swear it

Privacy Policy

Effective 7 October 2026

Swear It is run by Nalla Sai Abhiram, Visakhapatnam, Andhra Pradesh, India ("Swear It", "we"), who decides how the data described here is used (the "controller"). This policy covers the Swear It app for iPhone and Android and this website. Questions and requests: spatialsimp@gmail.com.

What we collect, and why

What	Why
Your account: email address, name, username, time zone, and a profile picture if you add one. If you sign in with Apple or Google, the name and email they give us. If you choose a password, we keep only a scrambled (hashed) form of it.	To sign you in, keep your promises on every phone you use, and put the right clock on your deadlines.
Your promises: what you promised, how often, by when, how it's proved, what a missed day costs, your rule for appeals, your reminders.	This is the service.
Proof: photos, screenshots, videos, time-lapse frames, voice notes and writing you send; when and how each was captured; the verdict and its reason.	To decide whether a day was kept, and to show you why.
Appeals and requests: what you wrote, and any pictures, video or voice note you sent with it. If you ask a person to review a charge, what you wrote to them.	To decide them against the rule you wrote, and to review a decision when you ask.
Health and fitness figures, only when a promise is proved by one and only the measures that promise uses (for example steps, workouts, sleep, mindful minutes, heart rate during a gym check-in). Read from Apple Health or Health Connect with your permission.	To check that promise, and to let your coach answer questions about your own progress. Nothing is written back to Health. Health data is never used for advertising or shared with data brokers. See our Health Data Privacy Policy.
Location, only when a promise is about a place: where you are at the moment you check in, and, if you allow location "Always", the moments you arrive at or leave a place you saved.	To prove check-ins and place-based reminders. Swear It keeps the places you save and those arrivals and departures; it does not keep a trail of where you go.
App usage (Screen Time), only for a promise about an app's use: minutes of use for the apps that promise names (Android), or whether a limit you set was crossed (iPhone).	To check that promise.
Connected apps you link (for example GitHub, Duolingo, RescueTime or Todoist): your username, key or sign-in token for that app, and the figures a promise counts.	To prove a promise from that app's own numbers. You can disconnect an app at any time.
Coach conversations: your messages, pictures and voice notes to the coach, its replies, the notes it keeps about your goals, and check-ins you ask it to schedule. With your permission, today's calendar event titles and times, so it can fit reminders around your day.	To give you a coach that knows your promises and can act on them.
Payments: the brand, last four digits, expiry date and type (credit or debit) of your card, whether it was added through Apple Pay or Google Pay, the references our payment processor gives us for you and your card, when you agreed to be charged for missed days, and a record of every charge, refund and dispute. Your full card number and security code go straight from the app to the processor and never reach our servers. Subscriptions are handled by Apple or Google; we receive what plan you're on and when it renews or ends.	To charge the stake for a missed day, refund an upheld appeal, and know whether you subscribe.
Your phone: a notification token, whether it's an iPhone or Android, the app version, and when it was last seen.	To send your reminders and verdicts, and to let you sign a lost phone out.
Your network address (IP address), which every request to our servers carries.	To limit abuse: we count requests per address by the hour. We keep it only in a scrambled (hashed) form, for up to three hours. Our hosting provider also keeps short-lived technical logs.
Your age range, where the law requires us to check it (for example in some US states): the age range your phone's app store reports for you (for example "18 or over"), never your date of birth. Only the result is kept, on your phone.	To make sure Swear It is used only by adults.
First-run steps: before you have an account, which setup screens were reached, under a random ID made on your phone. Never your words or who you are.	To see where setup loses people and fix it.
Problem reports you send, with your app version and phone model.	To find and fix what broke.

We don't collect your contacts, your photo library (only the pictures you pick), your precise location in the background beyond the places you saved, or anything for advertising. There is no advertising, no analytics from other companies and no cross-app tracking in Swear It. We receive data from you and your phone, from Apple or Google when you sign in or subscribe through them, and from the apps you choose to connect; we don't buy data about you from anyone.

Automated checks, and asking for a person

Parts of Swear It are automated systems that use artificial intelligence. The checker that reads your proof and your appeals, the coach, the step that sets a promise up from your words, and the weekly review are run by software, using models from OpenAI through its API. When you write to the coach you are writing to an automated system, not a person.

