Privacy Policy

Last updated: 2026-08-18

Quietoak is a mental-health-adjacent app, so we hold your data to a careful standard: your practice stays on your device by default, there are no ads or third-party trackers on your diary or chat, and we collect as little as we can.

Who we are

Quietoak is an iOS app published by HyperSage AI Labs LLC. There is no account and no login — the app identifies your install with a random, on-device identifier, not your name or email. Contact: support@hypersage.ai.

What stays on your device

Your diary card entries, mood and urge logs, chosen companion, and practice history live on your device, and we keep no copy of your diary on our servers. If you have iCloud Backup enabled, they are included per your iOS settings. Any health conditions or focus areas you choose to share — and how sure you are about each — are also kept on your device, and are optional, editable, and clearable at any time.

What leaves your device when you chat. To let your companion respond to how your week has actually gone, each message can be accompanied by a short recap of your most recent 7 logged diary days. That recap includes mood and emotion ratings, urge ratings — including the 0–5 suicidal-ideation and self-harm ratings, skills practiced, and up to the first 120 characters of each day's note. A "next time" plan from the newest chain and short summaries of up to three recent chains can ride along too. This context is sent to our service and included in the AI-provider prompt so the reply can fit you; it is not stored as a copy of your diary or chains. A full chain leaves the device only when you explicitly ask for a reflection. The app asks for permission before the first AI request, and that permission can be withdrawn in Me. Every non-AI part of Quietoak — including the diary, skills, trends, chain editor, and crisis kit — remains available without it.

What is sent off the device — and why

1. Your messages to your companion

When you chat with your companion, the messages in that conversation are sent to our backend and forwarded to an AI provider to generate a reply. If you've chosen to share any conditions or focus areas — which otherwise stay on your device — that context is included with your messages so the reply can be tailored to you. If you set an optional first name or nickname and pronouns (during setup, or later in Me → Edit profile), those are sent with each message too, so your companion can address you the way you asked. They are used only to generate that reply and are never used to identify you: we keep no server-side profile, so they are not stored as account details. If your companion saves something it has learned about you that happens to include your name, that note is stored like any other saved memory and is erased by "Delete all my data". Leave both fields blank and nothing is sent. When you mention a mood in chat, your companion may also save a brief mood note (an emotion and a 0–5 intensity) on our backend, tied to the same random device identifier, so it can keep gentle track with you — this is separate from your on-device diary card. We use Anthropic (Claude) as the primary provider and OpenAI as a fallback and for optional voice. Under these providers' current API terms, your content is not used to train their models — we don't control their policies, so please also see their privacy links below. We don't sell or share your conversations. To power your saved chats and the continuity you'd expect — your companion remembering what you're working on between conversations — your messages are stored on our backend, tied only to a random device identifier (we hold no name, email, or login). You can have them permanently deleted at any time (see "Your choices & rights" below).

2. A minimal safety log (so help works when it matters)

Quietoak runs an independent safety check on chat messages so it can surface crisis resources reliably. When a message is flagged, we record a minimal, pseudonymous safety event tied only to your random device identifier — not your name. This exists to keep the safety system honest and to meet our obligations under California's SB 243 (companion-chatbot safety law). These events carry a hard retention limit of 90 days and are purged automatically; there is no indefinite retention. Crisis resources are never gated, metered, or paywalled.

Quietoak's self-harm safety protocol

This is the protocol Quietoak maintains for preventing companion output that encourages suicidal ideation, suicide, or self-harm, and for referring a user to real crisis services:

Check before and after generation. An independent safety classifier checks user messages, optional photos, and any chain analysis sent for reflection before the companion responds. A separate output guard checks generated companion text while it streams.
Do not provide harmful assistance. The companion is instructed not to encourage self-harm, provide methods or optimization details, romanticize death, agree that the user should die, or impersonate an emergency or clinical professional. If unsafe output is detected, Quietoak stops or replaces it with a safe response.
Refer to real people and services. When a user expresses suicidal ideation or self-harm, Quietoak shows a resource card with crisis-service options. In the United States this includes calling or texting 988 and texting HOME to 741741; other regions receive locally appropriate or general emergency guidance.
Escalate proportionately. Active-method or plan/intent signals open the Crisis Survival Kit instead of leaving the user in an ordinary companion exchange. Passive or ambiguous signals keep the resources visible inline without hiding the conversation. The user can also open Get help now from every app screen.
Keep safety access independent. Crisis resources do not require an account, AI-data-sharing permission, a subscription, or a remaining message allowance. The resource directory is bundled on the device so it can still be found without a data connection, although placing a call or sending a text requires service.
Minimize audit data. A surfaced event records only a pseudonymous device identifier, risk level, and timestamp — not the message, photo, or chain text — and is automatically purged on a short schedule.

Quietoak is not an emergency service and no automated system catches every crisis. If there is immediate danger, contact local emergency services now. Questions or safety reports: support@hypersage.ai.

3. Purchases

If you subscribe to Quietoak Plus, the App Store sends us a signed transaction (JWS) that we verify on our backend. We store only the entitlement state needed to unlock Plus features. The App Store handles billing, refunds, and your Apple ID — we never see your payment method.

