Oath, Privacy Policy
Last updated: October 23, 2026
Oath ("Oath", "we", "us", "our") is an iOS app for focus, app blocking, habits and alarms. This policy explains what information the app collects, what stays on your phone, what leaves it, who it goes to and why, and what you can do about it. It applies to the Oath app, its widgets and extensions, and the email and support channels listed at the end.
Oath was previously published under the name "Stoic". Same app, same accounts, same policy.
The short version: almost everything you do in Oath is stored on your phone and never sent to us. What does leave your phone is listed below, line by line.
The following is stored only on your device (or in the private app group shared with Oath's own widgets and extensions). We cannot see it, and deleting the app deletes it.
When you first open Oath, it creates an anonymous account: a random identifier with no name or email attached. You can use the whole app this way.
If you choose to sign in, we receive and store:
A signed-in account exists so that you can prove it is yours. Your progress itself (habits, streak, journal, library) is stored on your phone as described in section 2.
If you sign in with an email address, we may send you one welcome email. We do not send marketing email.
If you fill in a display name, handle, short bio, Instagram username or profile photo, these are stored on our servers with your account. Oath does not currently show profiles, rankings or messaging to other users. If we launch features that make any profile information visible to others, this policy will say so first.
Oath records which screens you reach, which buttons you tap, and which multiple-choice answers you pick during setup, so that we can see where people get stuck and fix it. These events are sent to our own database under a random analytics identifier generated on your phone. They carry no name, email, device identifier or precise location, and they are not linked to your account.
If you turn notifications on, Oath stores a device push token with your account so a notification can reach your phone. The token says nothing about you. Most of Oath's reminders are scheduled locally on your phone and never involve our servers.
Oath includes the Meta (Facebook) SDK to measure whether people who install Oath from an ad actually keep using it. When you first use the app, iOS asks whether Oath may track you.
In both cases this data is used only to measure advertising. It is never used to show you ads inside Oath, to build a profile of you, or to decide what you see in the app. You can change your choice at any time in iOS Settings under Privacy & Security, then Tracking. Meta's handling of this data is governed by Meta's privacy policy.
Oath+ purchases are made through Apple. We never see your payment card. We use Superwall to present paywalls and measure them, and Superwall receives your account identifier, your first name if you have given one, and events about which paywall you saw and whether you purchased. To stop fraud, the app sends Apple's signed purchase receipt to our server, where its signature is checked and the subscription is recorded against your account.
Three features send a single piece of content to our server, which passes it to OpenAI to process, returns the result, and keeps nothing:
OpenAI processes this content under its API terms and does not use it to train its models. AI output can be wrong; it is a suggestion, not advice.
When you tap Report inside Ghost Feed, the app sends us a description of how the Instagram, TikTok or YouTube page was built (element names and short labels such as "Sponsored"), which of the three it was, and the version of the filtering rules in use, so we can fix those rules. It never includes your messages, captions, photos, videos, comments or who you follow. The app also downloads the current filtering rules for each of the three from our server; those requests carry no account information.
If you allow location access, the morning screen fetches local weather from Open-Meteo using a city-level location (accuracy of about one kilometre). Your location is sent to Open-Meteo for that request and is not stored by us. You can decline, and the weather line simply does not appear.
If you write to us, we receive whatever you choose to send from your own mail app. The "I'm stuck" button pre-fills the app version, iOS version, device model and your day count so we can help faster. You can delete any of it before sending.
Oath blocks apps using Apple's Screen Time framework (Family Controls, Managed Settings and Device Activity). When you choose which apps to block, Apple gives Oath opaque tokens, not app names. Oath does not know which apps you selected or anything about your wider Screen Time history.
To show how long you spent in your blocked apps today, Apple tells Oath when your time in them, taken together, passes set marks (for example 15 or 30 minutes). Oath keeps that daily total, and the last 14 days of it, in the private app group on your phone, where the app and its widgets read it. It is a single number per day, not tied to any named app, and it is never sent to us.
The Screen Time page and its widget draw your usage inside a sealed view that Apple provides. Apple fills in those numbers itself; Oath cannot read them, and they never leave your phone.
