Privacy

What we keep when you take the test

• Your answers. For each puzzle: the option you chose (or that time ran out), whether it was right, how long you took, and how many times the page lost focus or was hidden while the puzzle was on screen. The same for the warm-up and memory questions, which do not count towards your score.
• Your result. The score, its range and percentile, how many puzzles you got right, and how many answers came in under 3 seconds.
• Your age band and gender, if you choose them while your report is being built. “Prefer not to say” is always there.
• Three more answers, if you give them then: whether you have taken IQ tests before, where you think you will score, and which word you remember from the start of the test (we keep only whether it was right). Each is optional and kept with your test, to compare scores fairly; your guess appears in your report.
• Your country and city. Our host, Vercel, works them out from your IP address and passes them to us. We store the country and city, not the IP address, and use them to show how you compare with other test-takers where you are.
• An approximate location. Vercel also passes us map coordinates for your IP address. We store them rounded to about 10 km, never more precisely, to show where you are on the globe in your result. Only your result page shows them.
• Times: when the test started, when each answer arrived and when you finished.
• The language you took the test in, so your emails, your checkout and your certificate come in it.

Vercel also passes us your time zone, so the result shows the date where you are. We use it for that page and do not store it. When you create a certificate, we store the test date it prints, worked out the same way.

Your certificate

A certificate is optional. If you add your name to it, we store the name as you type it, a random certificate ID and the date it was issued, with your test. You can correct the name from your result page.

Anyone who has the certificate ID, or the link or QR code that carries it, can see the name, the score, its range, the percentile and the test date at whatiq.com/verify. Share the ID only with people you want to see them. Certificate pages ask search engines not to list them.

To stop IDs being guessed in bulk, we count certificate lookups per network for a minute at a time. We store a scrambled code made from the IP address, not the address itself, and delete it within a day.

When you unlock a result

We keep the email you enter before checkout, when your report is almost ready (or at checkout). We use it to fill in checkout and, after you pay, to send your receipt and your result link; if you do not finish checkout, we may also send up to four reminders about your result to this email, the last about 27 days after you gave it and shortly before we delete the email, each with an unsubscribe link. We pass it to Stripe for your receipt, use it to find your membership and to stop a second membership on the same email, and send you one email with the link to your result and the membership’s terms. If you do not unlock the result, we delete that email after 30 days. If you are in the EU, the EEA or the UK, we also keep the time you ticked the box agreeing to the terms, and its words. There the email field also says that we may send you an occasional email about your result, with “change” beside it: one tap and we send you none. We keep that line with the box’s words, and whether you tapped “change”. Once you pay, other visitors may see a line such as “Lau*** bought their IQ report · IQ 118” before they pay: the first half of the first name on your payment (or of the first word of your email address when the payment has no name), your score, and your country’s flag once 100 people there have finished the test. Never your full name, your email or when you paid.

Stripe processes the payment. We receive a payment reference and the state of your membership (in trial, active, cancelled), never your card details.

If you cancel with the form on our German pages (“Verträge hier kündigen”), we keep the name and email you enter, the kind of cancellation, the end you asked for and the time it arrived, as the record of your cancellation.

When you sign in

You can sign in with a code we email you, or with Google. We keep your email, when you signed in and, if you use Google, Google’s ID for your account (not your name or photo). Your account holds the tests you take while signed in, the result on screen when you sign in, and results paid for with your email; it also shows your membership.

If you use daily brain training, we keep each game you finish: which game, the level you reached, how many rounds you got right, how long it took, the day and your time zone. They make your streak and your levels, and stay with your account until you ask us to delete them.

A sign-in code works for 10 minutes and is stored scrambled. To stop codes being sent or guessed in bulk, we count them per email and per network, storing a scrambled code made from each, not the email or the IP address, and delete it within a day.

What stays in your browser

While you take the test, your browser’s local storage holds a random test ID, so a reload or a return within 90 minutes picks up where you were. It is removed when your result opens. After you pay, we set a cookie, wiq_member, which holds a signed reference to your membership, so your retakes open on this device. It lasts up to 400 days and is not used for analytics or advertising. When you sign in, we set wiq_session, which keeps you signed in for up to 400 days (we store only a scrambled copy of it), and wiq_signed_in, which only tells our pages to show “Account” instead of “Sign in”. Signing out removes both. For advertising we set wiq_vid, a random visitor code, and wiq_fbc when you arrive from a Meta ad; Meta’s pixel sets its own _fbp and _fbc on pages without a test ID (see Advertising below). We set wiq_locale to remember the language you read the site in, for a year. Outside the EU, the EEA and the UK, PostHog keeps a random visit code in the tab’s session storage until you close the tab (see Analytics below).

