Privacy policy

1. Who we are

Dronelix is made by IOCODO LLC, a limited liability company registered in Wyoming, United States. We decide why and how the data described on this page is used, so under European data protection law we are its controller.

Postal address: 30 N Gould St Ste N, Sheridan, WY 82801-6317, United States
Email: support@iocodo.com
Report criminal or illegal content: iocodo.com/report/
Our company details and the person in charge of data protection (the Managing Member of IOCODO LLC): iocodo.com/contact/
Impressum (legal notice for Germany): iocodo.com/impressum/

Use this email for anything about your data, including the requests described in Your rights.

2. What this policy covers

This policy covers the Dronelix app on iOS and Android, and this page. Dronelix is a study app for drone pilot licence exams (FAA Part 107, EASA A1/A3 and A2, the UK A2 CofC, Transport Canada RPAS Basic and Advanced, and CASA). It is made by an independent company, not by an aviation authority, and it does not grant a licence.

Here, "personal data" means any information about you as a person who can be identified, directly or indirectly. That includes identifiers such as an installation ID, an App Check token or a device token, even when they do not contain your name.

3. Data that stays on your device

Dronelix keeps the following on your device, in the app's own storage:

• your study progress: for each question you answered, your last answer, whether it was right, how often you have seen and missed it, and when it is next due for review; and your mock exams, with each answer, the score and the time taken
• your settings: the licence track you chose, the theme, sound effects, the study reminder and its time, and whether you finished the first screens
• how many times you have opened the app, and when it last showed you a prompt such as a rating request or an announcement
• whether this installation owns the one-time unlock of the mock exams, if you bought it before version 1.0.6
• your answers about usage statistics, crash reports and News from Dronelix: for each, whether you allowed it, when, the version of the text you saw, the app's version, the countries that set the rule for it, where you answered and the age you confirmed
• where the app shows its notice about usage statistics and crash reports, when you tapped its button (up to version 1.0.6, the version of our terms of use you accepted, and when)

We do not receive any of this, unless another section of this policy says otherwise. If you back up your device with iCloud or Google, the backup can include a copy of this data, under Apple's or Google's terms. Uninstalling the app deletes this data from your device.

To know which privacy rules apply, the app reads on your device the countries of the languages your phone is set to and the country of its time zone, and keeps only the consent countries it found, with your answers above.

If crash reports are off, the app deletes the crash reports waiting on your device and never sends them.

Study reminders are local notifications: your device schedules and shows them at the time you pick, and no data leaves it for them.

Contact support and Send report open an email in your own mail app, already filled in; nothing leaves your device unless you send that email yourself.

When you share Dronelix, the app passes the text to your device's share menu, and the app you pick receives it under its own terms. Links in the app, such as the official documents in the Library, open in your browser, and the website you open receives your visit under its own terms.

4. Accounts and sign-in

Dronelix has no user accounts: you do not register or sign in.

5. What we use data for, and on what legal basis

European data protection law (the GDPR and the UK GDPR) requires a legal basis for each use of personal data. For each use, here is the data involved and the basis we rely on.

• Running the app: keeping it configured, applying published question corrections and confirming that requests come from the genuine app

  Data: the installation identifier and its token, the app's version, the operating system version, your device's language, country setting and time zone, App Check tokens with an attestation from Apple's App Attest or from Google Play Integrity, and the IP address of each request.

  Legal basis: Performance of our contract with you, that is, providing the app you asked for (GDPR art. 6(1)(b)).

• Counting how the app is used

  Data: usage events, the app-instance identifier, device model, operating system version, the app's language, version and build number, and an approximate location that Google derives from your IP address (the app has no access to your phone's location).

  Legal basis: Your consent, which the app asks for before this starts in the European Economic Area, the United Kingdom, Canada, Vietnam and Brazil (in the European Union and the European Economic Area, GDPR art. 6(1)(a); in the United Kingdom, the same article of the UK GDPR). In Türkiye, it stays off until you turn it on in the app (Settings > Privacy choices). In other countries it is on unless you turn it off, except on an iPhone or iPad, and on any device in Switzerland, where it starts once you have seen the notice the app shows the first time it opens and tapped its button. In Thailand and Saudi Arabia, the legal basis is our legitimate interests (section 24(5) of Thailand's Personal Data Protection Act; article 6(4) of Saudi Arabia's Personal Data Protection Law). Everywhere, you can turn it off at any time in the app (Settings > Privacy choices).

