SYNOVA — Privacy Policy

Publisher: Hakan Timur — a natural person (sole proprietor) trading as Noriloop Studio
Postal address: Yenişehir Konakları, 979. Sokak 14G Daire 6, 26000 Tepebaşı, Eskişehir, Türkiye
Contact email: [email protected]
Application: SYNOVA (application id com.noriloop.synova)
Effective date: 6 September 2026
Last updated: 18 September 2026

1. Who we are

SYNOVA ("the App") is a cognitive training application published by the Publisher named in the identity block at the top of this document ("we", "us", "our"). Every reference below to the Publisher, to our address and to our contact address means the values given in that block, which is the only place in this document where any of them appears.

The Publisher is an individual — a natural person acting as a sole proprietor, not a company. For the purposes of the EU/UK General Data Protection Regulation (GDPR) and the Turkish Personal Data Protection Law No. 6698 (KVKK), that individual is the data controller for any personal data described in this policy.

You can reach us at the contact email address given in the identity block above.

2. The short version

The core App does not collect your personal data. One optional feature, Curiosity Quest, does send limited data to our server so it can be fairly scored — and a further optional layer on top of that, Ranking, lets you choose to appear to other players.

Everything the six original training exercises record about you — your scores, your streak, your history, your settings — is stored in a database file on your own device and is never sent to us or to anyone else. That has not changed.

What has changed since this policy was first published: the App now also offers Curiosity Quest, a trivia mini-game. Because its questions and correct answers must not be readable on your device before you answer (or every round would be trivial to cheat), each round is generated and scored on our server rather than on your device. Playing it sends your chosen topic, your answers and your resulting score to us, tied to an anonymous technical identifier — never to your name, your email address, or anything else that identifies you as a person. You do not create an account, provide a password, or sign in to play it.

On top of Curiosity Quest, you may separately choose to join Ranking — a leaderboard where a username and country you pick, together with your Curiosity Quest scores, become visible to other players. Joining Ranking is never required to play Curiosity Quest, or anything else in the App, and you can leave it and delete everything it holds about you at any time. §5 explains it in full.

The rest of this policy explains all of that in detail.

3. Accounts: the core App needs none, Curiosity Quest needs a technical one

The six original training exercises have no account system. You do not create an account, you do not provide an email address or a password, and you do not sign in. You use that part of SYNOVA anonymously, exactly as before.

To keep your own training history consistent on your own device, the App generates two random identifiers the first time you open it:

a local installation identifier, used to associate your saved sessions with the installation on this device; and
a public player identifier, used only if you later join Ranking (§5) — otherwise it is generated and never used or transmitted.

Neither is derived from your device's hardware, your advertising identifier, your phone number, or any account you hold anywhere, and neither is transmitted anywhere unless you play Curiosity Quest or join Ranking.

The first time you open Curiosity Quest, the App additionally creates a lightweight anonymous technical identity with our authentication provider (Firebase Authentication, part of Google Cloud). This happens automatically, without any sign-in screen, email address, or password — it exists purely so our server can tell one player's round apart from another's and score it correctly, and to stop the same device from being used to submit answers as if it were many different players. It is not a social or public identity: nobody, including us, can look at it and learn who you are. If you go on to join Ranking, this is the identifier your chosen username gets attached to (§5); if you never join Ranking, it is never shown to anyone.

4. Curiosity Quest — what it sends, and why

Curiosity Quest is a five-question trivia round across topics such as animals, nature, space, the human body and everyday science. Unlike the App's original exercises, its content has to come from somewhere you cannot inspect in advance — if the correct answer were stored on your device before you picked one, anyone could read it out of the App's files. So each round works like this:

When you start a round, our server (Google Cloud Functions, part of Google Cloud, region us-central1) picks five questions and sends you the first one — the question text, its image, and its answer options, with no indication of which option is correct.
When you answer, your selection is sent to our server, which checks it against the real answer, computes your score for that question, and only then sends back whether you were right and why.
Once you finish all five questions, the server computes and returns your round's total score.

What this means is stored with us, tied to your anonymous technical identifier (§3), is: the topic you chose, which option you picked for each question, whether you were right, your score, and when you played. We use it to compute your score correctly and, if you have joined Ranking, to update your leaderboard entry (§5). We do not use it for advertising, and we do not sell it.