The same ID is in your result’s web address. Anyone with that link can see the result, so share it only with people you want to see it. Result pages ask search engines not to list them.

What we don’t collect

No password, and no name unless you add one to your certificate. Your card details go to Stripe, never to us. We do not sell data, and your test ID, answers and score are never used for advertising.

Why we keep it

• To work out your score and show you your result.
• To calibrate and norm the test: to learn how hard each puzzle is and how scores spread across people. We do this with answers in bulk, which carry no name or contact details, and we only ever publish totals and averages.
• To spot tests answered by software or at random, so they do not distort the scores of everyone else.
• To show, during the test and while your report is built, how many people have taken it where you are and how long people take: counts and times added up across everyone, never anyone’s answers, score or details.

Who else handles it

• Vercel hosts the site. Like any host it keeps request logs, which include IP addresses, under its own retention rules.
• Railway runs our database, in the United States (US East). Test data is stored there.
• Cloudflare runs our domain’s DNS.
• PostHog counts visits, records how pages are used outside the EU, the EEA and the UK (described under Analytics) and records errors on our pages and servers so we can fix them, in the United States. It sets no cookies and never receives your test ID, score or email.
• Meta (Facebook, Instagram) measures our ads, described under Advertising.
• Stripe takes payments, sends receipts and runs the portal where you manage your membership, under its own privacy policy.
• Resend sends our emails (your result link and sign-in codes), in the United States.
• Google confirms who you are if you choose to sign in with Google, under its own privacy policy.
• Slack carries a note to our team of each payment: its amount, your email and your country.

Analytics

We count page views, how long a page stays open, how fast it loads, which site or ad brought you (the referring site and the campaign tags in the link), and a few steps of the test: started, practice done, reaching each of the five short breaks between puzzles, finished, the email given before the result, and on a locked result: checkout shown, opened and paid, a payment form that did not load or did not go through (with Stripe’s reason), result viewed, certificate named or shared, and signed in. PostHog receives these counts. They carry no test ID, answers or email: before anything is sent, addresses lose their query and result addresses are shortened to “/result/[id]”. Each count carries your country, which Vercel works out from your IP address.

In the EU, the EEA and the UK (and when we cannot tell your country), that is all: no cookies, nothing stored in your browser. PostHog uses your IP address only to make a code that tells visitors apart, then discards it; the code changes every day, so a visit cannot be linked to another day.

Everywhere else we also record how our pages are used, so we can see where they confuse people and fix them: what the page showed, where you clicked, tapped and scrolled, and where clicks went nowhere. During the test that includes the puzzles and the options you tapped. A recording never holds what you type (every field is hidden), email addresses, your certificate (it shows as a blank box) or, on result and account pages, any number, so your score and range stay out of it. Certificate check pages are not recorded. To link the pages of one visit, PostHog keeps a random code in your browser tab’s session storage, which is deleted when you close the tab. PostHog keeps recordings for 30 days.

Advertising

We advertise on Facebook and Instagram, and tell Meta which visits come from its ads and lead to a purchase, so it can show our ads to people likely to be interested. Meta’s pixel runs on the home page, the test page, the membership page and these policy pages; it reports page views with your browser, IP address and its own cookies. It never runs on result or certificate pages. From our server we tell Meta when a locked result is shown, when checkout opens, and when a payment or renewal is made, with its amount. With those we send your email, phone, name and billing address as Stripe has them, scrambled one way (hashed) as Meta requires, plus your IP address, browser and the codes above. We never send Meta your test ID, your result’s address, your answers, your score or the name on a certificate. Meta handles this under its own privacy policy.

How long we keep it

We keep test data until you ask us to delete it. A test left unfinished is closed after 90 minutes and its answers are kept like a finished one’s. An email given before checkout is deleted after 30 days if the result is not unlocked. Payment records are kept as long as tax law requires.

Seeing or deleting your data

Write to help@whatiq.com with your result link and we will send you what we hold for that test or delete it, certificate included (its ID then stops being found). We do not check who took a test, so without the link we cannot tell which one is yours.

Age

The test is for adults, 18 and over (see the terms).

Changes

We may update this page. The date at the top shows the current version.

Contact

help@whatiq.com