Codex name. Codex-like icon. Velqora underneath.

The screenshots tell the story.

All three current original Apple-hosted promotional images are preserved. The first advertises Codex above a Velqora interface; the model selector visibly reads GPT-5.1. Russian interface text is preserved as source evidence, with English captions. These images do not establish which service the executable actually uses.

See all 2 additional screenshots

The Codex name, look-alike terminal icon and Codex-led advertising create a misleading impression of an OpenAI product around a separately sold Velqora workspace.

The name on the listing.

App name

Codex AI - AI Coding Agent

Developer / seller

Despina Markou

Developer country · App ID 6806240560

Unknown · No account-linked business address or registry record. A name, Russian interface or the unexplained “tr” document suffix cannot establish country.

Apple Germany and Ireland provider panels, checked 2 November 2026: Despina Markou has not identified as a trader and no business country is disclosed. E3/E4.

OpenAI’s Codex identity is doing the selling

App Scam DB assesses this as misleading use of OpenAI’s Codex branding. The listing takes Codex as its leading name, repeats it in the subtitle and first advertisement, and combines it with an icon that closely echoes the official Codex terminal symbol and blue-purple palette. The pictured workspace instead identifies itself as Velqora. No explicit independence or no-affiliation disclaimer was found in the checked description.

The side-by-side originals show specific overlap: a right-facing terminal chevron and horizontal underscore, rounded strokes, a luminous blue-purple gradient, a centered emblem and a dark surrounding field. Differences are also visible: the investigated mark is dark on a circular orb, whereas official Codex uses a white mark on a lobed emblem, with dark and light tile variants. These are different drawings with a closely related overall identity. The combined name and visual presentation support the confusion finding; no numerical similarity score is used as a copying verdict.

The same promotion shows GPT-5.1 in the model selector. That is a visible marketing detail, not verification of the actual model endpoint, a Codex agent implementation or OpenAI authorization. The app describes general chat, research, tasks and code assistance; those promises alone do not demonstrate the agent functions of the official product.

OpenAI’s brand guidance prohibits misleading endorsement or sponsorship, bars designing a similar logo within its logo-use rules, and requires its marks not to dominate the operator’s own branding. These provisions are relevant to the observed Codex name, close visual treatment and prominent promotional wording. The report identifies apparent brand and intellectual-property misuse; it does not claim a court judgment or a takedown decision by OpenAI.

OpenAI also publishes Codex integration components, including an SDK and app-server. A third-party developer can therefore build on Codex. The phrase Powered by Codex is not technically impossible in itself; the unresolved issue is whether this app uses it accurately and explains its separate identity clearly.

The verified connection is Velqora

Velqora is not merely a coincidental search result. Its name appears in the currently advertised app window and repeatedly in the privacy-link document, which also names Despina Markou. Those are direct listing-to-product-to-provider connections. They establish a shared product identity, without requiring an assumption about another person.

An indexed AppAgg entry independently labels a Mac assistant Velqora under Despina Markou and associates it with version 1.2, updated 15 September. Its text and legal link match this product. The current direct page exposed only a minimal shell, so the numerical Apple ID could not be recovered there. The record supports the Velqora lead but does not prove a separate app or date the change to Codex.

The present listing is internally inconsistent regardless of whether it was renamed. A dated initial Apple capture showing Velqora and a later Codex capture would be needed to establish the precise transition. This investigation did not obtain that pair and does not present a review-bypass sequence as confirmed.

A coding app links to facial-data video terms

The App Store’s Privacy Policy link opens a document whose Google Docs title is Privacy Policy but whose actual heading is an End-User License Agreement for Velqora: AI Assistant. This is a substantive content mismatch, not an inaccessible link. It names the correct seller but mainly provides a software license, restrictions, warranty-related language and termination terms.

Its data section describes camera/gallery facial images used for AI video generation or animation. It says processing may happen locally or on secure servers, with immediate deletion and no third-party sharing of facial data. The document then points readers to four named privacy sections that are absent from the full exported text.

The material does not explain who receives coding prompts, uploaded source code, project resources or web-search queries, which AI service processes them, or how their retention works. Facial-image deletion promises do not answer those questions. This matters because the app invites users to work with source code and project materials.

The store separately declares identifiers, usage data and diagnostics used for tracking across other companies’ apps and websites. The linked document does not explain that tracking. Its facial-data restrictions are narrow; they should not be misrepresented as a blanket promise that no tracking occurs. The verified problem is missing and mismatched disclosure. The document does not establish that this coding executable actually captures faces.