This data is hosted on Google Cloud infrastructure that Google operates on our behalf as a data processor, in the United States. Google's processing of it is governed by the Google Cloud data processing terms, which incorporate the European Commission's Standard Contractual Clauses for transfers of personal data outside the EEA/UK where applicable.

Playing Curiosity Quest requires an internet connection. The App's six original exercises do not, and continue to work fully offline regardless of whether you have ever opened Curiosity Quest.

5. Ranking — the opt-in leaderboard

Joining Ranking is never required. You can play Curiosity Quest, and every other part of the App, for as long as you like without ever joining it, and declining costs you nothing.

If you choose to join, before anything is sent anywhere the App shows you, on the join screen itself, exactly what this section describes: joining creates a profile holding a username you choose, a country you select, and the birth year you enter (used only to confirm you meet the minimum age below — see §8). Your Curiosity Quest scores from that point on are then attached to that profile.

Once you have joined, your username, your country, and your best Curiosity Quest scores become visible to other players who are also signed in — on leaderboards scoped to today, to all time, to your country, and worldwide. Your birth year, your email address (you have none in the App), and your anonymous technical identifier are never shown to other players. We do not display your device, your location beyond the country you chose, or anything about the six original exercises.

Choosing a username is subject to a few rules enforced when you pick one: it must be 3–20 characters, letters/numbers/underscores only; it may not be a name that impersonates SYNOVA, Noriloop Studio, or a reserved word; and it is checked against a list of offensive terms. If your first choice is rejected or already taken by someone else, you are asked to pick another.

Leaving Ranking, at any time: the App has a "Leave ranking" action (Profile → Ranking) that immediately and permanently deletes your ranking profile, your username, your place on every leaderboard, every Curiosity Quest round you have played, and the anonymous technical identity itself. This cannot be undone — the next time you play Curiosity Quest, a new, unranked identity is created automatically, as if you had never joined. The six original exercises and your on-device history are never touched by this action, because they were never sent to us. A public web page offering the same deletion, for anyone who no longer has the App installed, is linked from §9.

6. What is stored on your device

The App stores the following on your device, and only on your device:

Training data

The results of each exercise you play: which exercise, which cognitive category, difficulty, accuracy, correct/incorrect/skipped counts, duration, the score awarded, and when the session started and ended.
A small set of numeric, per-exercise diagnostic measurements. These are numbers only — the field is technically incapable of holding text — and are limited in size by the App.
Your daily workout plans and which exercises within them you have completed.
Your Brain Score, your per-category scores, and a dated history of them.
The App's estimate of your ability at each exercise, used to set difficulty.
The calendar days credited to your training streak.
Achievements you have unlocked and your progress toward challenges.
Your experience points and level.

Preferences

Your theme and language preferences.
Your reminder and notification preferences.
Which exercises you have marked as favourites.
A record of whether you have completed onboarding and the baseline calibration.

Technical

The two random identifiers described in §3.
The local time-zone offset in force when a session was recorded and when a streak day was credited. This is stored so that a day you played is credited correctly if you travel between time zones. It is a numeric offset from UTC, not a location, and it never leaves your device.
A cached record of whether you hold a premium subscription. See §8.

What is never collected, on any part of the App. SYNOVA does not collect, and has no means of collecting: your name, your email address, your phone number, your postal address, your date of birth (Ranking asks only for a birth year, and only to confirm the age gate — see §5, §8), your contacts, your photographs, your files, your precise or approximate location, your device's advertising identifier, your browsing activity, or anything you have typed beyond a Curiosity Quest answer or a Ranking username. The App contains no field in which you can enter any other personal information.

The one thing described above that is not "on your device only" is Curiosity Quest's round data and, if you have joined it, your Ranking profile — both described fully in §4 and §5, both sent to our server rather than kept locally, and both deletable at any time the same way §9 describes.

7. Advertising

7.1 Today

The App currently shows no advertisements and contains no advertising software. No advertising identifier is read, no ad request is made, and no advertising company receives anything from the App.

