diff --git a/main.js b/main.js
index a71487b3..9c040c58 100644
--- a/main.js
+++ b/main.js
@@ -492,7 +492,7 @@ const SETTINGS_DEFAULTS = {
   clearCacheOnQuit: true,    // drop HTTP cache (images, scripts, etc.)
   clearHistoryOnQuit: true,  // drop navigation history (+ saved tabs unless restoreSession)
   clearStorageOnQuit: true,  // drop localStorage / IndexedDB / service workers / cache API
-  keepSignInsOnQuit: true,   // ...except for sites with a login saved in the vault (lib/signin-sites.cjs)
+  keepSignInsOnQuit: true,   // ...except your apps (sidebar + installed) and sites with a login saved in the vault (lib/signin-sites.cjs)
   // Password manager offers (Settings › Passwords).
   pwOfferSave: true,         // ask to save a password after a login or sign-up form is sent
   pwOfferFill: true,         // offer saved logins when a login form appears
@@ -4030,8 +4030,20 @@ function showPwFill(show, matches, extra = {}) {
 // Hostnames with a saved login, kept outside the vault (sealed) so the quit
 // clear can spare their sign-ins while the vault is locked. Rewritten only
 // when the vault is open and the set changed.
-const { createSigninSites, normHost: normSigninHost } = require("./lib/signin-sites.cjs");
+const { createSigninSites, normHost: normSigninHost, keepOrigins: keepOriginsForHosts } = require("./lib/signin-sites.cjs");
 let signinSitesInst = null;
+// What the quit-time clear leaves signed in: the web apps in the sidebar and
+// the installed apps (WhatsApp, Telegram keep their session in IndexedDB and
+// localStorage, so "Clear site storage on quit" signed them out at every
+// launch), plus every site with a login saved in the vault.
+function quitKeepOrigins() {
+  const hosts = [];
+  for (const L of settings.quickLinks || []) { try { hosts.push(new URL(L.url).hostname); } catch {} }
+  try { for (const a of webapps.list()) { const h = a.host || (() => { try { return new URL(a.startUrl || a.origin).hostname; } catch { return ""; } })(); if (h) hosts.push(h); } } catch {}
+  const keep = new Set(keepOriginsForHosts(hosts));
+  try { for (const o of signinSites().keepOrigins()) keep.add(o); } catch {}
+  return [...keep];
+}
 const signinSites = () => (signinSitesInst ||= createSigninSites({ file: path.join(app.getPath("userData"), "signin-sites.json"), safeStorage, log: (...a) => console.log("[signin-sites]", ...a) }));
 function refreshSigninSites() {
   if (!vaultState) return;
@@ -10085,7 +10097,7 @@ if (!process.env.THESEUS_NO_AUTOSTART && !app.requestSingleInstanceLock()) {
         cookies: settings.clearCookiesOnQuit,
         cache:   settings.clearCacheOnQuit,
         storage: settings.clearStorageOnQuit,
-        keep:    settings.keepSignInsOnQuit ? signinSites().keepOrigins() : [],
+        keep:    settings.keepSignInsOnQuit ? quitKeepOrigins() : [],
       });
       // Session file AND the address-bar history (history.json).
       if (settings.clearHistoryOnQuit) {
diff --git a/settings.html b/settings.html
index 3b2b1c0a..7eaf4c2b 100644
--- a/settings.html
+++ b/settings.html
@@ -904,10 +904,6 @@
         <div class="txt"><div class="t">Clear cookies on quit</div><div class="d">Drops session + persistent cookies. You'll sign in again next launch.</div></div>
         <label class="sw"><input type="checkbox" id="clearCookiesOnQuit"><span class="track"><span class="knob"></span></span></label>
       </div>
-      <div class="row" style="margin-left:24px">
-        <div class="txt"><div class="t">Keep sign-ins for sites in your vault</div><div class="d">Sites with a login saved in Settings › Passwords keep their cookies and site storage, so you stay signed in. Everything else is still cleared. If a site signs you out anyway, Theseus offers your saved login on its sign-in form.</div></div>
-        <label class="sw"><input type="checkbox" id="keepSignInsOnQuit"><span class="track"><span class="knob"></span></span></label>
-      </div>
       <div class="row">
         <div class="txt"><div class="t">Clear HTTP cache on quit</div><div class="d">Drops cached images / scripts / stylesheets. Sites re-download; small disk win.</div></div>
         <label class="sw"><input type="checkbox" id="clearCacheOnQuit"><span class="track"><span class="knob"></span></span></label>
@@ -916,6 +912,10 @@
         <div class="txt"><div class="t">Clear site storage on quit</div><div class="d">Drops localStorage, IndexedDB, service workers, and the cache API. Web-app state resets.</div></div>
         <label class="sw"><input type="checkbox" id="clearStorageOnQuit"><span class="track"><span class="knob"></span></span></label>
       </div>
+      <div class="row">
+        <div class="txt"><div class="t">Keep my apps and vault sites signed in</div><div class="d">When cookies or site storage are cleared on quit, these keep theirs, so you stay signed in: the web apps in the sidebar (WhatsApp, Telegram…), the apps you installed from Settings › Apps, and every site with a login saved in Settings › Passwords. Everything else is still cleared. If a site signs you out anyway, Theseus offers your saved login on its sign-in form.</div></div>
+        <label class="sw"><input type="checkbox" id="keepSignInsOnQuit"><span class="track"><span class="knob"></span></span></label>
+      </div>
       <div class="row">
         <div class="txt"><div class="t">Clear history on quit</div><div class="d">Drops back/forward history and address-bar history. With "Open previous windows and tabs" on, the tabs themselves still reopen.</div></div>
         <label class="sw"><input type="checkbox" id="clearHistoryOnQuit"><span class="track"><span class="knob"></span></span></label>