4. Voice dictation (optional)

If you tap to dictate a diary entry, the microphone is used only during that recording. The audio is sent to our backend and on to OpenAI for transcription, used only to produce the text, and is not stored after transcription.

5. Photos you attach (optional)

You can attach a photo or screenshot to a message — most often a conversation you want help replying to. Quietoak removes embedded metadata and downscales the image to at most 1568 pixels on its long edge, then sends it through our backend to Anthropic twice: first for an automated safety check and then, only if cleared, to write the reply. We do not store the image on our servers — the saved server conversation records that an image was attached, not the pixels. The protected on-device conversation keeps the downscaled JPEG plus a small thumbnail so you can reopen it; both are removed when you delete that conversation or use "Delete all my data". Quietoak receives only the specific photos you pick: it does not request broad photo-library access, and there is no in-app camera.

6. Chain-analysis reflections (optional)

Your chain analyses live on your device, and finishing one never sends it anywhere. After you finish, you can ask your companion to write a short reflection on the walk-through — and only that tap sends it. What is sent: the chain you wrote (the behavior you examined, what sparked it, your vulnerability factors, the thought/feeling/urge links, the consequences, your chosen skills, and your plan for next time), along with the same optional profile context as chat. It is checked by the same automated crisis classifier as your messages — if it detects a crisis, the app shows crisis resources first (and records the same minimal, pseudonymous safety event described above; never your text) — and is then forwarded to Anthropic to write the reflection. The chain and the reflection are not stored on our servers: the reflection is generated, streamed back to you, and saved only on your device with the chain. Reflections are free on a small daily allowance, and Plus raises that allowance; the chain itself always saves regardless.

What we do not collect

Your email or login credentials (the app has no account). A first name or nickname and pronouns are optional — if you set them, see "What is sent off the device" above.
Your precise or approximate location — there is no GPS and no CoreLocation anywhere in the app. (Your device's two-letter region setting, for example "US", is sent with each request so the right crisis lines are shown for where you are.) Your contacts, or your calendar. We never read your photo library either — only a photo you deliberately attach to a message is sent, and that is covered in "What is sent off the device" above.
Any advertising identifiers. There are no ad SDKs and no third-party analytics trackers attached to your diary or chat.
Data from outside Quietoak.

How your health-related content is treated

Your diary and conversations may include sensitive mental-health information. We treat that content with care, encrypt it in transit (TLS), keep what we store on infrastructure that encrypts data at rest, and minimize what leaves your device.

Quietoak is not a HIPAA-covered entity, and we do not claim to be. We are a self-help wellness app, not a healthcare provider.
The U.S. FTC Health Breach Notification Rule may apply to apps like ours. If a breach affecting your health-related data ever occurs, we will — within the timeframes the Rule sets — post notice here and in the App Store update notes, surface an in-app notice the next time you open Quietoak, and notify the FTC (and the media where the Rule requires). Because we hold no email or contact details for you, those are the most direct ways we can reach you.

Third parties

Apple App Store — purchases and Apple ID. apple.com/legal/privacy
Anthropic — primary AI provider for companion replies. anthropic.com/legal/privacy
OpenAI — fallback AI provider, optional companion voice, and voice-dictation transcription. openai.com/policies/privacy-policy
Fly.io — hosts our backend. fly.io/legal/privacy-policy

Service protection and abuse controls

For fair-use limits and abuse prevention, our quota service stores a SHA-256 hash of your IP address (never the address itself) alongside the calendar day and the feature used, so it can count requests. It is used to count requests, not to advertise to you or track you across apps or websites. Ordinary hosting infrastructure may also process network metadata needed to deliver and secure the service.

Your choices & rights

Delete your data: "Delete all my data" in the app erases your diary, chats, and chains — including any companion reflections, which exist only on your device — and asks our backend to delete your saved conversations, mood logs, and safety log tied to your device identifier (subject to minimal retention required by law). Deleting the app removes all on-device data, and you can always email support@hypersage.ai with any request.
Manage Plus: iOS Settings → Apple ID → Subscriptions.
EU/UK (GDPR) & California (CCPA): you may request access to or deletion of data tied to your device identifier, and you can object to or withdraw consent for processing at any time. We do not sell or share your personal information, and we will not discriminate against you for exercising these rights. The categories we hold are limited to: your random device identifier, companion messages and saved conversations (which can include an optional first name, nickname, or pronouns), chat-logged mood notes, minimal pseudonymous safety events, a short-lived IP-derived quota value, and Plus entitlement state. Our legal bases (GDPR) are your consent for the AI processing and our legitimate interest in operating and securing the service. Email support@hypersage.ai to access or delete any of it.

Children

Quietoak is intended for adults 18 and older and is not directed at children. We do not knowingly collect data from children. If you believe a minor has used the app, contact support@hypersage.ai.

Changes

If we change this policy we will update the date above and post the new version here. Material changes will be noted in the App Store update notes.

Contact

Questions about privacy: support@hypersage.ai

If you're in crisis: Quietoak is not an emergency service. Call or text 988 (US Suicide & Crisis Lifeline), text HOME to 741741, or call your local emergency number. The in-app Crisis Survival Kit is always free and works offline.