• Fixing crashes

  Data: crash and error reports with their diagnostics, a record of each app session start, device model, operating system and app version, and installation identifiers.

  Legal basis: Your consent, which the app asks for before this starts in the European Economic Area, Canada, Vietnam and Brazil (in the European Union and the European Economic Area, GDPR art. 6(1)(a)). In Türkiye, it stays off until you turn it on in the app (Settings > Privacy choices). In other countries it is on unless you turn it off, except on an iPhone or iPad, and on any device in Switzerland, where it starts once you have seen the notice the app shows the first time it opens and tapped its button; in the United Kingdom, the next row applies. In Thailand and Saudi Arabia, the legal basis is our legitimate interests (section 24(5) of Thailand's Personal Data Protection Act; article 6(4) of Saudi Arabia's Personal Data Protection Law). Everywhere, you can turn it off at any time in the app (Settings > Privacy choices).

• Fixing crashes in the United Kingdom

  Data: crash and error reports with their diagnostics, a record of each app session start, device model, operating system and app version, and installation identifiers.

  Legal basis: Our legitimate interests (UK GDPR art. 6(1)(f)): finding and fixing the crashes you hit. The app does not ask first in the United Kingdom, because the Privacy and Electronic Communications Regulations allow storing and reading this data on your device without consent when it is needed only to find and fix technical faults. On Android, crash reports are on unless you turn them off in the app (Settings > Privacy choices); on an iPhone or iPad, they start once you have seen the notice the app shows the first time it opens and tapped its button, and you can turn them off the same way. You can object at any time by writing to us.

• Sending you News from Dronelix notifications, if you turn them on

  Data: a notification token for your device, the topics the app subscribes it to, and the device model, language, time zone, operating system version and app version that Firebase Cloud Messaging records with each subscription.

  Legal basis: Your consent (GDPR art. 6(1)(a)). The app asks before this starts, and you can withdraw your consent at any time in the app (Settings > News from Dronelix). Withdrawing does not affect what happened before.

• Answering you when you write to us, and checking a question you report against its source

  Data: your email address, your message, anything you attach and what the app writes into the email it prepares for you: the app's version and build, your device's operating system and its version, the app's language and, for a question report, the question's identifier, licence track, topic area and cited source and the reason you picked.

  Legal basis: Our legitimate interests (GDPR art. 6(1)(f)): answering your request, correcting a question that is wrong, and keeping a record of how we handled it. You can object at any time by writing to us.

6. Who receives data

We use these service providers to run Dronelix. Each one receives only the data listed, for the purpose listed:

• Google Analytics for Firebase (Google LLC)

  What for: counts how the app is used; the app tells it not to use this data for advertising.

  Data: the events Analytics records by itself (first open, app opens, sessions and updates) and the screens you view; the study events the app sends (a study session started or finished, with the licence track, the topic area and how many answers were right; a mock exam started or finished, with the track, the score and whether it passed; a question reported, with its identifier and the reason you picked; and, when the app offers its one-time purchase, views of the purchase screen and purchases started, completed, failed or restored); the app's build number, language and version; an app-instance identifier; device model, operating system version and an approximate location that Google derives from your IP address.

  Google LLC processes this data on our behalf, under its data processing terms. Google Analytics for Firebase privacy information

• Firebase Crashlytics (Google LLC)

  What for: reports crashes and errors so we can fix them.

  Data: crash and error reports with the stack trace and the state of the device (model, operating system and its version, app version, orientation, free memory and disk space), a record of each app session start, the Crashlytics and Firebase installation identifiers and, while usage statistics are also on, the last usage events before the crash.

  Google LLC processes this data on our behalf, under its data processing terms. Firebase Crashlytics privacy information

• Firebase Installations (Google LLC)

  What for: gives your installation the identifier that the other Firebase services use.

