Your time.
Your data.

Who is responsible

Quitok's data controller

Sonia Capdevila, Barcelona (Spain)

Privacy contact

info@quitok.es

Your local profile, journal and app selection are stored on your iPhone. If you enable a private backup in your account, only the data described under Private backup are sent, with specific permission. If you choose Claude and give permission, messages from that conversation are sent as explained under Chat. If you use Groups or Family, the controller processes the data described in those sections. Supabase acts as a processor and the project’s main database is in the European Union. Request-handling functions may run in other regions depending on Supabase routing; the database location does not guarantee that all processing takes place in the EU. Alerts are delivered through Apple’s notification service. Optional nature downloads contact Pexels as explained below. Apple, Anthropic, Pexels and services where you choose to save a copy have their own privacy terms.

What is stored on your iPhone

• Your profile: your chosen nickname (your full name is not required), mode, companion and its name, daily goal and an estimate of usage.
• Your birthday, if you add it to your local profile, is optional. It is stored on the iPhone and can be included in the private backup only if you authorize it. Groups accounts separately store your birth month and year and require you to be at least 14. To apply age requirements for Claude, ads, private backup or the Family map, the app may ask you to explicitly confirm the profile’s month and year before storing them privately on the server. Confirming age for one feature does not enable the others or share your location. The teen-chat flow cannot replace a date already recorded in the account. Confirmation does not create a public profile or verify identity or age.
• Your activity in the app: journal, breathing and focus sessions, books, garden, night schedule, points, accessories, chat plans and your conversation with your companion.
• Journal drafts: text and mood that you have not yet saved, separated by date and profile. They remain on this iPhone so you can resume editing when you return. Simulation drafts exist only in memory.
• Next planned session and reminder time: if you choose when to do your next session, Quitok stores only that date on this iPhone and, if reminders are enabled, schedules a local notification. It is not included in the backup. Your chosen journal reminder time is part of your preferences and is included in the backup.
• Personal schedule and streak: automatic blocking times, days, time zone and activation are stored on this iPhone and shared with the extensions that apply protection; the schedule is not included in exported backups or sent to the server. Your personal streak adds one day for each local date on which you open Quitok, at most once per date; it does not depend on completing sessions or writing in the journal. Its visit record is stored locally and may be included in a backup you authorize. Family streaks follow their own usage and care rules.
• Screen Time: with your permission, iOS stores your selected apps using protected identifiers; Quitok does not see their names. Quitok receives notifications when usage reaches certain thresholds to apply breaks and calculate your points. This is an estimate in five-minute steps, not a record of every app opening.
• Usage report for all your apps: an Apple extension displays it within the app, and it does not leave that extension.
• Diagnostics: a brief record of what protection does, without app names, to help understand a problem.
• Data from earlier test versions: this version does not sell credits or charge for changing companions. If a credit balance or verified transaction identifiers already existed on the device, they may remain in its keychain, separate from editable backups.
• Library routines and break preferences. An exported backup may include their settings, but the protected identifiers for allowed apps stay on this device.

Optional general evaluation and optional ads are explained separately below. Notifications, widgets and the lock screen may show your companion’s name or image; you can change this in iOS Settings.

Optional ads for backgrounds

Optional Google AdMob ads let you try a background in versions that enable them. Availability depends on the version, mode and privacy choices: some iOS versions keep access limited to adults; versions that support minors apply the protections described here. Ads are unavailable in simulated profiles. The app shows whether they are available, and the provider may limit inventory. Declining ads does not prevent you from using Quitok or its free backgrounds.

Personal mode requires a confirmed account and a valid declared age in both the profile and the server. If the account has no age declaration, Quitok asks you to explicitly confirm the month and year before storing them privately. A date already recorded in Groups or the private declaration may be reused without changing requirements for other features. If the ages differ, the protection for the younger age applies; without a valid age, no ad is requested. In new versions, ads are limited to general-audience content (G), and everyone under 18 receives Google’s child treatment, including teenagers. Google receives the treatment settings, not the birth date. These settings do not replace any required consent or authorization.

On a phone linked as a Family child device, versions that include limited ads do not ask the adult for an additional permission to watch them. The option is enabled by default but does not play ads by itself: the child voluntarily chooses to watch one. The household adult can disable it in the profile settings, and that choice is kept when the phone is unlinked and linked again. This option does not enable chat, the map or Screen Time authorization. Quitok does not ask for another birth date for it: it applies child treatment and general-audience content (G). Tapping an ad may open the advertiser’s page or an external store. If the adult disables ads, no new exposure is loaded.

Before loading an ad, Quitok checks privacy choices and any notices or consent required for the requested treatment. For people under 18 and Family child phones, new versions request limited ads (LTD), in addition to child treatment and the general-audience content filter. Limited ads disable personalization and advertising features that need local identifiers. Adult ads are requested as non-personalized ads (NPA), preserving the provider’s privacy choices. Publisher first-party identifiers are disabled. Quitok does not request iOS tracking permission or grant consent on anyone’s behalf. It does not add your account, birth date, journal, conversations, family data, points, Family map places or phone usage to requests. If the provider does not allow ad requests, no ad is loaded.

