Privacy Policy

1. Who this policy covers

This policy explains how the Oath team (“we”, “us”) handles information when you use the Oath iOS app and its AutoFill extension, visit this website, or contact us. It describes both what happens on your device and the limited information we receive.

2. Information stored on your device

Oath stores what you add to it: two-factor authentication secrets and their issuer, account name and website; passwords, usernames and websites; passkeys, including their private keys; the spaces you create; notes; and your app settings.

• This vault is encrypted on your device with AES-GCM. The encryption key is kept in the iOS Keychain.
• The Oath app and its AutoFill extension share the vault through an App Group and a shared Keychain group on your device, so the extension can fill credentials.
• One-time codes are generated on your device. Your vault is not sent to us.

3. Features and permissions

AutoFill

When you turn Oath on as an AutoFill provider, Oath gives iOS a list of the websites and account labels in your vault so the system can suggest the right item. Secrets, passwords and private keys are not part of that list. Codes and passwords are produced at the moment you choose them.

Camera and photos

The camera is used only to scan two-factor QR codes. If you choose an image or screenshot, only that image is read to find a QR code. Images are processed on your device and are not stored or sent anywhere.

Face ID and passcode

Unlocking is handled by iOS. Oath only learns whether authentication succeeded; it never receives your biometric data.

Clipboard

When you copy a code or password, Oath can clear it from the clipboard after 60 seconds. You can change this in Settings.

4. Sync, backups and exports

iCloud sync

If iCloud sync is available in your version of Oath and you turn it on, your vault is stored in your own private iCloud database under your Apple Account, with its contents in encrypted fields. We cannot access it. Apple’s handling of iCloud data is described in Apple’s Privacy Policy. Turning sync off stops further uploads.

Backups and exports

Backup and export files are created only when you ask for them, and you decide where they go. Encrypted backups are protected by a password you choose; we cannot recover it. A plain-text export is not encrypted and should be handled with care.

5. Purchases

Apple processes all payments. Oath uses StoreKit on your device to check which plan is active and to restore purchases. We do not receive your payment card details. Apple provides us with sales and subscription reports that do not identify you personally.

6. Support and this website

If you email us, we receive your email address, your message and anything you attach, and use them only to help you. Please never send codes, secrets, passwords, recovery codes or backup files.

This website serves its own fonts, images and scripts. It sets no cookies and runs no analytics, tracking pixels or advertising. The hosting server may keep standard access logs, such as IP address, requested page, browser type and time, for security and reliability.

7. What we don’t do

• We don’t collect data from the app. Its App Store privacy label is “Data Not Collected”.
• We don’t track you across other companies’ apps or websites, and the app does not access the advertising identifier.
• We don’t sell or share personal information for advertising.

8. Retention and security

Your vault stays on your device until you delete items, erase the vault, or delete the app. Deleted items remain in Trash for 30 days unless you empty it sooner. iOS may keep some Keychain items after the app is deleted, according to Apple’s behavior. Export a backup before deleting the app if you want to keep your data.

Support emails are kept for as long as needed to answer you and to meet legal obligations, then deleted. No method of storage or transmission is perfectly secure, but Oath is designed so that your credentials never need to leave your control.

9. Your choices and rights

Because your vault is on your device, you can view, change, export or delete it at any time in the app. Depending on where you live, you may also have rights to access, correct or delete personal information we hold, such as support emails, or to object to or restrict its processing, and to complain to a data protection authority. Contact us to make a request.

10. Children

Oath is a general security tool and is not directed at children under 13. We do not knowingly collect personal information from children.

11. Changes and contact

If we change how Oath handles information, we will update this page and the date above, and explain significant changes in the app or on the App Store when appropriate.