  Data: an installation identifier and its token.

  Google LLC processes this data on our behalf, under its data processing terms. Firebase Installations privacy information

• Firebase Remote Config (Google LLC)

  What for: keeps the app configured, for example switching a feature on or off, pointing the app at a published question correction, or asking you to update a version with a serious problem.

  Data: the installation identifier and its token, the app's version, the operating system version, and the language, country setting and time zone of your device; while usage statistics are on, also the properties Google Analytics keeps for your installation (the app's build number and when you first opened the app).

  Google LLC processes this data on our behalf, under its data processing terms. Firebase Remote Config privacy information

• Firebase App Check (Google LLC)

  What for: confirms that requests to our Firebase services come from the genuine app.

  Data: a short-lived App Check token and an attestation of the app and the device, from Apple's App Attest, which Firebase checks with Apple, or from Google Play Integrity.

  Google LLC processes this data on our behalf, under its data processing terms. Firebase App Check privacy information

• Firebase Cloud Messaging (Google LLC)

  What for: delivers the News from Dronelix notifications.

  Data: a notification token for your device (on iPhone and iPad, linked to the token Apple gives the app for notifications), the topics the app subscribes it to, and the device model, language, time zone, operating system version and app version that come with each subscription.

  Google LLC processes this data on our behalf, under its data processing terms. Firebase Cloud Messaging privacy information

• Firebase Hosting (Google LLC)

  What for: serves our website, iocodo.com, including this page and the file of question corrections that the app downloads when it starts while a correction is published.

  Data: your IP address and the request itself: the address of the page or file, and the name and version of the software that asks for it.

  Google LLC processes this data on our behalf, under its data processing terms. Firebase Hosting privacy information

• GoDaddy Professional Email (GoDaddy Operating Company, LLC)

  What for: receives and keeps the emails you send to support@iocodo.com and our replies.

  Data: your email address, your message and anything you attach, and our replies.

  GoDaddy Operating Company, LLC processes this data on our behalf, under its data processing terms. GoDaddy Professional Email privacy information

• IT service providers (United States)

  What for: tools we may use to read the emails and question reports you send us, and to draft our replies.

  Data: the text of an email or a question report and what comes with it (your email address and what the app writes into the email it prepares), when we use these tools for it.

  These providers handle this data under their own terms.

Apple (App Store) and Google (Google Play) also handle your download, any purchase and the integrity checks the app asks them for, and the rating sheet the app can ask them to show, under their own privacy policies.

We do not sell your personal data.

7. Notifications

The push notifications Dronelix can send are news about the app. They stay off until you turn them on in the app (Settings > News from Dronelix), and until then the app creates no notification token. When you turn them on, Firebase Cloud Messaging (a Google service) gives your device a token, and the app subscribes it to the News from Dronelix topics: one for everyone who turned News on, and one for your platform (iOS or Android). We send each notification to a topic, not to a person, and we do not store your token. When you turn them off there, the app unsubscribes your device and deletes the token.

You can turn notifications off at any time in your device settings.

8. Where data is processed

IOCODO LLC is registered in the United States. Our service providers may process your personal data in the United States and other countries where Google, GoDaddy or their sub-processors have facilities.

Where European, UK or Swiss data protection law requires a safeguard for this, we rely on:

• the EU-U.S. Data Privacy Framework, its UK Extension and the Swiss-U.S. Data Privacy Framework, for providers certified under them (you can check a provider on dataprivacyframework.gov)
• the Standard Contractual Clauses approved by the European Commission, with the UK Addendum and the Swiss adjustments, which are part of our providers' data processing terms

You can ask us for a copy of these safeguards at support@iocodo.com.

9. How long we keep data

Here is how long we keep each kind of personal data. Items marked automatic are deleted on a fixed schedule, without anyone having to ask.

• Usage events in Google Analytics

  2 months. automatic

• The app-instance identifier and the data Google Analytics keeps about it

  14 months after that installation last used the app; each new use starts the count again. automatic

• Crash and error reports, with their identifiers

  90 days. automatic

• IP addresses logged by Firebase Hosting

  A few months. automatic

• App Check tokens

  They expire within 7 days, and Firebase does not keep them. automatic

• The notification token of News from Dronelix

  Until you turn off News from Dronelix, which deletes it.