Who is behind the listing?

Apple identifies Despina Markou, developer ID 6776260251, as the seller. The live US developer page and software lookup expose one current app: this listing. That result describes the checked storefront today; it does not prove the account has never sold another app.

The terms disclose a Gmail owner-contact address. That exact mailbox, the two public document IDs, bundle ID, app/developer IDs and seller/product combinations were searched. Existing local reports were checked for matching identifiers. No independently corroborated bridge to another Apple seller account or registered company was found.

The terms share broad template language with other AI-app documents in the report library. The contact address and document IDs differ. Common boilerplate, Google Docs hosting or a Gmail mailbox are not strong enough to merge operators. Search results for unrelated businesses called Velqora and people sharing the seller’s name were excluded.

No source checked established a previous Apple ban, a second account opened after termination or a separate fraud case by this seller. The actionable findings concern the current listing’s Codex-led identity and privacy disclosures. The account link is supplied below so its catalog can be checked directly.

No disclosed business country

Germany and Ireland both say Despina Markou has not identified as a trader. Neither checked panel supplies a business-country record. The provider name, English/Russian language support and Russian promotional interface do not establish residence or nationality.

The linked EULA ends its governing-law clause with the unexplained text “tr”. That is an incomplete jurisdiction disclosure, not verified evidence of Turkey. The separate terms refer to the owner’s location for law and venue without naming it. No registered company or account-linked location was established, so the report’s country is Unknown.

No dedicated Developer Website appears in the checked listing. The legal links are hosted on Google Docs. Hosted documents can be legitimate; here the concrete accountability problem is the combination of absent business-location information, a mismatched privacy document and incomplete legal drafting.

What buyers are being offered

The public purchase table shows four AI Pro/premium amounts and five token amounts. Repeated labels do not disclose the period for the subscriptions, the number of tokens supplied or the models each purchase unlocks. No weekly-to-yearly calculation can be justified from this record.

The description says subscriptions renew automatically and gives Apple-account cancellation instructions. The promotion separately shows a token balance and a buy-more-tokens control. This supports checking both subscription and usage-credit conditions before paying; it does not establish that the app charges twice for the same service.

A payment to this seller should not be assumed to grant an official OpenAI plan. The investigation did not buy a plan or establish the actual backend, included usage or connection to an existing OpenAI account.

The reviews do not establish buyer deception

The current US review feed returned six entries, all carrying five stars, dated from 22 September to 11 October 2026. They describe coding assistance, brainstorming, project organization and workflow convenience. None of these entries says the buyer mistook the app for official Codex or reports a refund dispute.

The exact-ID lookup reports zero aggregate ratings, while the rendered store says there are not enough ratings for an overview and still displays individual reviews. These are distinct Apple outputs. The report records the discrepancy rather than claiming there are no reviews or inventing a definitive aggregate rating.

The reviews use broadly similar, general language. That alone does not establish coordinated or purchased reviews. No review-authenticity verdict is made; the document and identity mismatches stand independently of the reviews.

What the dated record establishes

The legal documents self-date to 28 August 2026. Apple records the first app release on 9 September, version 1.2 on 15 September and current version 1.5 on 7 October. The source analysis and independent investigation are dated 2 November. A document’s printed date is not independent proof of when it first became public.

The exact current US URL returned a Wayback capture at 16:03:41 UTC on 2 November. Its replay opened. The filtered Velqora slug-prefix query returned no records. The secondary indexed Velqora entry is a useful historical lead, but it does not replace a dated Apple before/after sequence or demonstrate intentional evasion of App Review.

Apple’s accurate-metadata rules 2.3 and 2.3.1, copycat rule 4.1 and intellectual-property rule 5.2.1 are relevant to the dominant Codex branding and implied identity. Privacy rule 5.1.1 is relevant to the document linked as the privacy policy. Subscription rule 3.1.2 is relevant to clear paid-access information. These are grounds for review of the observed presentation; no Apple enforcement decision was obtained.

The records behind this report.

The complete supplied 11-page PDF is appended after this investigation, including all original store, promotional and policy captures. The original source SHA-256 was independently calculated. Current listing records, legal-document exports, Apple reviews, developer catalog and archive index were independently checked. No executable was installed, no purchase made, and no API integration or private account was accessed. The updated comparison adds both original Codex icon variants from the verified OpenAI-signed desktop application; source-resource hashes and signature evidence are retained privately.