Qwests Privacy Policy

Effective date: [TO CONFIRM: effective date]
Version: 1.0, for the Qwests app version 1.x
App: Qwests (qwests.), app ID xyz.qwests.app
Published at: https://analema.xyz/qwests/privacy [TO CONFIRM: page is live, public, not geo-blocked, HTML (not PDF), and the developer name matches both store listings]

This policy covers the Qwests app and messages you send us about it. [TO CONFIRM: whether it also covers the website analema.xyz/qwests; see section 4.]

The short version

• The app keeps your data on your phone. We have no server, and the app does not send your data to us.
• You do not need an account. You can continue with just a name, and then we collect no email address at all. Signing in with Apple or Google is your choice.
• A few things can leave your phone, always through your phone's maker or your own choice: signing in with Apple or Google if you choose to, your phone's own backups, things you share, and crash reports you agree to send to Apple or Google. Section 3 lists them.
• We only receive information if you send it to us, for example when you email us, or in the crash reports and statistics the app stores give developers.
• No ads. No tracking. No analytics tools. No crash-reporting tools in the app.
• We do not sell your data, and we do not share it for advertising.
• You can erase what the app keeps on your phone at any time: You → Delete account.

The rest of this page explains the details.

1. Who we are

Qwests is made by Analema GK (アナレマ合同会社), a company in Japan.

• Registered head office: 〒819-1303 福岡県糸島市志摩野北字犬鳴山2757番44 (2757-44 Inunakiyama, Shimanokita, Itoshima-shi, Fukuoka 819-1303, Japan)
• Representative: 代表社員 キーレズ・オーガスチン (Agustin Quiles IV), Representative Member
• Contact for support and privacy requests: info@analema.xyz [TO CONFIRM: mailbox is live]
• Person responsible for personal information (also the Korean privacy officer, 개인정보 보호책임자): Agustin Quiles IV, info@analema.xyz

For the app data on your phone, we decide how the app works but we cannot see or reach that data. [TO CONFIRM with counsel: whether we describe ourselves as the "controller" of on-device data, or only of the data we actually receive (section 4).] For the information we do receive (section 4), we are the controller, or the "personal information handling business operator" under Japanese law.

2. What the app keeps on your phone, and why

All of this is stored on your phone, in the app's own storage. The app does not send any of it to us.

You do not need an account to use Qwests. The first screen offers "Continue with just a name", "Continue with Apple" and "Continue with Google". Everything in this table is optional or made by the app.

3. When something leaves your phone

The app has no server and sends nothing to us. But your phone, and the choices you make, can move some data elsewhere:

• Signing in with Apple or Google, if you choose it. Your phone talks to Apple or Google, who run the sign-in (section 5). They learn that you use Qwests. If you continue with just a name, this does not happen.
• Your phone's backups. The app does not switch off your phone's own backups. If iCloud Backup (iPhone) or Google backup (Android) is on, your phone may copy the app's storage, including your calendar, notes and photos, to your Apple or Google account. That is how your data can come back on a new phone. You control these backups in your phone's settings, and you can turn them off there. We do not run them and cannot read them. Delete account cannot remove copies already in old backups (section 11).
• Sharing. If you tap Share, your phone's share sheet opens and you choose where the card or GIF goes (section 8).
• Crash reports and statistics. If you agreed in your phone's settings to share analytics or diagnostics with app developers, Apple or Google may send us crash reports and usage statistics (section 4).
• Web pages. Links in the app, such as this policy or Help, open analema.xyz/qwests in your browser (section 4).

4. What we do receive, and why

We only receive information in these cases:

Purposes of use: we use this information only for the purposes in the table above. We do not use it for advertising, and we do not combine it with anything else. We will tell you before we use it for a new purpose.

Who handles it for us: our email is run by [TO CONFIRM: email provider, e.g. Google Workspace] and our website by [TO CONFIRM: web host]. They store it for us and may not use it for their own purposes. We may also disclose information if the law requires it (for example, a court order).

5. Sign in with Apple and Google (optional)

This section applies only if you choose Continue with Apple or Continue with Google.

• Apple or Google runs the sign-in, under its own privacy policy. It handles its part as a separate controller. We do not control what it does.
• What the app receives: the name and email address the provider gives. If you use Apple's "Hide My Email", the app receives Apple's private relay address instead. These stay on your phone.
• Sign-in tokens: we do not keep sign-in tokens on any server, because we have no server. [TO CONFIRM: the app does not keep the token on the phone after sign-in, once native sign-in is built.]

6. Photos and other people

Adding a photo is always your choice. The app only gets a photo if you pick or take one.