• Installation identifiers

  Until they are deleted; Firebase then removes them from its systems within 180 days.

• Emails you send us, and our replies to you

  Until you ask us to delete them. We set no fixed end date: we keep them as the record of our support, to answer you if you write again and to show how we handled your request. If you are in Korea, we keep them after our reply for at most 3 years, on the basis of article 15(1)(vi) of the Personal Information Protection Act (our legitimate interest in showing how we handled your request). If a law or a legal claim requires us to keep an email, we keep it until that ends.

• What the app keeps on your device

  Until you uninstall the app. In Settings, Reset my progress removes your study progress; your settings and privacy answers stay until you uninstall the app.

When you delete your data in the app or ask us to delete it, we delete it as described here, unless the law requires us to keep part of it.

10. How we protect data

Data travels between the app and our service providers over encrypted connections (HTTPS).

If a security incident puts your personal data at risk, we tell you and the competent authorities when the law requires it.

11. Your rights

Wherever you live, you can ask us to:

• tell you what personal data we have about you, and give you a copy
• send that copy to you, or to another company, in a machine-readable format
• correct data that is wrong or incomplete
• delete your data
• stop or limit a use of your data, including any use based on our legitimate interests

To ask, write to support@iocodo.com. It is free. We reply within one month, and we may ask you to confirm that the data is yours before we act.

You can also withdraw any consent you gave, at any time, in the app, where you gave it (Settings > Privacy choices or Settings > News from Dronelix). What we did with your consent before you withdrew it stays lawful.

Deleting your data

You can delete your data:

• in the app, for your study progress on this device (your answers, your review schedule and your mock exams): Settings > Reset my progress
• by email: write to support@iocodo.com with the subject "Delete my data"

Usage statistics and crash reports that were already sent are deleted on their own, within the periods in How long we keep data.

Data that stays on your device is deleted when you uninstall the app.

Complaints

You also have the right to complain to an authority:

• in the European Union and the European Economic Area, the data protection authority of the country where you live or work (list of authorities); in Italy, the Garante per la protezione dei dati personali
• in the United Kingdom, the Information Commissioner's Office
• in Switzerland, the Federal Data Protection and Information Commissioner
• in Brazil, the Agência Nacional de Proteção de Dados
• in the United States, the attorney general of your state

If you are in Brazil, you have the rights listed in article 18 of the LGPD (Lei 13.709/2018), and you can use them as described above. If you ask us for your data, we send a complete answer within 15 days, not one month.

12. Privacy rights in US states

Several US states, including California, Colorado, Connecticut, Oregon, Texas and Virginia, give their residents privacy rights. We give the same rights to everyone in the United States:

• to know what personal information we collect, use and disclose, and to get a copy of it
• to correct it
• to delete it
• to opt out of the sale of your personal information, of its use for targeted advertising and of profiling that has legal or similarly significant effects
• to appeal if we turn down your request
• not to be treated differently for using any of these rights

The personal information we collect comes from you and from the app on your device. Why we use it and who receives it are described in What we use data for and Who receives data. We do not sell your personal information. In the current version of Dronelix, we do not use or share it for targeted advertising.

To use these rights, write to support@iocodo.com, or have someone you authorise write for you. We reply within one month (these state laws allow up to 45 days). If we turn your request down, you can appeal by replying with the word "Appeal" in the subject. We answer an appeal within 45 days, and if you still disagree you can contact the attorney general of your state.

13. Notices for some countries

Canada

The service providers listed in Who receives data collect and keep data for us. They may process it outside Canada, in the United States and other countries where Google, GoDaddy or their sub-processors have facilities. The courts and authorities of those countries can have access to it under their laws.