Non-personalized does not mean no data. Limited ads still need connection data, such as the IP address, to deliver the ad, and SDK code or creatives may be stored on the device. If Google has programmatic limited ads enabled, it may use cookies or local storage only to detect invalid traffic and fight fraud. Adult NPA ads may also use identifiers or storage for frequency capping and aggregated reporting where applicable. Google may process interactions, crash and performance data to serve and protect the service, and process data outside the EU under its terms.

Google Privacy · How Google uses information from apps · Google limited ads

The minute system accumulates 60 seconds of approximate exposure to completed ads to try the chosen background for 24 hours from the grant. An ad may last more or less than a minute, and several may be needed. The counter estimates time with the ad on screen and the app active; it does not certify video playback duration. Time only counts after the provider awards the reward and the server verifies its signed confirmation and the time reported by the app. Closing an ad before earning the reward adds no time. The trial does not permanently purchase the background.

To verify the reward, the only value Quitok adds to the Google request is a random reference for that attempt, not an account or child identifier or the device credential. In personal mode, Quitok’s server links it to your account, the background, request and grant times, the seconds reported by the app and accumulated session progress; it also stores a cryptographic hash of the transaction ID to prevent duplicate rewards. These records are kept for up to 30 days from creation and deleted by the next daily cleanup, normally within 31 days if maintenance is operational, or sooner if you delete your account. A maintenance failure may delay physical deletion. They are account-linked data, not anonymous statistics.

In Family, the server links these records to the child profile and its device within Quitok; Google receives only the random attempt reference. Attempts and sessions are kept for up to 30 days from creation and deleted by the next daily cleanup once no confirmation remains within its allowed window and no reward is active, normally within 31 days if maintenance is operational. Unlinking the phone deletes its ad records and preserves the adult’s choice about availability; deleting the profile also deletes that choice. Disabling ads blocks new requests and prevents pending attempts from granting new rewards. A reward already verified keeps its 24-hour expiry. Maintenance failures may delay physical deletion. These records are linked to the profile and device within Quitok, not anonymous statistics.

When the provider offers privacy choices, you can review them from the background selector’s privacy control. You do not need to watch another ad to do so. Withdrawing consent stops new requests according to your choice without deleting a reward already granted. In Family, the adult can enable or disable the ad option in the child profile settings. Providers may retain technical and security data under their own terms. Ad choices are separate from Claude and general validation; ad data is not used to measure health improvements or Quitok’s effectiveness.

Unity Ads is an optional alternative in versions that include it. Initial availability is limited to confirmed accounts with a declared age of at least 18 and excludes paired Family child phones. Before contacting Unity, Quitok requests specific permission, separate from Google permission. Contextual, non-personalized ads are requested; this permission does not replace regional notices or choices the provider must offer. Availability depends on service configuration and review. Declining or withdrawing this permission does not prevent use of Quitok or free backgrounds.

Unity may process technical device and connection data, IP address and approximate location derived from it, identifiers permitted by the system, advertising interactions, and performance or error data to serve and measure ads, prevent fraud and operate its service. Quitok does not attach phone usage, map coordinates, Family data, journal entries or conversations. Access to the advertising identifier is not requested through the iOS tracking permission. This does not mean that no data are processed or guarantee anonymity. Unity may process data internationally under its privacy policy.

With Unity, one completed video confirmed by the provider’s signature unlocks a background trial for 24 hours from the grant. Google’s 60-second counter is not used and no particular video duration is promised. Quitok sends a random reference for one attempt, not your real account identifier. The server links that attempt to your account and background to verify the reward and prevent duplicates. Attempts and confirmations are kept for up to 30 days and deleted at the next operating daily cleanup, normally within 31 days; identity-free replay-prevention hashes have the same technical retention period. Deleting an account removes its associated attempts and permissions, but those hashes may remain until cleanup. Permission is retained while the account exists and can be withdrawn in ad privacy options. A maintenance failure may delay physical deletion and blocks new exposures. Already verified rewards retain their expiry.

Unity privacy

General Quitok evaluation (optional)

When this option is available, you can opt in separately in Settings → Privacy → Help improve Quitok. Creating an account, joining Family, using Claude or completing another introduction does not activate it. The first individual version requires confirmation that you are at least 18; it does not automatically enroll minors or replace authorization by their representative. You can use the whole app without taking part.

The purpose is to evaluate usage trends across Quitok, with or without a companion, and prepare grouped results to improve the product and explain its limits. With your consent, 28 days of summaries are sent to Supabase: confirmed selected-app minutes rounded down to five minutes, pause and pass counts, mode, version, day number and coverage quality. No names, email, birth date, account, selected apps or their identifiers, journal, conversations, family details or reports from Apple’s Screen Time extension are sent. These summaries are not sent to Anthropic.