What is sent. Photos, screenshots, videos, voice notes and writing you send as proof or with an appeal; your messages to the coach, with the details of your promises and the health figures or calendar entries it needs to answer; the words of a promise you're setting up; and the figures your weekly review is written from. The app asks for your agreement, naming OpenAI, before anything is sent, and you can withdraw it in Settings; without it, proof that needs judging can't be checked. OpenAI processes this on our behalf. Under its API terms it does not use it to train its models, and it may keep it for up to 30 days to watch for abuse before deleting it. Before you have an account, the words of a promise you type during setup are sent without your name or any account attached.

What is decided automatically. Whether a piece of proof counts; whether a figure from your phone or a connected app meets the target you set; and whether an appeal or request is granted under the rule you wrote for yourself. If a day is missed, the stake you chose is charged. These decisions are made without a person, because an instant and impartial check is the service you ask for when you make a promise. You are always given the verdict and its reason.

Your safeguards. You can send better proof, appeal within 14 days, and ask a person on our team to review any automated decision that led to a charge: open the charge in the Money tab and choose "Ask a person to review", or write to spatialsimp@gmail.com. You can say what you think went wrong. The person can overturn the decision and refund the charge. We answer within 30 days, and usually much sooner.

Promises you choose to share as templates are screened automatically for abusive content before others can see them.

Who else receives your data

We share data only with the companies that run parts of the service for us, under contracts that limit them to doing that, and only what each needs:

• Supabase: our database, file storage and sign-in. Data is stored in the United States (Northern Virginia).
• OpenAI: checking proof and appeals, the coach, speech-to-text and read-aloud, as described above.
• Our payment processor: stores your card and makes charges and refunds. Your card details go to it directly from the app, and we give it your name, email address and account ID so a payment can be matched to you. It also uses information about the payment and your device to prevent fraud, under its own privacy policy. If you pay with Apple Pay or Google Pay, Apple or Google passes your payment details to it. No card can be saved and no charge made until a processor is in place, and it will be named here from that day.
• Apple and Google: push notifications, sign-in, your age range where the law requires it, and subscriptions bought in their stores.
• RevenueCat: keeps your subscription status in step between the store and your account. It receives your account's ID and purchase records, not your promises.
• Resend: delivers the emails that carry a sign-in code. It receives your email address and that email.
• Apps you connect: we ask that app for your figures using the access you gave.
• Telegram or a phone call provider, only if you link Telegram or ask the coach to call you.

Friends. If you ask a friend to vouch for a promise, that friend sees that promise and the proof you send for it, and nothing else. If you share a promise as a template, others see its name, how it's proved and its schedule, with your name only if you chose to show it; never your days, proof or money.

We don't sell personal data, and we don't share it for advertising. We may disclose information if the law requires it, or to protect people from serious harm or fraud. If Swear It is ever sold or merged, your data would move to the new owner under this policy, and we would tell you first.

How long we keep it

• Proof pictures, clips and voice notes are deleted 15 days after the day they were for is settled, except the most recent kept picture of a running promise, which new proof is compared with to spot the same picture sent twice. What stays is the verdict and a fingerprint of the file, never the file.
• Files sent with an appeal or request are deleted 15 days after it is decided.
• Pictures and voice notes sent to the coach are deleted after 30 days.
• Health and fitness figures are deleted after 400 days.
• Arrivals at and departures from your saved places are deleted after 90 days.
• First-run steps are deleted after 90 days. Problem reports are deleted after two years.
• Network addresses used to limit abuse are kept in hashed form for up to three hours.
• Your promises, verdicts, charges and conversations are kept while you have an account.
• When you delete your account, your profile, promises, proof, appeals, conversations, connected-app access and files are deleted at once. Copies in our provider's routine backups are overwritten within 7 days. Our payment processor keeps its own record of payments as the law requires of it.