Japan: information the app sends to other companies

When you use Dronelix, the app sends this information from your device to other companies:

• Google Analytics for Firebase (Google LLC)

  Information sent: the events Analytics records by itself (first open, app opens, sessions and updates) and the screens you view; the study events the app sends (a study session started or finished, with the licence track, the topic area and how many answers were right; a mock exam started or finished, with the track, the score and whether it passed; a question reported, with its identifier and the reason you picked; and, when the app offers its one-time purchase, views of the purchase screen and purchases started, completed, failed or restored); the app's build number, language and version; an app-instance identifier; device model, operating system version and an approximate location that Google derives from your IP address.

  Our purpose: to count how the app is used.

  Purpose of Google LLC: it uses the information only to provide this service to us.

• Firebase Crashlytics (Google LLC)

  Information sent: crash and error reports with the stack trace and the state of the device (model, operating system and its version, app version, orientation, free memory and disk space), a record of each app session start, the Crashlytics and Firebase installation identifiers and, while usage statistics are also on, the last usage events before the crash.

  Our purpose: to find and fix crashes and errors.

  Purpose of Google LLC: it uses the information only to provide this service to us.

• Firebase Installations (Google LLC)

  Information sent: an installation identifier and its token.

  Our purpose: to give your installation the identifier that the other Firebase services use.

  Purpose of Google LLC: it uses the information only to provide this service to us.

• Firebase Remote Config (Google LLC)

  Information sent: the installation identifier and its token, the app's version, the operating system version, and the language, country setting and time zone of your device; while usage statistics are on, also the properties Google Analytics keeps for your installation (the app's build number and when you first opened the app).

  Our purpose: to keep the app configured.

  Purpose of Google LLC: it uses the information only to provide this service to us.

• Firebase App Check (Google LLC)

  Information sent: a short-lived App Check token and an attestation of the app and the device, from Apple's App Attest, which Firebase checks with Apple, or from Google Play Integrity.

  Our purpose: to confirm that requests come from the genuine app.

  Purpose of Google LLC: it uses the information only to provide this service to us.

• Firebase Cloud Messaging (Google LLC)

  Information sent: a notification token for your device (on iPhone and iPad, linked to the token Apple gives the app for notifications), the topics the app subscribes it to, and the device model, language, time zone, operating system version and app version that come with each subscription.

  Our purpose: to deliver the News from Dronelix notifications.

  Purpose of Google LLC: it uses the information only to provide this service to us.

• Firebase Hosting (Google LLC)

  Information sent: your IP address and the request itself: the address of the page or file, and the name and version of the software that asks for it.

  Our purpose: to serve the file of question corrections.

  Purpose of Google LLC: it uses the information only to provide this service to us.

In Settings > Privacy choices, you can turn off usage statistics (Google Analytics for Firebase) and crash reports (Firebase Crashlytics). The other transmissions cannot be turned off in the app; Firebase Cloud Messaging receives data only when you turn on News from Dronelix in Settings, or once after an update from a version before 1.0.6, to delete the notification token that version may have created.

Korea: personal information, entrustment and transfer abroad

Personal information: under Korea's Personal Information Protection Act (the Act), the personal information we process is the emails you send to support@iocodo.com, including the ones the app prepares for you when you contact support or report a question, with what you write in them. The installation and app-instance identifiers, App Check tokens, the notification token, usage events, crash reports and the device information listed in Who receives data cannot be linked to you with anything we hold or could lawfully obtain at reasonable cost in time, money and technology, so under the Act they are not personal information (the definition in What this policy covers is broader), and we handle them without identifying you.

Processed without your consent: we process your emails to us without asking for your consent, on the basis of article 15(1)(iv) of the Act, which covers what is needed to carry out our contract with you (our terms of use) or, in the process of concluding a contract, to act on your request. Once we have handled your request, we keep your emails to us and our replies, with your email address, as the record of how we handled it, in case you write to us again about it or a dispute arises, on the basis of article 15(1)(vi) of the Act (our legitimate interests, where they clearly outweigh your rights and stay within a reasonable scope). If you are in Korea, we keep them for 3 years after our last message about that request, then delete them; we delete them sooner if you ask us to.

Entrustment and transfer abroad: we entrust the work below to this company, which receives the personal information outside Korea. The legal basis for the transfer is article 28-8(1)(iii) of the Act: we entrust this work to it to carry out our contract with you, and this policy discloses the details the Act lists. The company uses the information only to do this work for us, and keeps it for the periods in How long we keep data.