A random key lets us compare your days without linking them to an account: records are pseudonymous, not fully anonymous. The withdrawal key is held only on this phone and excluded from backups; uninstalling before withdrawal may lose it. To prevent abuse, a daily cryptographic digest of the connection address, keyed with a server secret, is retained for up to three UTC dates; the untransformed address is not stored in the evaluation tables. The provider may keep technical connection logs according to its configuration.

Collection starts at the midnight following confirmed enrollment and lasts 28 local dates. Summaries already collected can be uploaded within 30 days of permission, without measuring extra days. Records expire after 90 days and are purged in the next daily maintenance. Withdrawal stops collection and requests immediate deletion; while offline, only what is needed to retry is retained. After deletion, a protected digest of the key remains for 90 days to reject delayed uploads, without the summaries. Already published grouped results may be retained. The controller and privacy contact are listed at the start of this page.

Thresholds are an observed lower bound of selected usage, not total phone time. Days 1–7 are compared with days 22–28 using at least five weekday pairs from the same segment, mode, version and source. Changing apps or rules starts a different segment. Incomplete or missing days are not treated as zero. Results are hidden unless there are ten comparable participations and no published cell contains between one and nine participations. These are observations from a voluntary sample of installations, not verified unique people or causal or clinical evidence. Protection is not disabled to create a before-use period.

Quitok help chat

Read the chat terms

You can use the local guide without sending messages outside your iPhone. Previous Apple Intelligence history may remain stored locally. Claude requires a confirmed account and displays the applicable balance or limits. Eligible AI access uses a daily balance, without promising a fixed number of replies; free access retains daily, monthly and shared service limits. Anthropic is identified and explicit permission is requested before the first message; you can choose the local guide or withdraw permission from the chat.

Through Quitok’s server, Claude receives the message you approve, a limited context of messages in that conversation written after consent, and the chat’s visual mode. Earlier conversations, your name, birthday, motivation, memory, journal, selected apps, usage metrics, achievements and family data are not automatically forwarded. Avoid writing private information about yourself or children. The response cannot change protection, make purchases or alter schedules.

History is stored on the iPhone, and new Claude conversations are separated by account. Supabase checks the account and retains counters, dates, identifiers, request fingerprints and costs to enforce limits and avoid duplicates. Quitok’s backend does not store input messages. A response may be temporarily stored so it can be recovered after a connection failure: it becomes inaccessible after 24 hours and, while hourly maintenance is operational, is normally purged before 25 hours. This chat’s metadata without text is retained while the account exists; deleting the account removes its associated records. Global spending counters without account identifiers may remain to control the service budget.

Anthropic’s API processes messages through global routing, without a guarantee that processing will take place exclusively in the European Union. Its standard retention period for inputs and outputs is up to 30 days, with contractual, safety, compliance and legal exceptions; flagged content may be retained longer. See its retention notice and privacy policy. Withdrawing permission stops future submissions; it does not retroactively withdraw those already processed.

Personal chat for adults requires an account with a declared age of 18 or over, calculated conservatively from the stated month and year. This declaration does not verify identity or age. If you already have a Groups profile, its declared date and account status are used; the private AI date cannot bypass those restrictions. Without that profile, confirming the date does not create a public name or add you to Groups. The private month and year are not shown to other users or sent to Anthropic and are deleted when the account is deleted. Separate access for teenagers aged 14–17 is explained below; the app shows its availability in each beta. Linked Family child devices do not gain that access simply by being linked. Local guidance and plans may use iPhone summaries; these are not automatically attached to Claude.

The chat can make mistakes. Quitok is a digital wellbeing tool, not a medical or emergency service.

Anthropic data retention · Anthropic privacy policy

Chat for ages 14–17 and permission by code or QR

Quitok includes a code or QR permission flow for chat for ages 14–17. Permission and chat access are enabled separately; the app shows each feature’s availability in the beta you use. Local guidance remains available. Generating a code or obtaining permission does not enable Claude or send messages to Anthropic. A Family subscription is not required. Availability in a beta does not guarantee that all chat responses are safe or suitable.

Access requires a teenager aged 14–17 to have their own account with a confirmed email. The account’s declared date is reused, or explicit confirmation of the month and year already in the local profile is requested before storing them privately on the server. This flow does not allow an already recorded date to be changed. If the required date is missing or requirements are not met, local guidance is offered.

The teenager can generate a 12-character code and a QR in the app, valid for 15 minutes. The adult reviews them in their own app by scanning the QR, opening a photo or entering the code. The adult’s email is not requested and no invitation is sent. Opening or reviewing the request does not grant permission. Creating another code replaces the previous pending request, without a normal 15-minute wait or a three-request daily limit. An active adult approval is preserved and not reset by renewal. Brief anti-abuse controls remain; the app shows when to try again.