7.2 If and when we introduce advertising

We intend to offer SYNOVA free of charge, supported by advertising, with an optional subscription that removes ads. When advertising is introduced, this policy will be updated before the change reaches you, and the following will apply:

Advertisements would be served by Google AdMob (Google Ireland Limited / Google LLC). Once an advertising SDK is present in the App, Google collects data directly from your device, independently of us. That typically includes your device's advertising identifier, your IP address and the approximate location derived from it, your device model and operating system version, your language, and your interactions with the advertisements shown.
We would not receive your advertising identifier or your personal data from Google. We would receive only aggregate reporting about advertising performance.
Where the GDPR or KVKK applies, you would be asked for consent through Google's consent interface before any advertisement is requested. If you declined, you would still see advertisements, but they would be non-personalised — selected from the context rather than from a profile of you.
On iOS, we would ask for permission through Apple's App Tracking Transparency prompt only if we served personalised advertisements. If advertising is non-personalised, no such prompt appears and no tracking occurs.
Google's own privacy policy would govern its processing: https://policies.google.com/privacy and https://support.google.com/admob/answer/6128543 for AdMob specifically.

Nothing in this subsection describes the App as it exists today.

8. Subscriptions

The App offers, or will offer, an optional premium subscription that removes advertisements and unlocks additional features.

Today, no purchase mechanism is connected. The subscription screen is visible but cannot complete a purchase, and no purchase, receipt, transaction identifier or billing information is collected or stored.

When purchasing is enabled, it will be handled entirely by Google Play Billing on Android and Apple's App Store / StoreKit on iOS. That means:

Your payment details are given to Google or Apple, never to us. We never see your card number, your billing address, or your store account.
We store on your device only a cached record of whether a subscription is active, its type, when it expires and when it was last verified. This lets the App work offline without repeatedly locking you out.
Your subscription is managed, and can be cancelled, through your Google Play or Apple App Store account settings, not through us.

See the Terms of Service for how auto-renewal and cancellation work.

9. Analytics and crash reporting

The App currently sends no analytics and no crash reports.

The App contains the internal structure needed to add analytics and crash reporting later, but no such service is connected. When an error occurs, the details are written to your device's local developer log and go no further.

If we connect an analytics or crash reporting provider in the future, we will update this policy before doing so and will state which provider, what is collected, and on what legal basis. Any such data would be limited to information about how the App is used and how it fails — never the content of your training data, and never information that identifies you personally.

10. Children

Minimum age. SYNOVA is intended for users aged 13 and over.

We do not knowingly collect personal data from children. The App's six original exercises collect no personal data from anyone and transmit nothing from the device, so there is no personal data belonging to a child for us to hold, access or delete there.

Curiosity Quest and Ranking are different, and this is why Ranking specifically has an age gate. Joining Ranking (§5) requires entering a birth year, and the App refuses to create a Ranking profile for anyone who states they are under 13. We do not verify age beyond what is entered — as with most consumer apps, we rely on the answer given — but a stated age under 13 is always refused, without exception.

If you are a parent or guardian and you believe a child has used the App, including Curiosity Quest or Ranking, in a way that concerns you: all on-device data can be removed instantly by deleting the App from the device, and any Ranking profile and Curiosity Quest history held on our server can be removed using §11 below, or by contacting us at the contact email address given in the identity block at the top of this document.

11. How to delete your data

11.1 The six original exercises — on your device only

Because this data is stored only on your device, you control it completely and do not need to ask us to delete anything — we hold nothing to delete.

To erase your training history: open Profile → "Reset local progress" and confirm. This permanently deletes every session you have played, your daily workouts, your Brain Score history, your category scores, your measured abilities, your streak days, your achievements, your challenge progress and your experience points.

Please note that this does not remove your app preferences, your favourite exercises, the two random identifiers described in §3, or your cached subscription status. Resetting your progress is deliberately not the same as resetting the App.

To erase everything: uninstall the App. Uninstalling deletes the App's entire database from your device. Nothing survives it, and nothing is retained by us, because we never held a copy. This action is irreversible and cannot be undone by reinstalling.

On Android, your data is also excluded from Google cloud backup and from device-to-device transfer, so uninstalling really does end it: no copy is left in your Google account.

11.2 Curiosity Quest and Ranking — held on our server

This is the data described in §4 and §5: your Curiosity Quest round history, and — only if you joined — your Ranking profile, username and leaderboard entries.

In the App: open Profile → Ranking → "Leave ranking" and confirm. This immediately and permanently deletes your Ranking profile, your username, your place on every leaderboard, every Curiosity Quest round you have ever played, and the anonymous technical identity itself (§3). It works whether or not you have joined Ranking — if you have only ever played Curiosity Quest, it deletes your round history and that identity; if you have also joined Ranking, it deletes that too.

