Quat — Privacy Policy

Quat turns things you capture — a recording, a photo of a page, a link — into flashcards that test you. This policy explains what happens to that material.

The short version: your notes and cards live on your device. Quat has no accounts, no login, and no server that stores your content. The only things that leave your phone are the specific items you hand to a capture feature, and they leave only to be read once and turned into text.

We do not collect

Quat has no user accounts and asks for no identity. Specifically, Quat does not collect:

• your name, email address, phone number, or date of birth
• your location
• your contacts, calendar, or health data
• advertising identifiers, and there is no advertising in the app
• analytics or usage tracking of any kind — there is no analytics SDK, no crash reporter, and no telemetry in the app

What stays on your device

Everything you create stays in the app's private storage on your phone and is never uploaded:

• notes, flashcards, folders and tags
• your review history, intervals and scheduling data
• statistics, streaks, XP, badges and challenge progress
• your language, theme and app preferences

Deleting the app deletes all of it. There is no copy anywhere else, so there is also no way for us to restore it — export your deck if it matters to you.

What leaves your device, and when

Quat sends material to be read by an AI model only at the moment you use a capture feature, and only the material that feature needs:

Nothing is sent in the background. Nothing is sent on a schedule. If you never use a capture feature, nothing you write ever leaves your phone.

Links you paste are fetched by your own device, so the website you link to sees your request the same way your browser would, including your IP address.

Who processes it

Material sent for processing passes through two services and is not stored by either as part of providing this feature:

• Cloudflare Workers hosts the small relay that forwards requests. It exists so that no API credential has to ship inside the app. It does not store the content of your requests, and it does not log them.
• Google Cloud Vertex AI runs the model that produces the transcript, the extracted text, the summary or the answer. Processing is governed by the Google Cloud terms, under which customer data is not used to train Google's models. Google's own documentation on data handling: https://cloud.google.com/vertex-ai/generative-ai/docs/data-governance

We do not sell or share your material with anyone, and there is no third party beyond those two.

The device identifier

To stop one device using the AI features without limit, Quat generates a random string the first time it needs one — for example d-k3f9a2xq1b8w. It is created on your device, stored there, and sent with AI requests so a daily allowance can be counted.

It is not a hardware identifier, an advertising identifier, or anything issued by Apple or Google. It is not linked to you, and it identifies nothing except "some device". Deleting the app discards it, and the next install generates a new one.

The relay keeps a count against that string — a number, not your content — and those counters are deleted automatically after 36 hours. If the identifier is missing, the count falls back to your IP address for the same 36 hours so the limit cannot simply be bypassed.

Shared decks

If you share a deck, it is encrypted on your device before it leaves it, and travels as a single block of text that you send however you choose. We never receive it.

If you choose to bind a deck to a recipient's email address, that address is never transmitted to us or stored anywhere. It is mixed into the encryption key on your device, so the deck simply will not decrypt without it. Nobody checks it against a list, because there is no list.

Be aware of the flip side: because we hold nothing, a deck you send cannot be recalled, and a lost password cannot be reset by anyone.

Notifications

Review reminders are scheduled by your phone, on your phone. Quat uses no push service, registers no push token, and operates no server that could send you anything. The app carries no push notification entitlement at all.

Microphone, camera and photos

These are requested only at the moment you use the feature that needs them, and used only for it:

• Microphone — to record a lecture or session you explicitly start recording
• Camera and photo library — to read text off a page you photograph or pick

Quat does not open the camera or microphone at any other time. You can revoke any of these in your device settings; the rest of the app keeps working.

Children

Quat is a study tool intended for a general audience, and it is not directed to children under 13. It collects no personal information from anyone, including children — no account, no name, no email, no location, no analytics.

Quat is rated 4+ and is not listed in a children's category. Because the app collects no personal information at all, there is nothing it could collect from a child that it does not equally decline to collect from an adult.

Your rights

Because Quat stores your content on your device and holds no account, you already have direct control:

• Access and portability — export your decks from within the app at any time
• Deletion — delete individual items in the app, or delete the app to remove everything at once
• Withdrawing consent — revoke microphone, camera or photo access in your device settings, or simply stop using the capture features

If you are in the EEA, the UK, or a US state with a comprehensive privacy law, those rights apply to you and are exercised as above. There is no account for us to look up, and no stored copy of your material for us to return or erase.

Changes

If this policy changes materially, the effective date at the top changes and the new version is published here before the change takes effect.

Contact

Questions about this policy: yuvisbabbar@gmail.com