The adult must use a different account of their own, free of charge, with a confirmed email and a declared age of at least 18, review the data use and declare that they are an authorized parent or legal representative. Family membership or a subscription is not required. Account control and that declaration do not verify identity, actual age or legal guardianship. Permission does not give access to the teenager’s conversations or messages through Family.

Before approval, the adult will be shown an alias for the permission. After approval, the teenager will see the same alias and must compare it with the one on the adult’s phone, confirm that it belongs to that person and separately accept the use of chat. The confirmations are bound to those two accounts, the permission and the version of the accepted information. Adult approval consumes both the code and QR code at the same time, so neither can be reused.

Anthropic will receive the messages needed for the conversation and its limited context through Quitok’s server, together with safety instructions and the visual style. The input text and reply will also be sent to Anthropic for automated moderation. These controls can fail and do not guarantee that a reply is suitable. GPS location, contacts, phone usage, reports, journal, name, birthday and account or family identifiers will not be automatically attached. If you write personal data in a message, it will be sent; avoid doing so.

Supabase will retain both account identifiers, permission status and dates, the adult’s alias, the binding of confirmations, and accepted declarations and versions. The alias is a reference to that account for that permission, not a name or proof of identity or guardianship. Permission will last at most 365 days; material changes will require renewed adult authorization and teen acceptance. Permission evidence will be kept while valid and removed once more than 90 days have passed since expiry or withdrawal, at the next operational hourly cleanup. Technical request records and individual chat counters will be removed once older than 90 days, at the next cleanup.

The code and QR code are shown only temporarily on the device and are not saved in backups. To check them, the database stores only their cryptographic hashes, not the original code or QR token. Both expire after 15 minutes and are invalidated when the request is approved or withdrawn. Expired hashes are removed at the next operational hourly cleanup, normally within 75 minutes of creation. Expiry prevents authorization even if physical deletion is delayed.

Lookup and approval attempts, including incorrect codes, are counted in 15-minute windows to limit abuse per adult account and across the service. These counters do not include codes, conversations or location. They are removed once older than 24 hours, at the next operational hourly cleanup, normally within 25 hours.

Quitok’s server will not store input messages. An approved reply may be cached temporarily to recover a request: it will become inaccessible after 24 hours and be deleted at the next operational hourly cleanup. Withdrawing permission will erase these recoverable replies. Anthropic’s timeframes are separate: the retention and international processing explained under Chat also apply to moderation. There is no promise of anonymity or of Anthropic deleting messages within 24 hours.

The adult who granted permission and the teenager will each be able to withdraw it in the app, even while chat is disabled. The adult will see a permission reference and its status, without messages. Withdrawal will stop new sends but will not retract messages already received by Anthropic. Deleting either account will remove the associated permission and recoverable replies from this access. Chat is limited to phone habits, study and breaks; it can be wrong and does not replace professional help or emergency care.

Linking a teen account to Family chat credit

This link is optional and only assigns the chat allowance associated with a Family with AI profile. It does not give the adult access to conversations. Sharing the adult who authorised chat does not by itself establish a family relationship.

It requires a confirmed account for a teen aged 14–17, a current accepted chat permission, verification from the phone paired with the profile, confirmation by the adult who authorised that chat and belongs to the same household, and a final acceptance by the teen. It does not replace or expand chat permission.

We store account, adult, household, profile and device identifiers; the permission reference and version; the state, revisions and dates of each confirmation; and technical verification data and temporary codes. This link contains no conversations, locations or app selections.

The request expires after ten minutes. An active link is retained while it remains valid. After expiry, rejection or withdrawal, its metadata is removed at ninety days through scheduled cleanup. Expired verification stops working at the deadline; codes and their hashes are removed during the next cleanup. Deleting the account, household, profile or device also deletes the corresponding link. Cost accounting for requests already started is retained for the periods described in Privacy.

The teen or the adult who approved the link may withdraw it. This removes access to that allowance without automatically revoking independent chat permission or disconnecting family controls or the map. Additional credit is checked again when requesting a response and may become unavailable if permission, device, household membership, age, plan or capacity changes.

What leaves the iPhone only if you choose

• Progress summary (Progress): you can share text through the system share sheet containing the 7- or 28-day period, sessions and recorded focus minutes. It does not include names, selected apps, activity titles, journals or conversations. You choose the destination; it is not sent automatically.
• Nature videos (breaks without a pet): tapping Download requests the file from Pexels. That service receives your IP address and technical connection data, without your profile, journal, conversation or app selection. Quitok does not use cookies or credentials for these downloads. Afterwards, the video plays from a local cache that you can delete and that the system may purge; it is not included in your backup. Links to the creator and licence open Pexels when you choose them.
• Export a local backup (Settings): creates a readable file with your profile, progress, journal, sessions, conversation, plan and preferences, including chat memory if enabled. You choose where to save it or whom to send it to; keep it somewhere private. It excludes unsaved journal drafts, permissions, protection status, protected app identifiers and any credits from earlier test versions. This is separate from the private backup in your account, which excludes chats.
• Diagnostic report (Settings): technical text containing protection events and the app and iOS versions, which you can send to help resolve a problem.

