Privacy Policy
Last updated: 6 July 2026 · Version v1
This Privacy Policy explains how Stacked Stones Investments Pte. Ltd. (“Cognitiv Q”, “we”, “us”) collects, uses, stores, and protects your personal data when you use the Cognitiv Q application at app.cognitivq.com (the “Service”). We are committed to handling your data in line with Singapore’s Personal Data Protection Act (PDPA) and, where applicable, the EU/UK General Data Protection Regulation (GDPR).
Cognitiv Q is a wellness product, not a medical or diagnostic service. It does not diagnose, treat, or predict any medical condition, and nothing in the Service should be treated as medical advice.
1. Who we are
The data controller is Stacked Stones Investments Pte. Ltd., 10 Petain Rd, #04-01, Singapore 208089. For any privacy question or to exercise your rights, contact us at hello@cognitivq.com.
2. What data we collect
We collect only what the Service needs to work:
| Category | Examples |
|---|---|
| Account | Email address, password (stored hashed by our authentication provider), first and last name, date of birth. |
| Check-in results | Your responses and performance on cognitive check-in tasks, response times, computed scores and trends, and technical metadata about your device (e.g. input type, screen refresh rate) captured to interpret timing accurately. |
| Self-reported state | Daily check-ins (sleep, energy, stress) and mood/alertness ratings you choose to provide. |
| Consent records | Which consents you have granted or withdrawn, and when. |
| Communications | Records of emails we send you (e.g. results-ready and reminder emails), including their content and delivery status. |
We do not intentionally collect special categories of data, payment card details (payments are not enabled in this version), or data about you from third parties. We do not sell your personal data.
3. How and why we use your data (legal bases)
- To provide the Service — creating your account, running your check-ins, computing your personal baseline and trends. Basis: performance of our contract with you, and your consent to store check-in results.
- To communicate with you — results-ready notifications and check-in reminders. Basis: consent / legitimate interests; you can opt out of reminders.
- To improve and secure the Service — diagnosing errors and preventing abuse, using aggregated or de-identified information wherever possible. Basis: legitimate interests.
- Anonymised group statistics — only if you opt in, and only in a form that does not identify you. Basis: consent.
Your results are always presented against your own history — we do not rank you against other people, and we do not make automated decisions that produce legal or similarly significant effects about you.
4. Your choices and consent
Storing your check-in results is required to use the Service (it is what your trends are built from). Contributing anonymised data for group statistics is optional and off by default. You can review and change your consents at any time on your account page, and withdrawing a required consent means closing your account.
5. Your rights
Subject to applicable law, you have the right to:
- Access and portability — download a complete copy of your data as a file, any time, from your account page.
- Erasure — delete your account and associated data from your account page; we also remove identifying details from communication and audit records on deletion.
- Rectification — correct your profile details in the app.
- Withdraw consent — at any time, without affecting processing already carried out.
- Object or restrict / lodge a complaint — with us at hello@cognitivq.com, and with your data protection authority (in Singapore, the PDPC; in the EEA/UK, your local supervisory authority).
6. Storage, security, and international transfers
Your data is stored in our managed database hosted in Singapore(ap-southeast-1). Access is restricted at the database level so that you can only read your own data, and internal staff access is limited and logged. We use encryption in transit and rely on our infrastructure providers’ encryption at rest. Some sub-processors (application hosting/CDN and transactional email) may process limited data outside Singapore; where they do, we rely on their standard contractual safeguards for such transfers.
7. Sub-processors
We use a small number of service providers to operate Cognitiv Q:
| Provider | Purpose |
|---|---|
| Supabase | Managed database + authentication (hosted in Singapore). |
| Vercel | Application hosting and content delivery (global edge network). |
| Resend | Transactional email delivery (results-ready and reminder emails). |
We require each of them to protect your data consistently with this policy, and we update this list if our providers change.
8. Data retention
We keep your account data for as long as your account is active. The full content of emails we’ve sent you is retained for up to 180 days, after which it is removed while a minimal delivery record (recipient, subject, status, timestamp) is kept. When you delete your account, we remove your personal data and de-identify records we must retain for security or legal reasons. Any residual copies in routine encrypted backups are removed on our normal backup-rotation cycle.
9. Children
The Service is not directed at children. You must be at least 18 to create an account.
10. Changes to this policy
We may update this policy from time to time. If we make material changes, we will notify you and, where required, ask for renewed consent. The version and date at the top reflect the current policy.
11. Contact
Questions or requests: hello@cognitivq.com.