Privacy Policy

Last updated: 2026-09-17

This Privacy Policy describes what information Vow ("we", "us") collects when you use the Vow iOS application, why we collect it, and your rights over it. Vow is operated by Hassan Hajarat, a sole developer based in Amman, Jordan.

Short version: Vow is built around a single privacy principle — we don't know which apps you block, and we don't track what you do on your phone outside Vow. Apple's Screen Time framework hands us an opaque, encrypted reference to your selection; the actual list never leaves your device. We do use Mixpanel to measure how the app itself is used — what that covers, and the strict limits on it, are described below.

Information we collect

From Sign in with Apple

When you create your account, Apple sends us:

• A stable user identifier (Apple's "sub") that lets us recognize you on this and future installs.
• Your email address — either your real address, or, if you choose, the Apple private relay address that forwards to you.
• Your name, only if you choose to share it on first sign-in.

From your use of the app

• Your active vow: the start time, end time, current state ("active", "completed", "expired"), and an opaque Family Controls selection blob produced by Apple's Screen Time framework. This blob references the apps and categories you chose, but it is not human-readable and cannot be decoded by us. It only resolves to specific apps when running on your device under your Apple ID.
• Your account–device pairing: the Apple ID identifier described above is also written to your iCloud Keychain so that reinstalling Vow on the same Apple ID resumes the active vow without re-authentication.

Witnessed vows

If you choose to make a vow public, Vow lets you mint a witnessed-vow certificate at a shareable link (makevow.app/v/<id>). This is an explicit, opt-in action — nothing is published unless you create a certificate. When you do:

• The display name you choose (up to 24 characters — it does not have to be your real name) is published at that public URL, together with the vow's start time, end time, and outcome (kept or cracked).
• Anyone with the link can witness the vow by entering a name. That name is user content from a person who may not be a Vow user — we do not authenticate witnesses — and it is displayed publicly on the certificate alongside the other witnesses.
• We record the IP address of each witnessing request in a short-lived rate-limit table, solely to prevent abuse (e.g. mass-submitting fake witnesses). These records expire automatically (typically within minutes to a few hours) and are not linked to your Vow account.
• The vow's owner can remove any witness from a certificate at any time from within the app.
• Deleting your account deletes all of your certificates, including the display name and every witness name recorded on them — see "Your rights" below.

From subscriptions

Your subscription state (active or lapsed), product ID (monthly or yearly), and an anonymous purchaser identifier are processed by RevenueCat on our behalf. Apple processes the payment itself; we never see card numbers, billing addresses, or transaction details.

Product analytics

To understand how the app is used and to improve it, we record in-app product events using Mixpanel — for example, opening the app, viewing onboarding or paywall screens, starting or completing a vow, creating or editing a schedule, and errors. These events are tied to your Apple identifier (the same "sub" above) and carry coarse context such as your app version, OS version, subscription status, and how many schedules you have.

We deliberately limit what analytics can see:

• We never send Mixpanel the specific apps or categories you block. Apple's opaque token stays on your device and our backend and never reaches analytics.
• We never send your email address, your name, or any Sign in with Apple tokens. This exclusion is enforced in our code.
• We do not use Apple's advertising identifier (IDFA), and no advertising SDKs are integrated.

Our subscription processor, RevenueCat, also forwards subscription and revenue events to the same Mixpanel profile.

What we do not collect

• The specific apps or categories you have blocked. We see only Apple's opaque token.
• Your device-wide screen time, your app usage outside Vow, or your browsing history. (Our product analytics, described above, see only your activity inside Vow.)
• Location, contacts, photos, microphone, camera, calendars, health data, or any other system data.
• Apple's advertising identifier (IDFA). No advertising SDKs or ad-tracking are integrated.

Why we collect each piece

Where your data is stored

• Amazon Web Services (AWS) hosts our backend. Vow records, account identifiers, and witnessed-vow certificates are stored in Amazon DynamoDB, and our API runs on AWS Lambda. All data is hosted in the AWS eu-central-1 region (Frankfurt, Germany — EU).
• Apple iCloud Keychain holds a copy of your active vow on your devices. This data syncs through Apple's infrastructure and is not accessible to us.
• RevenueCat holds your subscription receipt and an anonymous identifier.
• Mixpanel holds the in-app product events described above, tied to your Apple identifier.
• Apple handles the App Store purchase, Sign in with Apple, and Family Controls authorization. Their handling of that data is covered by Apple's own privacy policy.

Sharing

We do not sell your information, and we do not share it with advertisers. The only third parties that receive any data are the service providers listed above (AWS, RevenueCat, Mixpanel, Apple), and only to perform the functions we use them for.

Retention

• Active vow record: kept while the vow is active, and for up to 30 days after it ends, to support cross-device recovery.
• Account identifier and email: kept while your account exists.
• Subscription state: kept while your subscription is active, plus the period Apple and RevenueCat require for receipt validation.
• Product analytics events: kept while your account exists, and deleted from Mixpanel when you delete your account.
• Witnessed-vow certificates: kept until you delete your account. Witness IP addresses are kept only briefly for abuse prevention and expire automatically regardless.

Your rights

You can:

• Delete your account and data at any time: in the app, go to Settings › Account › Delete Account. This immediately and permanently erases your account record, your vows and schedules, and all of your witnessed-vow certificates (including the display names and witness names on them) and your Mixpanel profile and events — no email required. It also revokes Sign in with Apple. Deletion is refused while a vow is active or a recurring schedule is inside its window (see the callout below). Cancellation of your subscription is separate (see below); deleting your account does not cancel it.
• Cancel your subscription at any time through Settings › Apple ID › Subscriptions on your device. Cancellation does not delete your account.
• Revoke Sign in with Apple via Settings › Apple ID › Sign in with Apple. This will sign you out of Vow on this device.

Children

Vow is intended for adults working on their own digital habits and is not directed at children under 13. We do not knowingly collect information from children under 13.

Changes to this policy

If we change this policy in a material way, we will notify you in-app before the change takes effect.

Contact

Vow — support@makevow.app

For general help or questions, reach us at the email above. To delete your account, use Settings › Delete Account in the app — see "Your rights" above.