A copy you have shared is under the recipient’s control. Deleting Quitok does not delete that copy from their storage.

Read the Pexels privacy policy

Private backup in your account (optional)

From Settings › Account, you can enable a free private backup if you are at least 14 and have an account with a confirmed email. The app shows its availability in each beta. You do not need to create a Groups profile or subscribe to Family. Creating an account or signing in does not enable backups or restore your progress automatically. Specific permission for the data to be stored is requested before the first upload.

This backup includes your profile, progress, personal streak, achievements, books, sessions, preferences and saved journal. The journal may contain sensitive information: review what you have written before authorizing its upload. It excludes conversations, chat memory or plans, location or other Family data, credentials or access keys, protected app selections and their identifiers. It is not sent to Anthropic or advertising providers.

Supabase stores the file linked to your account in Quitok’s main database in the European Union, with access restricted to that account. It is not shared with your groups or other Family members. The warning above about functions being routed to other regions still applies. This is not an end-to-end encrypted backup: the server processes the file to store and return it.

Once enabled, Quitok checks for changes approximately every 60 seconds while you use the app in the foreground and when you reopen it. A new version is saved only if the content has changed; changing the export timestamp alone does not create another copy. Continuous backup while the app is closed is not promised. If the signed-in account changes, new uploads are suspended until you explicitly authorize which local progress to copy again.

At most three versions are kept per account, each up to 2 MB. Each version becomes unavailable for viewing or restoration 90 days after it was saved. Hourly cleanup deletes expired versions, normally within one additional hour when maintenance is working; a failure may delay physical deletion even though reading is already blocked. Saving a fourth version removes the oldest versions exceeding the limit of three. If the file exceeds 2 MB, your history is not truncated: you can use local export.

You can disable backups from Settings › Account. Withdrawing permission stops future uploads but does not delete versions already saved: they remain subject to the 90-day limit and cleanup described above. Signing out suspends new backups without deleting local progress. Deleting your Quitok account also deletes its private backups and associated record; signing out or deleting the app does not remove the account from the server.

Restoring a backup requires confirmation and merges its data with this iPhone’s data using Quitok’s import checks. It does not itself enable new uploads or delete local progress. If that progress was linked to another account, the app warns you before asking permission to save it to the current account. Check which account appears under Settings › Account before enabling or restoring a backup.

Family (validation access)

An adult can create a private account and link their child’s phone using a temporary invitation and Apple’s parental authorisation. The child does not need a social account. The project’s main database in the European Union stores the adult’s email address, family name, chosen names or nicknames, schedules, daily budget and its allocation into passes or phases, extra-time requests and responses, extra minutes granted and the agreement day they relate to, device linking, the version’s ability to enforce budgets, status and last connection. Validation access allows up to four adults, including the creator, with their own accounts; in purchased plans, the number of adults and profiles depends on the chosen plan. Their access, aliases and invitations are stored. Invited adults can view and manage child profiles, schedules, budgets, extra minutes, requests and statuses; the child’s phone receives only its own profile and agreement. Each adult’s personal journal and progress are not shared.

The adult can choose a daily total and divide it into passes or phases of use and breaks. A pass reserves its duration when activated; in phases, detected usage is deducted and breaks do not consume the total. Study and rest schedules take priority. With an active budget, extra time granted applies only to the agreement day. Configuration is stored on the server; selected apps and counters for usage, passes, cycles and breaks remain on the child’s phone. The adult dashboard does not receive that usage history.

The child’s pet stores its name, appearance and care days only on that phone, separately from the adults’ personal profiles. Caring for it does not grant extra time or change the rules. Family does not send names or identifiers of selected apps, journals, conversations, content or detailed Screen Time reports. Creating a family does not enrol anyone in studies. Device keys are stored in the keychain, and the server retains a protected fingerprint. Apple may deliver silent update notifications.

Phone invitations last ten minutes and adult invitations last 24 hours. Adult invitations are purged once they have been expired for more than seven days. Requests expire after one hour and are retained for up to seven days. Technical rate-limit records, expired invitations and notification destinations for revocations are purged through hourly maintenance, with retention periods of up to one day. Schedules, budgets and profiles remain until the adult deletes them. The server retains the latest bonus and its date until the next grant or deletion of the profile; this does not create a usage history. Providers may retain technical logs according to their service configuration.

To disconnect from the child’s phone, the server stores a request linked to the device, profile and household, its status and timestamps, the approving adult, and hashes of the credential and code. The six-digit code is returned only to the adult and is not stored as plain text; it lasts up to five minutes, within the original request’s ten-minute limit. Expired requests are purged through the existing hourly maintenance. This process does not send location data or chat conversations.

