Used Quittr? What Was Exposed, What to Do Now, and How to Pick an App That Can’t Leak Your Recovery

In March 2026, the tech outlet 404 Media reported that Quittr — described by 404 Media as a viral porn-addiction recovery app — had exposed intimate data belonging to hundreds of thousands of its users. If you are or were a Quittr user, this page is for you: what the reporting actually says, what you can do about it now, and what to look for before trusting any app with this part of your life again.

One thing before anything else: none of this is a victory lap. We build a competing app, and you should factor that into how you read this page — but a breach in this category hurts every person trying to quit, and Quittr’s users deserved better. The useful part of this story is what it teaches about how recovery data should be protected. That is what this page is about.

What happened, according to the reporting

On March 10, 2026, 404 Media published an investigation reporting that Quittr had exposed user data including ages, masturbation frequency, and users’ emotional responses to pornography — and that many affected users were minors. Cybernews, covering the same exposure, put the figure at more than 600,000 users, roughly 100,000 of whom were identified in the data as minors. Coverage by Techlicious described the exposed data as including porn-use triggers, personal confessions, relapse incidents, mood check-ins, and journal entries.

The technical cause, per the reporting, was a misconfigured Google Firebase backend that allowed far broader access to the database than intended. In a follow-up published April 6, 2026, 404 Media reported that at least three separate security researchers had warned the company months earlier — one email from July 2025 stating plainly that the database was misconfigured and could be read and written to — and that a founder initially promised a fix “in a matter of hours,” while the exposure in fact persisted for months. According to that reporting, the vulnerability was finally fixed sometime before the March article was published — only after 404 Media had contacted the company multiple times.

What to do now — in order

• Audit what you shared. Journal entries, confessions, relapse logs, mood check-ins — the reporting says these categories were in the exposed database. Knowing what you put in tells you what your realistic exposure is.
• Exercise your deletion rights. If you stop using the app, don’t just uninstall — request account and data deletion inside the app or by emailing the company. Under GDPR (EU/UK) and CCPA (California) you have a legal right to erasure; many other jurisdictions have equivalents. Deletion requests also apply to backend copies, which uninstalling does not touch.
• Rotate any reused password. The reporting centers on database contents rather than passwords, but if the password you used there guards anything else — especially your email — rotating it costs you two minutes.
• Be extra skeptical of targeted messages. Data this personal is exactly what extortion and phishing campaigns prize. Treat any message that references your recovery, your habits, or this app with maximum suspicion, and never pay anyone claiming to hold your data.
• Decide about the app with clear eyes. The vulnerability is reportedly fixed. Whether you keep using the app is your call — the section below is the checklist worth running before trusting it, or any alternative, again.

How to judge any recovery app before trusting it

Recovery data is arguably the most sensitive data you own — more compromising than your bank statement, more personal than your photos. Three questions cut through every privacy page ever written:

1. Can the company read your entries?

This is the only question that matters architecturally. If your journal is stored readable on their servers, then a misconfiguration, a hack, a subpoena, an acquisition, or one careless employee can expose it — no matter how good the privacy policy sounds. End-to-end or on-device encryption means the company cannot read your data even if it wants to, and therefore cannot leak it in readable form. Policies are promises; architecture is a fact.

2. What does the store privacy label say?

Both app stores force every app to publish a data-safety declaration — on Google Play it is the "Data safety" section of the listing, on the App Store the "App Privacy" label. Read it before installing. Look for what is collected, what is linked to your identity, and what is shared with third parties. A recovery app that declares collecting identity-linked "sensitive info" or sharing data with advertisers is telling you, in public writing, exactly what its incentives are.

3. What happens when researchers knock?

Every app has bugs. The tell is the response. The pattern described in 404 Media’s follow-up — repeated warnings over months, a promised fix “in a matter of hours” that didn’t come, denial that the problem existed — is the failure mode to screen for. Companies that take security seriously publish a contact for researchers and fix reported issues fast, because they know the alternative is their users’ data on the line.

Where Axiom stands — said plainly

We built Axiom zero-knowledge because of exactly the failure mode this story describes. Your streak, your journal, your check-ins, your relapse log — all of it is encrypted on your device, and what reaches our servers we cannot read. This is not a policy choice we could quietly reverse; it is how the system is built. If our database were breached tomorrow, your recovery would not be in it in any readable form.

That is the whole pitch, and we will leave it there. Whatever app you choose — including none — the checklist above is yours to keep.