Your choices and rights

• Download your data: Settings, Privacy, Download my data.
• Delete your account: Settings, Delete account. It takes effect at once (unless you put your own lock on deleting, which always opens). You can also ask without the app: see Delete your account. Deleting your account does not cancel a subscription: cancel that in the App Store or Google Play.
• Turn off proof checking by OpenAI: Settings.
• Have a person review an automated decision: Money, the charge, Ask a person to review.
• Withdraw a permission (Health, location, camera, microphone, calendar, notifications) in your phone's settings at any time. Promises that depend on it can then only be proved another way.
• Disconnect an app: Settings, Connected apps.
• Correct your details: Settings, or ask the coach.

Depending on where you live (for example the EU, the UK or some US states), you may also have the right to know what we hold about you and get a copy of it, to have it corrected or deleted, to move it elsewhere, to object to or restrict certain uses, to withdraw a consent you gave, and not to be treated worse for using these rights. Write to spatialsimp@gmail.com from the email address on your account and we will answer within 30 days. If we can't do what you ask, we will say why, and you can ask us to look again.

Complaints. If you think we have handled your data wrongly, tell us at spatialsimp@gmail.com. We will acknowledge your complaint within 30 days and tell you the outcome without undue delay. You also have the right to complain to your data protection authority: in the UK the Information Commissioner's Office (ico.org.uk), in the EU the authority where you live.

Legal bases (EU and UK)

We process your account, promises, proof and payments, and make the automated decisions described above, because they are necessary to perform our contract with you. We process Health data, location, Screen Time and calendar entries, and send proof and coach messages to OpenAI, on your explicit consent, which you can withdraw at any time. We keep first-run statistics, limit abuse and secure the service on our legitimate interest in making the service work and keeping it safe. We keep payment records, and check your age where required, because the law requires it.

International transfers

Our providers process data in the countries where they operate, mainly the United States. Our team works from India. Where the law requires it, transfers rely on standard contractual clauses or an equivalent safeguard, and you can ask us for a copy.

Security

Data is encrypted in transit and at rest. Each account can read only its own rows, enforced by the database itself, and files are private to the account that uploaded them. Nobody who isn't signed in can read any table. Secrets you put in the vault are encrypted and never shown to anyone but you. When you choose a password we check that it hasn't appeared in a known data breach; only the first five characters of a scrambled form of it are sent to the checking service (Have I Been Pwned), never the password. No system is perfectly secure. If a breach affects you, we will tell you and the authorities as the law requires.

Health data

Our use of information received from Apple HealthKit and from Health Connect follows Apple's HealthKit rules and Google's Health Connect Permissions policy, including its Limited Use requirements. We use it only to check the promises you prove with it and to show and explain your own progress to you. We never use it for advertising, never sell it, never use it to decide credit or insurance, and never pass it to anyone except the providers that run the service for us. How we handle health data, and your rights over it in Washington and Nevada, are set out in our Health Data Privacy Policy.

United States

California. In the last 12 months we have collected the categories described in the table above: identifiers (name, email, account ID, network address), commercial information (charges, refunds, subscription status), app activity (promises, verdicts, first-run steps), precise geolocation and health information where you chose a promise that uses them, pictures, video and audio you sent, and payment card details as described. We use them for the purposes in that table and disclose them only to the service providers listed above. We do not sell personal information or share it for cross-context behavioural advertising, and we use sensitive information only to provide the service you asked for. You can ask to know, correct or delete your information, yourself or through an authorized agent, as described under "Your choices and rights"; we won't treat you differently for asking. We do not track you across other websites or apps, so there is nothing for a "Do Not Track" or Global Privacy Control signal to switch off.

Nevada. We do not sell covered information as Nevada law defines it.

Washington and Nevada. See our Health Data Privacy Policy.

Children

Swear It is for adults. You must be 18 or older to use it, and we don't knowingly collect data from anyone younger. If you believe a minor has an account, write to us and we will delete it.

This website

This website sets no cookies, runs no analytics and loads nothing from other companies. The app stores what it needs to work on your phone (your sign-in, your settings, drafts) and nothing for tracking.

Changes

If this policy changes in a way that matters, we will say so in the app before it takes effect. The date at the top is when this version began to apply.

Contact

Nalla Sai Abhiram, Visakhapatnam, Andhra Pradesh, India. Email: spatialsimp@gmail.com.