Adults can unlink phones and delete child profiles. Only the person who created the family can invite or remove adults and delete the family. Collaborators can leave without losing their account or their personal Quitok. Deleting a collaborator’s account removes their access and notifications; deleting the creator’s account also deletes the family. An offline phone removes its rules when it receives the removal notice; until then it retains the last schedule. Changes and notifications may be delayed, and the dashboard shows the last confirmation received. To exercise your rights, use the controller’s contact details on this page.

Family plans and payments

When subscriptions become available, the account holder will be able to choose a plan for their household through Apple’s in-app purchase system. Apple handles payment: Quitok does not receive your card or bank details. The server verifies the purchase and retains App Store transaction and customer identifiers, the product, dates, renewal, expiry and any refunds, linked to the household to share its benefits correctly and avoid duplicate charges. Proof of purchase does not include children’s names, journals or usage data.

Deleting your account or family does not cancel an Apple subscription. You can manage renewal in your Apple account settings. Minimal verification records may be kept separately from the deleted profile to reconcile purchases and restore them using valid proof from Apple; they do not retain the deleted account’s email address or identifier. To exercise your rights regarding these records, contact the controller with your purchase reference, without sending full payment details.

Family chat for adults

When Family chat is enabled, it will be separate from personal chat and reports. It requires an adult account aged 18 or over, membership of the household and a supported family plan. Before use, the provider, processing destination and data retention are shown, and a separate authorization asks you to confirm that you are an authorized parent or legal guardian. Entering Family or completing its introduction does not grant that permission.

Only the messages you choose to write and a limited context from that conversation since authorization are sent to Anthropic. Chat does not automatically attach names, child profiles, selected apps, your journal, earlier conversations, agreements, charts or usage data. Avoid entering private information about children. The active conversation is held in memory on this iPhone and separated by account and family; the server does not store input messages. Recoverable replies and their metadata follow the retention, recovery and deletion periods explained for chat. You can withdraw permission and stop future sends from its options.

Family chat with eligible AI access uses a daily balance per person and a shared household limit. This balance is not subject to the free tier’s global cap and does not guarantee a fixed number of replies. Free access retains daily, monthly and shared service limits. The app displays the available balance or limits; requests sent to the provider may consume them even if the reply fails. Reports require Family with AI and retain their own limits, a preview and fresh permission for the specific aggregates. Using chat does not authorise a report or send dashboard data. No reply automatically changes protection, schedules or adult decisions.

Recommendations for adults with Family with AI

Recommendations are an optional feature separate from the personal chat. They require an active family plan with AI and an adult account. This age requirement is checked before starting an AI purchase; a family account without a group profile can confirm it using the private month and year explained above. Before each consultation, the adult sees the specific data and confirms that they are authorised to share it: configured budgets and routines, and counts of time requests and decisions from the last seven days. They are sent to Anthropic with generic labels such as ‘Profile 1’. Names, child identifiers, routine titles, dates of birth, conversations, journals, selected apps and actual usage records are not attached. The aliases shown in the dashboard to identify profiles are excluded from the request to Anthropic.

The AI does not measure the child’s phone or change its rules automatically. It offers ideas that the adult decides how to use. Each household has one consultation per day and four per month, shared by its adults; attempts sent to the provider also count if the response fails. Server responses have the same recovery and purge periods described for the chat. Each consultation’s records are deleted when the account that made it or the family is deleted; the household’s shared counters remain until the family is deleted. These are not anonymous data while linked to the household.

The latest recommendation, its date and the identifier of a pending consultation may also be stored on this iPhone, separated by account and family, to recover a response or read it again without using another consultation. They are not included in the exported backup. Signing out hides the recommendation; resetting local data or deleting the account from this iPhone removes that copy. Deleting the account from another device does not remotely erase files on this iPhone. Access to the history requires checking that you are still an adult household member; the saved recommendation is not sent back to Anthropic.

Family map and location (optional beta)

The Family beta includes an optional map, places and a manual “I’ve arrived” check-in; the app shows each feature’s availability. Sharing does not start when you create an account or enter Family. It requires the adult’s authorization for that child and separate acceptance on the linked device, both valid. The adult needs an account with a confirmed email and a declared age of at least 18; confirming age does not enable chat or share location. The iOS “While Using the App” permission allows a location to be shared. Attempting to detect arrivals and departures while the app is closed requires “Always” and precise location. After detecting a zone entry or exit, Quitok may start a location check lasting up to 2 minutes, with the iOS indicator: at most two points at least 65 seconds apart. It does not store routes or track continuously. iOS may prevent it from starting or suspend it; alerts depend on accuracy, connectivity and platform conditions and are not guaranteed. Stopping sharing immediately stops local capture; remote withdrawal and deletion can only be confirmed upon contacting the server. Location does not certify presence. The manual “I’ve arrived” check-in needs no GPS and does not verify that someone is in a place.

