Privacy

Quies is built around a single promise: what you write is yours. This page describes — without marketing language — what happens to the data you create inside the app, where it lives, and which limited cases involve a network at all.

What stays on your device

• Journal entries. Text, transcripts of voice journals, mood states, prompt responses, and CBT toolkit answers are all stored locally in an encrypted database. The encryption key is generated by iOS Keychain or Android Keystore on first install and never leaves the device.
• Voice audio. When you record a voice journal, the audio is transcribed on your device using the operating system's built-in speech recognition. The audio file is discarded immediately after transcription — only the text remains.
• Self-model. The "About You" surface in the Reflect tab — your dominant moods, themes, time-of-day patterns — is computed from your entries on your device and stored locally. It is never transmitted.
• Reflections. When the Ask tab generates a reflection on one of your entries, the model that produces it (templated library or, on supported iOS devices, Apple Intelligence Foundation Models) runs on your device.
• Privacy Receipt. Inside the app, Settings → Privacy Receipt shows you a chronological log of every data event the app has performed on your behalf. This log itself is encrypted and stored on your device.

What we never store

• Your name, email, phone number, or any account identifier — there is no account.
• Your contact list, calendar, location, or photo library — Quies does not ask for these.
• Audio recordings of voice journals — they are discarded after transcription.
• The text of your entries on any server we control.

What does cross the network

Crash reports (Sentry)

If Quies crashes, an anonymous crash report is sent to Sentry to help us fix the bug. We have configured Sentry to strip entry text, voice transcripts, mood, theme, and biometric values from any crash report before it leaves your device. The crash report contains stack traces, OS version, device class, and Quies version — nothing about what you wrote.

Anonymous diagnostics (opt-in, off by default)

In Settings → Privacy, you can choose to enable anonymous diagnostics. When enabled, Quies sends a small fixed set of event names — for example "an entry was created" or "a grounding minute completed" — with a randomly generated device identifier that cannot be linked back to you. The diagnostic events never contain content. The full list is allow-listed in the app's source code. This setting is off by default and can be turned off at any time.

Purchases (RevenueCat)

If you purchase Quies Pro, the purchase is processed by Apple (App Store) or Google (Play) and verified through RevenueCat. RevenueCat may collect anonymous purchase metadata as described in their privacy policy. We use RevenueCat to unlock Pro features on your device; no personal information about you is sent to RevenueCat by us.

Cloud Intelligence (Pro, opt-in, off by default)

If you are a Pro subscriber and you explicitly opt into Cloud Intelligence in Settings — and confirm a one-time in-app dialog — Quies will send the text of an entry you choose to reflect on to our proxy at quies-api.vercel.app. Each request is HMAC-SHA256 signed with a key derived from your device's vault, so a request that didn't originate from your install is rejected. The proxy holds the upstream API credentials and forwards the entry to Anthropic under Anthropic's zero-retention API policy. Anthropic does not store the prompt or the response. Our proxy logs status code + timestamp only; never body content. The reflection text returns; nothing about it is stored on our servers.

The Cloud Intelligence toggle takes effect instantly. The next reflection will use Apple Intelligence (if available) or the templated provider on-device. Crisis-flagged entries are never sent to cloud regardless of this setting — they always route to the on-device templated provider.

Crisis detection and safety

Quies includes a local crisis detector that runs on the text of your entries before they are saved. If the detector flags a phrase, the app surfaces a care card with local hotline numbers. The detector runs entirely on your device. The fact that a care card was shown is logged in your Privacy Receipt (as a count), but the phrase that triggered it is never logged, never transmitted, and never stored on any server.

Hotline numbers are bundled with the app so they remain accessible without a network connection.

Apple Health (opt-in, off by default)

If you grant the Health permission in Settings, Quies uses Apple HealthKit in two ways. Both are entirely on-device — Health data never leaves your phone via Quies.

Writes (to Apple Health). When you log a mood inside Quies, the corresponding State of Mind valence is written to Apple Health. When you complete a Minute (the grounding surface), the elapsed seconds are written as a Mindful Minutes sample. You can disable either by revoking the Quies permission in iOS Settings → Privacy & Security → Health.

Reads (from Apple Health). The Reflect tab can read sleep hours, heart rate variability, and resting heart rate samples to surface gentle correlation observations — for example, "heavy days tend to follow nights under six hours of sleep." All correlation runs on your device. The biometric values themselves never appear in telemetry, the Privacy Receipt, or anywhere over the network.

Children

Quies is not directed at children under 13. We do not knowingly collect data from children.

Deletion

Settings → Reset → Erase all data permanently removes every entry, the self-model, the Privacy Receipt itself, and any cached state. Uninstalling Quies has the same effect. Because there is no Quies account, there is no server-side data to request the deletion of.

Changes to this policy

If we make material changes to this policy, we will update the "Last updated" date at the top and surface a notice inside the app on next launch.

Contact

Questions about privacy or this policy: support@masdinero.com.