From the web, without the App installed: use the account deletion page at https://noriloop.net/delete-account/, which explains what it needs from you to find your account and delete it (it does not need a password, because none exists — see §3).

Either way, deletion is permanent and cannot be undone. It does not affect the six original exercises or anything else stored only on your device (§11.1); those are erased separately, on the device itself, because we never had a copy to delete.

12. Your rights under the GDPR and the KVKK

12.1 GDPR (EU/EEA and UK)

If you are in the European Economic Area or the United Kingdom, you have the right to access your personal data, to have it corrected or erased, to restrict or object to its processing, and to data portability. You also have the right to lodge a complaint with your national supervisory authority.

For the six original exercises, these rights are satisfied directly and immediately by the design of the App rather than by a request process: your data is on your device, visible to you in the App, and erasable by you at any moment (§11.1). We hold no copy, so there is nothing for us to disclose, correct, export or erase on your behalf.

For Curiosity Quest and Ranking, the data described in §4 and §5 is processed on the legal basis of your consent: playing Curiosity Quest is your consent to your round data being sent to our server to be scored, and joining Ranking is a separate, further consent to your username, country and scores being shown to other players — each given by the affirmative act of starting a round or joining Ranking, after being told what happens, and each withdrawable at any time by the deletion methods in §11.2, which has the same effect as a withdrawal of consent. You may access what is held about you, or ask us to correct it, by contacting us at the address in the identity block above; because a Ranking username and country are visible to you at all times inside the App, this will usually already answer the question.

12.2 KVKK (Türkiye)

If you are in Türkiye, Article 11 of Law No. 6698 on the Protection of Personal Data gives you the right to learn whether your personal data is processed, to request information about that processing, to learn its purpose, to know the third parties to whom it is transferred, to request correction or deletion, and to object to results produced solely by automated analysis.

For the six original exercises, SYNOVA processes no personal data on our systems: no data is transferred from your device to us or to any third party, and no personal data is transferred abroad. For Curiosity Quest and Ranking, your explicit consent (açık rıza) is obtained by the same affirmative acts described in §12.1 — starting a round, and separately joining Ranking — before any such data is sent, and that data is processed by our infrastructure provider, Google, whose servers for this purpose are located outside Türkiye (§4).

You may address any request under Article 11 to the contact email address given in the identity block at the top of this document, and you have the right to complain to the Turkish Personal Data Protection Authority (Kişisel Verileri Koruma Kurumu).

13. Permissions the App requests

None, on either platform, beyond internet access.

On Android, the release build requests only INTERNET, added specifically so Curiosity Quest can reach our server — the App declared no permissions at all before Curiosity Quest existed, because it had nothing to talk to. It does not request notifications, location, camera, microphone, photo library, contacts, or storage, and it does not request an advertising identifier. INTERNET carries no runtime prompt on Android; it is a manifest-level permission the system grants automatically at install time.

On iOS, the App requests no permissions beyond the platform defaults. It does not request tracking permission, location, camera, microphone, photo library or contacts access.

14. Security

Your on-device data is stored in the App's private storage area, protected by the security model of your operating system, which prevents other applications from reading it. The App adds no encryption of its own beyond that, and relies on your device's own encryption, passcode and biometric protection.

For the six original exercises, because no data is transmitted, there is no transmission for an attacker to intercept and no server of ours that can be breached for that data specifically. For Curiosity Quest and Ranking, data in transit is encrypted (HTTPS/TLS), and access to it at rest is restricted by our infrastructure provider's security rules to the specific server-side functions that need it — no Ranking username, country or score can be written except through those functions, and the Curiosity Quest question bank and correct answers are never directly readable by any client, including the App itself, before a round is answered.

15. Governing law

This policy is governed by the laws of Türkiye.

Nothing in this policy limits any right you have under the mandatory consumer protection or data protection law of the country in which you live.

16. Changes to this policy

We may update this policy as the App changes. When a change materially affects how your data is handled — in particular, if the App begins transmitting data that it does not transmit today — we will update the effective date at the top of this document and give notice within the App before the change takes effect.

The current version of this policy is the one published at the privacy policy address shown on the App's store pages and reachable inside the App from Profile → Legal. If you are reading this page on the web, this is that current version.

17. Contact

Questions about this policy, or about your data, should be sent to the contact email address in the identity block at the top of this document. Postal correspondence may be sent to the postal address given there.