• GoDaddy Operating Company, LLC

  Work entrusted: receiving and keeping the emails you send to support@iocodo.com and our replies.

  Personal information transferred: your email address, your message and anything you attach, and our replies.

  Countries: the United States and other countries where GoDaddy and its sub-processors work, which GoDaddy's privacy notice does not name.

  When and how: when you send us an email or we reply to you, over the internet.

  Contact: Office of the Data Privacy Officer, 100 S. Mill Ave, Suite 1600, Tempe, AZ 85281, United States, privacy@godaddy.com.

  How to refuse: do not write to us by email; to remove the emails you already sent, ask us to delete them.

  If you refuse: we cannot answer you or receive your question reports by email, and the app works the same.

  Sub-processors: the list published by GoDaddy Operating Company, LLC

Where we process it: we have no servers of our own: the company above stores this personal information for us, in the countries named for it.

Destruction: when the period in How long we keep data ends, or when you ask us, we delete the personal information without delay, permanently and so that it cannot be recovered. We keep none of it on paper.

Automatic collection: the app collects information automatically through the software development kits (SDKs) of these services. What each one collects is listed in Who receives data, and how long it is kept in How long we keep data.

• Google Analytics for Firebase
• Firebase Crashlytics
• Firebase Installations
• Firebase Remote Config
• Firebase App Check
• Firebase Hosting

Firebase Cloud Messaging receives data only when you turn on News from Dronelix in Settings, or once after an update from a version before 1.0.6, to delete the notification token that version may have created: that is not automatic collection.

How to refuse: usage statistics (Google Analytics for Firebase) and crash reports (Firebase Crashlytics) are on by default in Korea, and you can turn them off at any time in Settings > Privacy choices. The other services in this list are needed for the app to work: to refuse them, stop using the app and delete it. You can also write to us at support@iocodo.com.

Your requests: you can make the requests described in Your rights. If you are in Korea, we answer within 10 days, not one month. A legal guardian of a child under 14 can make the same requests for the child.

Privacy officer: IOCODO LLC, Privacy team, support@iocodo.com. You can also send complaints about how we handle personal information to this address.

South Africa

If you are in South Africa, you can object at any time to our use of your personal information. In Settings > Privacy choices, you can turn off usage statistics (Google Analytics for Firebase) and crash reports (Firebase Crashlytics); for any other use, write to us at support@iocodo.com. You can also lodge a complaint with the Information Regulator: Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191, South Africa; email POPIAComplaints@inforegulator.org.za; telephone +27 10 023 5200.

14. Children

Dronelix is not meant for children under 13.

The app never asks for your date of birth. Where it asks before it starts usage statistics or crash reports, the button that allows them states the age from which your consent counts in your country, between 13 and 18 depending on the country; when your phone points to more than one country, the highest of their ages applies. If you are younger, do not allow them: the app works the same.

If you think a child has given us personal data, write to support@iocodo.com and we will delete it.

15. "Do Not Track" and other companies

Some browsers and devices can send a "Do Not Track" signal. There is no common standard for responding to it, so neither Dronelix nor this page changes what it does when it receives one. The choices described in this policy are how you control your data.

In the current version of Dronelix, only the service providers listed in Who receives data receive data from the app, for the purposes listed there. We do not let other companies use Dronelix to collect personal data about your activity over time and across other apps and websites.

16. Changes to this policy

We update this policy when Dronelix or the law changes, and the date at the top shows when the current version took effect. If a change affects how we use data we already have about you, we tell you in the app before it applies, and we ask for your consent again where the law requires it.

This version was last updated on October 20, 2026.

Earlier versions: 2026-10-06, 2026-08-09

17. Contact

IOCODO LLC
Postal address: 30 N Gould St Ste N, Sheridan, WY 82801-6317, United States
Email: support@iocodo.com
Report criminal or illegal content: iocodo.com/report/
Our company details and the person in charge of data protection (the Managing Member of IOCODO LLC): iocodo.com/contact/
Impressum (legal notice for Germany): iocodo.com/impressum/