When sharing is authorized, Quitok’s server in Supabase stores the last shared latitude and longitude, accuracy, capture and receipt times and permission status, linked to the device and child profile. Adults can save up to five places with names, coordinates, radii and alert preferences. No route history is stored. The map uses Apple MapKit, also subject to its services’ terms.

Authorised adult household members can view shared child positions. The child’s phone map shows their own latest position and those of adults who have agreed to share with linked children; the previous permission does not reveal siblings’ positions. Changing household adults invalidates previous permissions and deletes positions, events and places: authorisation must be given again. Locations, places and alerts are not sent to Claude or used for advertising or Quitok’s general validation.

An adult can share their own latest position through a specific confirmation: household adults and linked children will be able to see it. The iPhone requests location permission separately. The adult’s position updates only when they ask to share it or tap “Update my position” with the app open; their route is not followed in the background, and no adult arrival or departure alerts are generated. They can stop sharing from the map. Changes to members or linked devices invalidate the previous acceptance and delete their latest position; sharing again requires a new confirmation.

In versions with estimated arrival detection, two consistent samples within the chosen radius may confirm entry; departure uses an outer margin to reduce changes caused by inaccuracy. Tapping “I’ve arrived” is not required for these automatic alerts. To distinguish arrival from an initial position, the server retains each child/place’s last confirmed side and its date, without additional coordinates, for a logical maximum of seven days. A pending candidate expires after 15 minutes. Daily cleanup of the confirmed state uses a six-day threshold to normally keep physical deletion within seven days. Withdrawing permission, changing adult members or deleting the place removes the corresponding state. This does not extend GPS-position retention or guarantee an immediate alert upon crossing the radius.

A position is no longer shown more than 24 hours after capture. Daily maintenance removes stored points older than 24 hours, normally within 48 hours of receipt. Arrival, departure and manual check-in events are no longer shown after seven days; daily cleanup removes events older than six days, normally before seven days. Configured places remain until deleted, the household is deleted or its adult membership changes. Counters without coordinates and minimal technical records for abuse prevention or alert delivery are removed by daily cleanup, normally before eight days. Maintenance failures can delay physical deletion, so the server closes the feature if it cannot confirm a recent successful cleanup.

You can stop sharing from the iPhone even while offline: local readings and region monitoring stop immediately. Remote deletion is confirmed when connectivity returns; meanwhile a point already sent may remain visible to adults until it expires. Disabling sharing from the household while online removes the child’s position and events. It does not by itself delete the household’s shared places. Unpairing or deleting the profile removes its location information from the server.

Automatic arrival and departure alerts depend on sufficiently accurate observations, connectivity and iOS allowing the app to run. Their operation on real devices remains to be checked in this beta; they may be delayed or not occur. When notifications are available and the adult accepts them, lock-screen alerts will be generic, without the child’s name, place or coordinates. This map is not an emergency service and does not guarantee that anyone will see or respond to an alert.

Private Family photos (optional)

An adult can choose their own photo and a child profile’s photo to recognise them in profiles and on the map. The iOS picker lets you select an image without granting general access to your photo library. Before uploading it, Quitok creates a copy of up to 512 pixels and 256 KB; the server validates the JPEG again and removes metadata, including EXIF or GPS information. The original file is not sent.

The copy is stored privately in Supabase, and every read requires a fresh check of access to the household or child device. It has no public address or reusable link. Authorised household adults can see the photos. The child’s map shows only their own profile and the adults visible under their current permission. The child cannot modify other people’s photos. These images are not sent to Claude, advertising services, Groups or the general validation protocol.

Changing or removing a photo immediately withdraws server access to its previous version. A technical queue then deletes the stored object with bounded retries; service interruptions can delay physical deletion. Deleting a profile, leaving the household or deleting an account withdraws the corresponding access and schedules removal of its images. The iPhone uses temporary in-memory views only, without keeping a copy in the app’s image cache. You can remove the photo and continue using Family.

Friend groups (optional)

If you create an account to compete in groups, Quitok’s main database (Supabase, in the European Union) stores:

• Your account: email address, account identifier and username. If you register with a password, the authentication service protects your sign-in details. We also store month and year of birth to check that you are 14 or over.
• Signing in with Google or Apple: the provider confirms your identity and email address. If you sign in with Google, Supabase may also retain your name and a reference to your profile photo as authentication data. These details do not replace the username and avatar you display to your group. Native Sign in with Apple requests your email address and lets you hide it.
• How you appear: your companion, its stage and accessory, or your landscape if you use Quitok without a pet.
• Your groups: which ones you belong to, your role and which users you have blocked. We do not access your iPhone’s address book.
• Daily minutes for what each group measures, and weekly results. The leader enters the agreed apps or categories, and that rule is stored with the group. Each member’s protected selection remains on their iPhone: the names and identifiers of their selected apps are not sent.
• What you write in the group: chat messages (text only, deleted after 30 days), proposed agreements and your responses.
• Notifications: your iPhone’s notification identifier, language, time zone and quiet hours (night and focus), so notifications arrive in the appropriate language and at the appropriate time.
• Safety: reports and blocks. The controller may review reports and take action, such as hiding a message, removing someone from a group or suspending an account.

