Privacy Policy
Last updated: [Effective date to be added]
Oathset is a fitness game: you log your workouts and they level up your character. This policy explains what personal information we collect to run it, why, who we share it with, and the choices and rights you have. We collect only what the game needs. We don't sell your information and we don't show ads.
1. Who we are
Oathset is operated by Sobosoftware Ltd., a company registered in New Zealand ("we", "us"). We are responsible for your personal information under the New Zealand Privacy Act 2020 and, where they apply, the EU and UK General Data Protection Regulations (GDPR).
Sobosoftware Ltd., [Registered address to be added]
Privacy contact: [email protected]
2. What we collect
| Information | Where it comes from | What it's for |
|---|---|---|
| Email address, username and password (stored only as a secure hash) | You, when you create an account | Your account, signing in, account emails (verification, password reset, account deletion) |
| Google or Apple account identifier and email address (with Apple, this may be a private relay address) | Google or Apple, if you choose to sign in with them | Signing you in. We don't receive your Google or Apple password, and we don't keep your real name from them. |
| Workouts you log (exercises, sets, dates and times), your weekly goal, saved workout presets and favourite exercises | You | Levelling up your character, rewards, streaks and your training history |
| Game progress: character appearance, class, level, items, coins, resources, camp, expeditions | Generated as you play | Running the game |
| Friends, friend requests (including an email address you enter to invite someone), waves, parties and guild membership | You and other players | The social features. Friends and guildmates can see your username, character, level, and when you trained. |
| Membership status: which plan, which store, when it renews or ends | Google Play or the App Store, through RevenueCat | Unlocking the game after the free trial. We never see your card or bank details. |
| Time zone, push notification token, app version | Your device | Counting your days correctly, sending the notifications you've allowed, and supporting your version of the app |
| IP address and request logs | Your device, when it talks to our servers | Security, preventing abuse (for example rate limits), and fixing problems |
| Crash and error reports: what went wrong, device model, operating system and app version, and your account ID | The app and our servers, when something fails | Finding and fixing bugs. Reports don't include your email address or username. |
We don't collect your location, contacts, photos, or data from Apple Health or Health Connect, and we don't use advertising identifiers.
Your workout logs
Workout logs say something about your physical activity. We use them only to run the game for you and to show them to the friends and guildmates you choose to play with. In places where the law treats this as health information, we process it because you have chosen to log it. You can delete individual workouts, or your whole account, at any time.
Fair play checks
To keep rewards fair, our servers automatically look for patterns that suggest a workout log isn't genuine, such as an implausible number of sets. If an account is flagged repeatedly, it may earn fewer in-game rewards. This only affects in-game rewards. If you think it has affected you unfairly, contact us and a person will review it.
3. Why we use it (legal bases)
- To provide Oathset to you (performing our contract with you): your account, the game, social features, memberships, and service emails.
- Our legitimate interests: keeping the service secure, preventing cheating and abuse, and fixing bugs. We keep these uses limited, and you can object to them (see section 7).
- Your consent: push notifications, which you allow or refuse in your device's settings, and logging workout information that may count as health information.
- Legal obligations: for example, keeping records where the law requires it.
4. Who we share it with
We share personal information only with service providers that help us run Oathset, under contracts that require them to protect it and use it only for us:
- Our hosting provider: our servers and database are in Germany.
- Migadu (Switzerland): sends our account emails.
- RevenueCat (USA): manages memberships bought through Google Play and the App Store.
- Google (Google Play, Firebase Cloud Messaging, Sign in with Google) and Apple (App Store, Apple Push Notification service, Sign in with Apple): payments, push notifications, and sign-in if you use it.
- Expo (USA): delivers push notifications to Google's and Apple's notification services, and delivers app updates.
- Sentry: crash and error reports, stored in the EU.
Other players see what the game shows them: your username, character, level and training activity if you're friends or in the same guild or party. We may also disclose information when the law requires it, to protect someone's safety, or as part of a sale or restructuring of our business (in which case this policy will continue to protect it). We never sell personal information or share it for advertising.
5. International transfers
We are based in New Zealand, our servers are in Germany, and some providers above are in the United States. When personal information moves between countries, we make sure it stays protected to the standard the law requires: for example, through the European Commission's Standard Contractual Clauses or the EU-US Data Privacy Framework, and, under New Zealand law, with comparable safeguards.
6. How long we keep it
- Your account and game data: for as long as you have an account. When you delete your account, we erase it from our live systems straight away, and it disappears from our backups within 30 days as they rotate.
- Membership records: your RevenueCat record is deleted with your account. Google and Apple keep their own purchase records under their privacy policies.
- Server logs and error reports: kept for short periods, normally no more than 90 days.
- Email links (verification, password reset, account deletion): expire within 24 hours.
7. Your rights
Depending on where you live, you can ask us to:
- give you a copy of your personal information, including in a portable format;
- correct information that's wrong;
- delete your information (you can also do this yourself, see below);
- restrict or object to how we use it, including our legitimate-interest uses;
- withdraw consent you've given, without affecting what we did before.
You can delete your account at any time in the app (Settings → Delete account) or on the web atour account deletion page. For anything else, email[email protected]. We'll respond within 30 days, or sooner where the law requires. We may need to confirm it's really you first.
If you're unhappy with how we've handled your information, please tell us first. You can also complain to the Office of the Privacy Commissioner in New Zealand (privacy.org.nz), to the data protection authority where you live in the EU, or to the UK Information Commissioner's Office.
California residents: you have the right to know, delete and correct your personal information, and not to be discriminated against for using these rights. We don't sell or share personal information as California law defines those terms.
8. Children
Oathset is not for children under 13. If the law where you live sets a higher minimum age for agreeing to the use of your personal information (up to 16 in some European countries), you must be that age, or have permission from a parent or guardian. We don't knowingly collect personal information from children under 13. If you believe a child has given us their information, contact us and we'll delete it.
9. Security
Everything between the app and our servers is encrypted in transit. Passwords are stored only as secure hashes, access to our systems is restricted, and our database is backed up. No system is perfectly secure, but we work to protect your information and will tell you and the authorities about a serious breach as the law requires.
10. Changes to this policy
If we make significant changes, we'll let you know in the app or by email before they take effect. The date at the top shows when this policy last changed.
11. Contact
Sobosoftware Ltd., [Registered address to be added]
[email protected]