• If other people are in the photo, please add it only if they are okay with it.
• Photos stay in the app's storage on your phone (and in your phone's backups, if those are on; see section 3). Nobody sees them unless you share them.
• If you tap Save on a share card, the image goes to your phone's photo library. After that it is yours, and the app can no longer reach it.
• We do not scan, analyse or recognise faces.
• Photos can carry hidden details such as where they were taken. [TO CONFIRM: the app removes location details when it stores a photo.] Either way, those details stay on your phone.

7. Notifications

If you turn them on, Qwests shows one gentle reminder a day (8:30 local time by default). The app explains why before your phone asks. These are local notifications, scheduled on your phone. We have no push server. You can turn them off any time in You → Morning reminder or in your phone's settings.

Reminders are short encouragement messages. They do not include your notes or other personal details, but your phone may show them on the lock screen.

8. Sharing and saving

Qwests does not share anything by itself. If you tap Share, your phone's share sheet opens and you choose where the card or GIF goes. Once it reaches another app, that app's own privacy policy applies, and we cannot control or take it back.

9. What we do not do

• At launch, the app does not ask for your date of birth. It does not collect your location, contacts, advertising ID, health data, payment data, browsing history or messages.
• We do not sell personal information, and we do not use or share it for targeted advertising.
• There are no analytics, advertising, tracking or crash-reporting tools in the app.
• We do not make automated decisions about you that have legal or similarly significant effects. The app picks your daily quests by chance, on your phone.
• The app does not respond to "Do Not Track" signals, because it does no tracking across other apps or websites.

10. How long things are kept

• On your phone: until you delete it, use Delete account, delete the app, or erase your phone (see the table in section 2). Copies in your phone's backups follow your backup settings.
• With us: only what is in section 4, for the time shown there. When the time is up, we delete it so it cannot be recovered.

11. How to delete your data

This section is also published at https://analema.xyz/qwests/delete. [TO CONFIRM: page is live and needs no login.]

• In the app: go to You → Delete account. This erases your profile, completions, notes, the photos the app stored, feelings, settings and scheduled reminders, resets the app icon, and returns you to the welcome screen. It cannot be undone.
• Sign out is different. You → Sign out removes your name (and email, if you gave one) but keeps your calendar, notes and photos on the phone, so the next person to sign in on that phone could see them. To erase everything, use Delete account.
• Uninstall the app. This also removes everything the app stored.
• Backups: your phone's own backups to your Apple or Google account may include app data, and you control them in your phone's settings. Delete account cannot remove copies already in old backups. To remove those, delete or replace the backups in your phone's settings.
• Images you saved or shared: images in your photo library or sent to other apps are outside the app. Delete them there.
• To remove the sign-in link (only if you used Apple or Google): on Apple, go to Apple ID settings → Sign in with Apple. On Google, go to Google Account → Security → Third-party connections.
• Emails you sent us: ask us at info@analema.xyz and we will delete them, unless the law requires us to keep them.

How we destroy data we hold: we permanently delete emails and electronic files so they cannot be recovered. We do not keep paper records.

12. Your rights

Your app data is on your phone, so you can see, change and delete it yourself. You can edit your name in the app; your completions, notes and photos are in your calendar. The app does not offer an export file.

For anything we hold about you (section 4), you can ask us to:

• tell you what we hold and how we use it, and give you a copy;
• correct it;
• delete it, or stop or limit using it;
• object to how we use it;
• give it to you in a common electronic format (portability), where the law gives you that right.

How to ask. Email info@analema.xyz from the address you want us to look up, and say what you would like. We may ask you to confirm it is you, but we will not ask for more than we need. Someone can ask for you if they can show you authorised them. It is free. We answer without delay, and within the time the law where you live sets (for example, 10 days in Korea, 30 days in Thailand, one month in the EU and UK, 45 days in California); if we need longer, we will tell you why. If we hold nothing about you, we will say so plainly. We will not treat you differently for asking.

Japan (APPI). You may ask us to disclose (including electronically), correct, add to, delete, stop using or stop providing to third parties the personal information we hold about you, and for the records of any provision to third parties. We do not charge a fee. Complaints and questions: info@analema.xyz.

EU and UK (GDPR / UK GDPR). You have the rights listed above, and where we rely on consent, the right to withdraw it at any time without affecting what came before. Our legal bases are in section 4. For the app on your phone: you do not have to give the app anything beyond a name of your choice, and the app receives an email address only if you choose Apple or Google sign-in. Nothing is sent to us. [TO CONFIRM with counsel: whether an EU or UK representative is needed under Article 27; if so, add their contact here.]