Group members can see profiles, daily minutes and weekly progress. Each member can read only messages sent since their current admission: leaving and rejoining starts access again. Before joining, someone with an account and invitation code can see the group’s name, measurement rule, mode, time zone, number of members and leader’s username. This preview does not show messages or usage minutes. There are no public groups, search or private messages.

You can leave a group at any time and delete your account from Settings › Account › Delete account: your account, profile, minutes, messages, proposals and replies are deleted from the server. Previously shared pacts and moderation records may remain without reference to the deleted account’s identifier. The legal basis is the consent you give when creating the account; you can withdraw it by deleting the account.

Account access emails

Emails to confirm an account or recover access use Supabase authentication and its transactional email through Brevo, from noreply@auth.quitok.es. The provider processes the recipient address and the message needed for delivery, and may retain technical records under its settings and terms. These are service emails, not a marketing subscription.

Permission for chat for ages 14–17 is managed through the code or QR described above, not invitation emails. The teenager does not need to provide the adult’s address to request permission, and Brevo does not receive the code or QR through this route. Both accounts must still have confirmed emails. This route does not change the sender or configuration of the app’s sign-in emails.

Brevo may add remote images to measure opens and transform the message format. The anonymization preference requests that opens be counted in aggregate; it does not remove pixels or make the email anonymous. Quitok does not add its own measurement pixels or links to these messages, but this does not prevent the provider from adding them. Successful delivery and domain authentication do not establish the absence of measurement. Technical delivery records are processed separately under the provider’s terms.

Brevo privacy policy · Brevo open measurement

Your choices

You can delete each downloaded nature video from the pause without deleting your history or preferences. Videos are stored in a local cache that the system may also clear.

Under Settings › Account, you can see which account is signed in and sign out. Signing out preserves this iPhone’s personal profile and progress and does not delete your groups or server account; it suspends new private backups and ends that session’s access. You can sign in again using the same sign-in method. You do not need to reset Quitok to change accounts.

To delete your server account, use Settings › Account › Delete account and confirm deletion. The effects on Groups, Family and private backups described above apply. Deleting the account does not automatically erase the personal profile, journal or progress kept on this iPhone; signing out or deleting the app does not remove the server account either. Uninstalling removes app data, but Keychain data may remain, including any credits from earlier test versions.

You can withdraw Screen Time and notification permissions in iOS Settings at any time.

Your local profile and journal are stored on this device and are included in a remote private backup only if you authorize it. Protected app selections are not included in that backup. Groups, Family and optional chat with Claude involve the remote processing described above. For Quitok’s remote data, you can request access, correction or deletion through the contact above, or delete the account yourself. Withdrawing Claude permission prevents future sends; Anthropic’s retention periods and terms also apply to data already processed. If you have questions, use the contact address. In Spain, you can complain to the Spanish Data Protection Agency.

Spanish Data Protection Agency

Age

The local profile’s birthday is optional and is not shared with the group. Friend groups request month and year of birth and are available only from age 14, the age at which people in Spain can consent to the processing of their own data. The App Store age rating and Apple’s Screen Time controls do not replace family guidance.

If this policy changes

We will publish the new version with its date. If the data sent outside the iPhone or the purposes for which it is used change, we will explain this here and request the appropriate permission.

This website

The website is hosted on ChatGPT Sites. When you visit, the provider may process technical data needed to serve and protect it, such as your IP address, browser information, requested pages and operational logs. It may also use cookies necessary to provide the service.

Cookies and preferences

Quitok saves your chosen style, animation pause and privacy choice in your browser’s local storage. The introduction and page transitions use tab storage. These are necessary preferences, without advertising or visitor identifiers.

Website analytics: your choice

Analytics stays off until you accept it. If you do, we send only the page route and event type: page view or download click. We do not send searches, link parameters, referring websites, names, email addresses or visitor identifiers. We use no advertising pixels or external analytics services.

The server adds these events to daily totals per page. Totals older than 180 days are deleted when new measurements arrive. Your IP address is processed temporarily to provide the service and limit abusive submissions; it is not stored in the analytics database. Your consent is the legal basis for this optional analytics.

Your choice is remembered for 180 days. You can reject analytics or withdraw consent at any time through “Cookies and preferences” in every page’s footer. Withdrawing stops new submissions; previous totals cannot identify you. We also respect your browser’s no-tracking signals.

You can delete all preferences in your browser settings. Style and animation pause are kept until you change or delete them; the introduction and transition end with the tab session.

If you email us, we use your address and the content of your message to reply. You can ask to view or delete those messages at info@quitok.es. Hosting this website may involve processing outside the European Union; this should not be confused with the European location of Quitok’s main database.