What we hold,
and why.
One Quarter is an app for small groups of friends who set goals together and fine each other for going quiet. It is run by Aeroy LTD. This page says exactly what it holds about you, why, and how to get rid of it.
- No advertising
- No analytics or tracking
- Nothing sold
Last updated 11 September 2026
There is no advertising, no analytics, no tracking, and nothing is sold or shared with anybody. The app loads no third-party scripts and self-hosts its own fonts, so opening it does not tell anyone else that you did.
What is held
- Email address
- It is how you sign in — a six-digit code is emailed to you — and how reminders reach you.
- Apple ID link
- Only if you use Sign in with Apple on iPhone: Apple's private identifier for you in this app, and the email address Apple shares — your own, or a private relay address that forwards to you if you chose to hide it. The app never learns your Apple ID password.
- Name
- Shown to the other members of your group.
- Emoji or picture
- Optional. Shown next to your name. A picture is stored as an image file; an emoji is stored as text.
- Phone number
- Optional, and only if you type one. Never used automatically.
- Your goals and ticks
- The point of the app. Visible to the other members of your group.
- Workouts
- Only if you connect Apple Health, so a goal like "run 5 km" ticks itself. For each run, walk, ride or swim: the sport, when it started, how far it went, and whether it was typed in by hand. Nothing else — no route, pace or heart rate. Used only to tick your own goals, and never shown to anyone, your group included: they see the tick, as if you had made it.
- Fines and updates
- What the group settles up from at the end of a quarter.
- Group plan
- Only if your group has one: which group it covers, whether it is active, when it renews or lapses, and Apple's reference for the purchase. Payment itself is handled entirely by Apple — the app never sees card details.
- Notification address
- Only if you turn notifications on: a web push address in a browser, or a device token from Apple on iPhone. Neither says who you are on its own.
- Sign-in sessions
- A random token per device, so you stay signed in. Never your email or password; there is no password.
- Event log
- Sign-ins, joins and errors, kept 30 days, so faults can be diagnosed.
- Launch list
- Only if you type your email into the coming-soon page: the address, when you joined, and which page you joined from. It is used for one email on the day the app opens, and to work out whether you were inside the first 1,000 for the free month. Ask us and it is deleted.
- Contact page
- Only if you sign in with Google to post a question. Google tells the site your name, your email address and an identifier, and never your Google password. This is kept apart from app accounts: posting a question does not create one. What you post, with your first name and last initial, is public once the team approves it. Your email address is never shown; it is used only to tell you about replies.
Who can see it
- Your group sees your name, picture, goals, ticks, weekly updates and fines. That is the whole idea of it.
- Nobody outside your group sees any of that. Groups are joined by invitation only.
- Profile pictures are served from a web address with a long random name. Anyone holding that exact address can view the image, the same way most chat apps serve avatars. The address is not guessable and is not published anywhere.
- The app's operator can see everything stored, in order to run and fix it.
Where it is stored, and who processes it
Everything runs on Cloudflare (database, file storage, and the code itself), hosted in Western Europe. Other services are involved only where named here:
- Cloudflare Email sends your login codes and reminders, so it handles your email address.
- Apple confirms who you are if you choose Sign in with Apple. It tells the app an identifier and an email address, nothing else.
- Apple takes payment for the group plan through the App Store. The app learns only whether the plan is active and when it renews; it sends Apple nothing about your goals or your fines.
- Apple Health, if you connect it in the iPhone app. The app reads your workouts on your phone and sends the few details listed above. It never writes anything to Apple Health, and Apple Health data is never used for advertising or shared with anyone.
- Google confirms who you are if you sign in with Google to post on the contact page. It tells the site your name, email address and an identifier, nothing else. No Google script runs on the page: you go to Google's own sign-in and come back.
- Google Places is used only when a group admin searches for a restaurant for the end-of-quarter dinner. It receives what is typed into that search box and nothing else — no account details are sent.
- Notifications, if you turn them on. In the iPhone app, Apple delivers them, and the wording of each one — your group's name and what is at stake that week — passes through Apple to reach your phone. It never includes your goals, your ticks or your fines. In a web browser the notification is an empty knock delivered by your browser's maker, and the app fetches the wording itself once it arrives, so the push service sees nothing at all.
How long it is kept
- Your account and its goals: until you delete it.
- Login codes: 15 minutes, then discarded.
- The event log: 30 days.
- Workouts from Apple Health: 21 days — long enough to add up a week — then deleted. The ticks they made stay, like any tick.
- Sessions: until you sign out. Each time you use the app the year starts again, so only a year without opening it ends one on its own.
- Group plan records: as long as the group exists, so the record of what was paid stays straight.
- Launch list: until the app opens and the one email has gone, or until you ask for it to be deleted.
- Contact page questions and replies: until the team removes them or you ask us to. Your contact-page sign-in lasts 90 days. To have what you posted, or your contact-page details, removed, email help@onequarter.app.
Deleting your account
Open the app, go to Settings, and choose Delete my account. You will be asked to type DELETE, and then it happens immediately — no email, no waiting.
What is erased: your name, email address, phone number, profile picture (the image file is deleted from storage), your goals, every sign-in session, any notification address, and any workouts held. If you used Sign in with Apple, the link to your Apple ID is removed and Apple is asked to revoke the app's access. Your email address is freed, so you can sign up again later with the same one.
What is kept: fines already recorded against you, and the weeks you did or did not report. Those belong to the group's ledger — other people's share of a dinner bill is calculated from them — so removing them would change what somebody else owes. They no longer carry your name, email or picture.
Deleting your account does not cancel an App Store subscription. Apple bills that, so cancel it in your Apple Account settings as well. A group you paid for keeps its plan until the period already paid for runs out.
If you would rather ask a person, email help@onequarter.app and it will be done for you.
Your rights, and the rest
Your rights
Under UK and EU data protection law you can ask for a copy of what is held about you, ask for it to be corrected, or ask for it to be erased. Most of it you can see and change yourself inside the app. For anything else, email the address above; expect a reply within 30 days.
Children
The app is not intended for anyone under 13, and no account should be created for one.
Security
There are no passwords to steal — sign-in is a code emailed to you, valid for 15 minutes and once only. Everything travels over HTTPS. Login codes are stored hashed under a secret key rather than in the clear.
Changes
If this page changes in a way that matters, the date at the top changes with it.