Privacy Policy for Quessia: App Blocker & Focus Timer (Android)

Effective date: 13 October 2026. Version 3.0 (applies to Quessia 1.1.1 and later, package com.appkadag.quessia).

Who is responsible

The controller for the limited processing described below is Kemal Cetinkaya, trading as AppKadag, Gauweg 9C, 51067 Köln, Germany. Email: appkadag@gmail.com. Quessia is intended for people aged 16 and over.

1. Data stored on your device only

This data is kept in the app's private storage on your phone and is never sent to us:

• Block rules: which apps you block, schedules, daily time limits and passes.
• Focus sessions: start, end and planned length; focus profiles; daily scores.
• Block attempts and passes: which rule fired, when, how often, and the optional reason you tapped (for example "Reply", "Bored", "Habit", "Work", "Other") when you used a pass or a mindful open.
• Study to unlock (Pro): minutes you earned and spent.
• Tasks, projects, subtasks, tags and daily plans you type in.
• Settings, theme, and your Pro status as reported by Google Play.
• If you set a partner lock: a salted hash of the partner code (never the code itself).
• Feed blocker (Pro): your consent record (version and time), the apps you switched on, and simple counters such as how many feeds were stopped.
• Screen-time statistics from Android's Usage Access (Section 4).

Android's app sandbox keeps other apps from reading this storage. If Android Auto Backup is on for your phone, Android may include this storage in the backup it makes to your own Google account (Quessia allows backup and has no exclusion rules). We do not receive or control that backup.

2. App blocking service ("Quessia blocking")

You turn this on in Android Settings, Accessibility, after Quessia explains it in the app and you agree. It listens only for window changes (typeWindowStateChanged) and cannot read window content (canRetrieveWindowContent is off). All it learns is the package name of the app that just came to the front, for example com.instagram.android. It compares that name with your rules on your phone. If a rule applies it shows a block screen over the app or sends you to the Home screen. The package name is not stored beyond the block-attempt log in Section 1, not sent anywhere, and not used for advertising, analytics or profiling. It is used only to enforce rules you created.

3. Feed blocker service ("Quessia feed blocker", optional, Pro)

This service stays off until you read a full-screen notice in Quessia, tap "Agree and continue", and switch it on in Android Settings, Accessibility. Android limits it to a fixed list of apps (YouTube, Instagram, TikTok, X), and Quessia only acts in apps you switch on.

3.1 What it reads. In those apps it reads the view IDs, class names, whether an element is selected, and the accessibility labels of buttons and tabs. Each label is compared on your phone with a short fixed list of names such as the Shorts, Reels or Following tab, and any label that does not match is discarded immediately. It never reads the text of messages, comments, captions, video titles, search queries, usernames or passwords, and it never types anything.

3.2 What it does. When it recognises a Reels, Shorts or For you feed, it leaves the feed by pressing Back or by tapping the Following tab, and shows a short notice. It takes no other action in those apps.

3.3 What happens to the data. Everything is processed in memory on your phone and discarded after each check. It is not stored (apart from the counters and consent record in Section 1), not sent to us or anyone else, and not used for advertising, analytics or profiling. You can withdraw consent in Quessia or turn the service off in Android Settings at any time; the feature stops immediately and everything else keeps working.

3.4 Not an accessibility tool. Quessia is a focus tool. It does not use accessibility services to help people with disabilities, and it does not act on its own: the only actions are the ones described above, triggered by rules and settings you chose.

4. Usage Access and overlay

Usage Access (PACKAGE_USAGE_STATS) is granted by you in Android's "Usage access" screen. Quessia uses it to show your own screen time and top apps and to confirm which app is in front. The data is processed and stored only on your device. The overlay permission (SYSTEM_ALERT_WINDOW, "Display over other apps") is used only to draw the block screen over a blocked app.