California (CCPA / CPRA). [TO CONFIRM with counsel: we expect the CCPA does not apply to us, as we are under its thresholds. We describe our practices anyway.] We do not sell or share personal information (as California law defines those words), and we do not use sensitive personal information. The only personal information we receive is in section 4: identifiers (email address), the content of your messages, and device and app diagnostics. They come from you or from Apple and Google, are used only for the purposes there, and are kept for the times there. The name, email, installation ID, notes, photos, feelings and completions in section 2 stay on your phone and are not received by us. You can ask to know, delete or correct information as described above.

South Korea (PIPA). You can exercise the rights above, including stopping processing and withdrawing consent, and we will answer within 10 days. Privacy officer: see section 1. Overseas transfer: emails you send us are stored by [TO CONFIRM: email provider, its contact] on servers in [TO CONFIRM: country], from the moment you send them, over the internet, only to answer you, for the time in section 4. You can avoid this by not emailing us; you can still use the app fully. We do not use cookies or similar tools in the app. [TO CONFIRM with counsel: a Korean domestic agent is not required, as we are below the thresholds.]

Thailand (PDPA). You can exercise the rights above, including withdrawing consent and complaining to the regulator. The purposes, legal bases and retention periods are in section 4. We have not appointed a data protection officer, because we do not process data on a scale that requires one. [TO CONFIRM with counsel.] [TO CONFIRM with counsel: whether a representative in Thailand is needed.]

Complaints. You can contact us first, and we will try to put things right. You can also complain to a regulator:

• Japan: Personal Information Protection Commission (PPC), https://www.ppc.go.jp/en/
• EU: the data protection authority where you live or work; UK: the Information Commissioner's Office (ICO), https://ico.org.uk
• South Korea: Personal Information Protection Commission (PIPC), and the KISA Privacy Infringement Report Center, https://privacy.kisa.or.kr (call 118)
• Thailand: the Personal Data Protection Committee (PDPC), https://www.pdpc.or.th
• California: the California Privacy Protection Agency or the Attorney General

13. Children

Qwests is for adults aged 18 and over. Anyone under 18 must not use it. It is not made for children, and we do not knowingly collect personal information from anyone under 18.

The app does not send us what you put in it, so we will usually not know who uses it. If we learn that a child under 13 has sent us information (for example, by email), we will delete it. If you think a child is using Qwests, email us and we will explain how to delete the app data on their phone (section 11).

14. Security

On your phone: your app data sits in the app's own storage, protected by your phone's security and encryption. Please use a screen lock (passcode, fingerprint or face unlock) and keep your phone updated. Anyone who can unlock your phone can open the app.

What we hold: we protect it with these measures [TO CONFIRM: each one is actually in place before launch]:

• Rules: we have a written rule for how we handle personal information, including who may see it and when we delete it.
• People: only the people who answer support can read support emails, and they are bound to keep them confidential.
• Technical: our email and website accounts use strong passwords and two-step sign-in, and data is encrypted in transit.
• Physical: we do not keep paper records, and the devices we use are locked and encrypted.
• Where it is stored: our email provider stores data in [TO CONFIRM: country, e.g. the United States]. We checked that country's privacy laws before choosing it. [TO CONFIRM: country; the APPI requires us to know and disclose this.]

No system is perfectly secure, so we cannot promise absolute security. If a breach affects you, we will tell you and the regulators as the law requires.

15. International transfers

The app does not send your app data anywhere. The information in section 4 may be stored outside your country, including in [TO CONFIRM: country] by our email provider. We are in Japan, which the EU and UK recognise as giving adequate protection. Where the law requires more for a transfer, we use the safeguards it allows, such as the provider's data protection terms. Apple and Google handle sign-in, backups and crash reports in other countries under their own policies.

16. Changes to this policy

We may update this policy. We will change the effective date at the top. For meaningful changes, we will tell you in the app before they take effect.

Version 1.0 keeps everything on your phone. If we ever add cloud sync, groups, a community tab or other features that send data from your phone to us, we will update this policy and tell you in the app before it happens, and ask for your agreement where the law requires it. Nothing will change silently.

17. Translations

We publish this policy in English, Japanese, Korean, Thai and Simplified Chinese. If they differ, the English version applies, unless the law where you live says otherwise. [TO CONFIRM with counsel: whether the Korean version must control for Korean users.]

18. Contact

info@analema.xyz Analema GK (アナレマ合同会社) 〒819-1303 福岡県糸島市志摩野北字犬鳴山2757番44 (2757-44 Inunakiyama, Shimanokita, Itoshima-shi, Fukuoka 819-1303, Japan) Representative: 代表社員 キーレズ・オーガスチン (Agustin Quiles IV), Representative Member Person responsible for personal information: Agustin Quiles IV