Keep & Quit Privacy Policy

Last updated: September 25, 2026.

Who we are

Keep & Quit is a habit-tracking app — keep good habits, quit bad ones, with friends — operated by Burak Toksoy (sole proprietorship, Maltepe, İstanbul, Türkiye) (contact: hi@burkiwski.com). This policy explains what we collect, why, where it is stored, and the choices and rights you have, under both the EU General Data Protection Regulation (GDPR) and the Turkish Personal Data Protection Law (KVKK).

Scope

This policy covers the Keep & Quit iOS app and the data it sends to our servers. It does not cover other companies’ apps, websites, or services you may reach through a link.

What we collect

  • Account & sign-in. A username, display name, and an optional bio and avatar photo you choose. If you sign in with Apple, we receive your Apple-issued user identifier and, only on your first sign-in, the name and email address you choose to share — this may be your real email address or the private relay address Apple generates if you pick “Hide My Email”. If you sign in with an emailed one-time code instead, we store that email address to send the code and to identify your account. We never see your Apple ID password or any password.
  • Habits and activity. The habits you create (Keep habits you want to build, Quit habits you want to stop), your check-ins, slips, notes of up to 140 characters, streaks and clean-time. Some of this can reveal health information — see “Health-related data” below.
  • Friends. Friend requests, friendships and blocks, and each habit’s visibility (private to you, or visible to friends).
  • Quick messages. Friends can send a small set of preset, positive phrases to react to your progress (e.g. “Well done!”, “Why did you quit?”). There is no free-text chat anywhere in the app.
  • Reports. If you report another user, we store the reason you selected and any optional detail you add.
  • Push notifications. A device push token if you allow notifications, and your notification preferences.
  • Photos. Any photo you add to a share card stays on your device — see below. If a proof photo is still possible for you (an older challenge — see below), it is uploaded; otherwise no photo ever reaches our servers.

We do not use advertising identifiers, and we do not collect your contacts or precise location.

Health-related data

The habits in Keep & Quit are named by you, in your own words. Because of that, a habit’s name and your activity on it — for example a Quit habit called “Sigara” (smoking) or “Alkol” (alcohol), with a running clean-time clock — can reveal health-related information about you, such as an addiction or a condition you are working on. Under Turkish law this is “özel nitelikli kişisel veri”; under EU law it is a “special category” of personal data (GDPR Article 9).

  • Legal basis. We only process this because you choose to type it in and use the feature: your explicit consent (KVKK m.6, GDPR Art. 9(2)(a)). We never infer or guess a health condition; we only store what you write.
  • Who can see it. Only you, and — only if you set that specific habit to “friends” visibility — the friends you added. We never read, analyze, sell, or use habit names for advertising.
  • Withdrawing consent. You can withdraw at any time by renaming or deleting the habit, or by deleting your account (see “Retention and account deletion”). This takes effect immediately.

Photos on share cards never leave your device

When you add a photo to a share card — a selfie, a new camera photo, or one from your library — it is composited into the image entirely on your phone. That photo is never uploaded to us and never sent anywhere by the app. It only leaves your device if you choose to share or save the finished card yourself, through your phone’s own share sheet.

Proof photos (older challenges only)

An earlier version of the app let you attach a photo as proof when checking in (“Live Tap”). This is turned off for anything new today. If you are still a member of a challenge created before this change whose rules require a proof photo, the check-in screen may remain available to you so that commitment is not broken. A photo captured there is uploaded to a private storage bucket and shown only to the people your proof-visibility setting allows — challenge participants, friends, or, for a public challenge, other signed-in users — never wider than who can already see the challenge. You can remove a photo you posted at any time.

Older features

Earlier versions of the app included public/community challenges, sponsor content, friendly-bet “pacts”, and XP/levels/medals. These are currently turned off in the app. If you used them before, your account may still hold that history even though it is not shown to you today; we do not use it for anything new.

How we use your data

To run the app: show you your habits and progress, show your friends what your visibility settings allow, deliver the notifications you opted into, and review reports. We do not use your data for advertising and do not sell it.

Analytics and tracking

We do not use any third-party analytics or advertising SDK, and we do not track you across other companies’ apps or websites — no App Tracking Transparency prompt is shown because we do not track. A small set of in-app usage events is defined in the app’s code for future product improvement; in the version on the App Store, these are not sent anywhere.

Who we share data with

Other users see only what your visibility settings allow. We do not sell your data or share it with advertisers or data brokers. We use these processors to run the app:

  • Supabase — our database, authentication and file-storage provider.
  • Expo (Expo Application Services) — delivers push notifications; sending you one means passing your push token and the notification’s text to Expo, which relays it to Apple’s Push Notification service.
  • Apple — for Sign in with Apple, and to deliver push notifications through APNs.

Where your data is stored

The app’s database and file storage run on Supabase infrastructure in the European Union (Frankfurt). Push notifications pass through Expo’s and Apple’s infrastructure to reach your device, which may process the token and message text outside the EU/Türkiye as a limited, mechanical relay. [Note for legal review: confirm the transfer safeguard Expo and Apple rely on, e.g. Standard Contractual Clauses.]

Retention and account deletion

We keep your account data for as long as your account exists. You can delete your account at any time in Settings. When you do:

  • Your profile is anonymized immediately (username, display name, bio and avatar are replaced or removed) and your login is deleted, so you cannot sign in again.
  • Your push token, notification preferences, notifications, friend requests, friendships, blocks and pending invitations are deleted.
  • Any proof photo you posted is removed and your check-in notes are cleared.
  • Your membership in other people’s active challenges ends; your own upcoming or active solo challenges are cancelled.
  • Numeric history shared with other people (for example a friend’s streak that included your check-ins) stays, but anonymized, so deleting your account does not erase your friends’ own history.

Reports filed by or about you are kept for moderation records.

Your rights (KVKK & GDPR)

Depending on where you live, you have rights under the Turkish Personal Data Protection Law (KVKK) and/or the EU GDPR, including the right to:

  • know whether we process your data, and get a copy of it;
  • ask us to correct inaccurate data;
  • ask us to delete your data — you can also do this yourself, any time, in Settings;
  • object to processing, or ask us to restrict it, in certain cases;
  • receive your data in a portable format, or have it transmitted to another controller where feasible (the app has no built-in export yet; write to us and we will provide it manually);
  • withdraw consent at any time for anything based on consent — for example a habit’s health-related name — without affecting what already happened before you withdrew it;
  • lodge a complaint with the Turkish Personal Data Protection Board (Kişisel Verileri Koruma Kurulu, kvkk.gov.tr) or, if you live in the EU/EEA, with your local supervisory authority.

To exercise any of these, write to hi@burkiwski.com. We aim to respond within 30 days.

Children

Keep & Quit is not directed at children. You must be at least 13 to use it anywhere in the world. If you are in the European Economic Area, you must be at least 16, unless your local law allows a lower age with a parent’s or guardian’s consent. We do not knowingly collect data from anyone under 13; if we learn we have, we delete it.

Security

We separate your data from other users’ with Supabase Row Level Security on every table and private storage for anything not meant to be public. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

Changes to this policy

We may update this policy as the app changes. We will update the date at the top; we will flag significant changes in the app.

Contact

Burak Toksoy — şahıs işletmesi / sole proprietorship
Cevizli Mah. Zuhal Cad. A Blok No: 46 İç Kapı No: 50
Maltepe/İstanbul, Türkiye
Kartal Vergi Dairesi / Kartal Tax Office
hi@burkiwski.com