5. Android permissions

• Accessibility (two services): Sections 2 and 3.
• SYSTEM_ALERT_WINDOW: the block screen.
• PACKAGE_USAGE_STATS: Section 4.
• POST_NOTIFICATIONS: reminders and the alert if Android switches blocking off. Optional.
• FOREGROUND_SERVICE and FOREGROUND_SERVICE_MEDIA_PLAYBACK: keeps Pro focus sounds (bundled in the app) playing during a session.
• REQUEST_IGNORE_BATTERY_OPTIMIZATIONS: lets you exempt Quessia from battery optimisation so blocking is not stopped in the background. Optional.
• Quick Settings tile and home-screen widget (Pro): show and toggle your own focus profile and stats.
• INTERNET and ACCESS_NETWORK_STATE: used by Firebase Crashlytics and by Google Play services (Sections 6 and 7).
• com.android.vending.BILLING: Quessia Pro purchases through Google Play.
• WAKE_LOCK and RECEIVE_BOOT_COMPLETED: declared by libraries Quessia uses so that background components can run and restart after a reboot.
• CSV export (Pro): when you export, the file is handed to the app you pick in Android's share sheet. Quessia does not send it anywhere itself.

Quessia does not request location, contacts, camera, microphone, photos or the list of all installed apps. It lists launchable apps only so you can choose which to block.

6. Crash reports (Firebase Crashlytics)

If Quessia crashes, Firebase Crashlytics (Google) automatically sends a crash report: the stack trace, the app state at the time, device model and OS version, the Quessia version, and a random Crashlytics installation identifier (UUID) and Firebase installation ID that Firebase uses to count how many installs a crash affects. Google also sees your IP address while the report is transmitted. Quessia sets no custom keys, logs or user IDs, so a report contains nothing about your rules, the apps you block or your usage. Crashlytics is used only for crash reporting; Quessia has no Firebase Analytics. Firebase keeps crash stack traces and the associated identifiers for 90 days. There is no in-app switch for crash reports; to stop them, uninstall the app.

Legal basis: our legitimate interest in finding and fixing crashes (Art. 6(1)(f) GDPR). Google acts as our processor for this service and may process data in the USA and other countries under the EU Standard Contractual Clauses and Google's data processing terms: https://firebase.google.com/support/privacy.

7. Purchases and in-app review (Google Play)

If you buy Quessia Pro (monthly, yearly or lifetime), Google Play processes the payment as an independent controller under Google's terms and privacy policy. Quessia receives only whether you own Pro and keeps that status on your device. We never see your card or payment details and have no account system. The optional rating prompt is shown by Google Play's In-App Review API; Quessia receives no content from it. Legal basis for handling your Pro status: performing the contract with you (Art. 6(1)(b) GDPR).

8. What we do not do

We do not collect or sell personal data, show ads, use an advertising ID, track what you tap or which screens you view, read your messages, comments or passwords, use your location, or share your rules, tasks, sessions or screen-time data with anyone, because that data never leaves your device.

9. Your choices

• Turn either accessibility service off in Android Settings, Accessibility, or switch off the Feed blocker in Quessia. Turning off the blocking service stops app blocking until you turn it back on.
• Revoke Usage Access, overlay or notification permissions in Android Settings.
• Delete rules, tasks, sessions and other items one by one in the app. There is no single "erase everything" button yet; uninstalling Quessia deletes its local data. Backups in your Google account are managed in your Google settings.

10. Children

Quessia is intended for people aged 16 and over and is not directed at children. We do not knowingly collect data from anyone under 16, and the app collects no personal data from any user. If you believe a minor has sent us information, email us and we will delete it.

11. Retention

Data on your device stays until you delete it or uninstall the app. Crash reports are kept by Firebase for 90 days. We keep emails you send us only as long as needed to answer you.

12. Your rights (GDPR, UK GDPR, CCPA/CPRA and similar laws)

Because your app data stays on your phone, you can already see, correct and delete it inside the app. Where we do process personal data about you (an email you send us, or a crash report you can identify to us), you have the right to access, rectification, erasure, restriction, portability and objection, to withdraw consent at any time, and to complain to a supervisory authority. Our competent authority is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW), Kavalleriestraße 2-4, 40213 Düsseldorf, Germany; you may also complain to the authority in your own country. Crash reports carry no name or email, so we usually cannot link one to you; to ask about one, contact us with the approximate time of the crash and your device model. We do not sell or share personal information for advertising, so there is nothing to opt out of.

13. Changes

If we change how Quessia handles data (for example, adding advertising, a new service provider, or reading more in the accessibility services), we will update this policy and its date before the change ships and show a notice in the app on your next launch where the change is material.

14. Contact

Kemal Cetinkaya, AppKadag, Gauweg 9C, 51067 Köln, Germany. Email: appkadag@gmail.com.

All privacy policies