The settings needed to run these features live in the private app group on your phone, and none of it is sent to us. Face ID, when you use it to confirm spending credits, is handled entirely by iOS; Oath never sees biometric data.
Ghost Feed loads the Instagram, TikTok and YouTube websites inside Oath and hides the parts you ask it to hide, such as Reels, Shorts, the For You feed, suggestions and ads. Your logins, cookies and sessions for each service are stored by iOS in a separate, isolated web store for each account, on your phone only. We never see your passwords, your messages, your feed, the videos you watch, or what you scroll past. Signing out of an account in Ghost Feed wipes that store.
The time you spend in each service and your daily limits are counted on your phone and stay there.
To notify you of new Instagram direct messages, Oath periodically checks your Instagram inbox page in the background using your own session and turns a new unread count into a local notification. Nothing from that check leaves your phone.
When you share an Instagram, TikTok or YouTube link to Oath from another app, the link is held briefly in the app group until Oath opens it, then discarded.
Instagram is a product of Meta Platforms, Inc. TikTok is a product of TikTok Ltd. and its affiliates. YouTube is a product of Google LLC. Oath is not affiliated with, endorsed by or sponsored by any of them, and your use of each service remains subject to that service's own terms and privacy policy.
To keep a focus session running after you switch apps, Oath may play a silent audio stream. It also uses iOS background refresh to check Ghost Feed's inbox (section 5). Neither collects data.
| Service | Purpose | What it receives |
|---|---|---|
| Supabase | Account, database, file storage, our server functions | Account identifier, sign-in email, profile, push token, analytics events under a random id, subscription record, Ghost Feed reports |
| Apple | App Store, payments, Sign in with Apple, push delivery, Screen Time, speech recognition, Vision, Core Motion | As described in Apple's privacy policy |
| Sign in with Google (optional) | Your Google account identifier and email, if you choose it | |
| Meta (Facebook SDK) | Ad measurement and attribution | Install, open and purchase events; advertising identifier only if you allow tracking |
| Superwall | Paywall display and measurement | Account identifier, first name if given, paywall events |
| OpenAI | Reading book covers, brain dump, roadmap suggestions | The single photo or text you submit, processed and not stored |
| Google Books and Open Library | Book cover and page count lookup | Book title and author |
| Open-Meteo | Morning weather | City-level location for the request |
| Resend | Sending the welcome email | Your sign-in email address |
We do not sell personal data. We do not share it with data brokers. We do not use advertising SDKs to show ads, and there are no ads in Oath.
Where the GDPR or UK GDPR applies, our legal bases are: performance of our contract with you (running the app and your account), your consent (tracking, location, notifications, camera, microphone, motion, and the optional sign-in), and our legitimate interests (security, fraud prevention, understanding and improving the app, measuring advertising where consent is not required).
Settings, then Account, then Delete Account removes your account, profile, profile photo, push tokens and subscription record from our servers. Data on the phone is removed when you delete the app. Purchases are managed by Apple and are not affected; cancel a subscription in your Apple ID settings.
Depending on where you live, you may have the right to access, correct, delete, export or restrict the use of your personal data, to object to processing, and to withdraw consent. You can delete your account in the app, change permissions in iOS Settings, and email us at the address below for anything else. We answer within 30 days. You may also complain to your local data protection authority.
Oath is not directed at children under 13, and you must be 13 or older to use it. We do not knowingly collect personal data from anyone under 13. If you believe a child has given us personal data, email us and we will delete it.
Data in transit is encrypted with TLS. Server data is encrypted at rest. Sign-in tokens are kept in the iOS Keychain. Server functions require authentication and are rate-limited. No system is perfectly secure, and we cannot guarantee absolute security.
Our servers and providers are located in the United States and elsewhere outside your country. Where required, transfers rely on standard contractual clauses or an equivalent safeguard.
We will update this policy when the app changes. The date at the top tells you when. For material changes we will tell you in the app before they take effect.
Email: shavitsappscompany@gmail.com Developer: Shavit Brosh, Israel