Privacy policy

Effective November 10, 2026 · vow is made by Gelotto (“we”).

vow is a private app for adults in a consensual Dom/sub dynamic. This policy explains what vow collects, why, how it is protected, and how to delete it.

What vow collects

Your account

• An account identifier. You can start as a guest; if you sign in with Google or Apple, we receive that account's identifier, and Firebase Authentication (Google) keeps your email address and name for signing in.
• The display name you choose (up to 40 characters), your time zone, and the time you confirmed you are 18 or older.

What you and your partner write: encrypted

Task titles and notes, item icons, rewards, consequences, rules, free-text limits, journal entries, check-in notes, point reasons and the titles you call each other are encrypted on your phone (XChaCha20-Poly1305) with a key that only your and your partner's phones hold. Our server stores and relays only the ciphertext and cannot read it. Private journal entries use a key only you hold.

What the app needs in the clear

• The structure of your dynamic: who is the Dom and who is the sub, schedules and due times, points and balances, task and reward states, consequence durations, numeric limits, pauses, and when things happened.
• Your devices: platform (Android or iOS), a push token so we can tell your phone to sync, a public key used to pass your shared key between your phones, and when each device was last seen.
• Your sign-in sessions, so you stay signed in.

What vow does not collect

No location, contacts, photos, microphone, advertising identifiers or browsing data. vow has no ads and no analytics or tracking SDK. Notifications from our server contain generic text only (for example “Something needs you”); task reminders are built on your phone.

How we use it

Only to run vow: to sign you in, sync your dynamic between your phones, send sync and reminder notifications, apply the rules of the app (points, schedules, limits, pause), keep the service secure and prevent abuse. We do not use your data for advertising or profiling, and we do not sell it.

Who processes it

• DigitalOcean hosts our servers, database and encrypted backups (United States).
• Google Firebase handles sign-in (Firebase Authentication) and push notifications (Firebase Cloud Messaging).
• Apple handles Sign in with Apple, only if you choose it.

We may disclose information if the law requires it. Because your writing is end-to-end encrypted, we cannot disclose it in readable form.

Security

All connections use HTTPS. The database is on encrypted volumes, and backups are encrypted. Your shared key is passed between your phones sealed to each phone's public key; the server never sees it. On your phone, keys are kept in the Android Keystore or iOS Keychain, and you can turn on a fingerprint or Face ID lock.

Keeping and deleting your data

• Delete your account any time in the app: tap your names at the top of the home screen, then Settings → Delete account. You are signed out at once and your data is purged within 24 hours. See Delete your account.
• A dynamic's shared data is purged when both members have left, or 90 days after one of you leaves it.
• Backups are kept for up to 30 days, so deleted data leaves them within 30 days.
• You can download everything vow holds about you in Settings → Export my data.

Your rights

You can access, export, correct and delete your data in the app. Wherever you live, you can also email us to exercise any right you have under laws such as the GDPR or CCPA, and we will answer within 30 days.

Adults only

vow is only for people 18 or older. We do not knowingly collect data from anyone younger. If you believe a minor uses vow, email us and we will delete the account.

Changes and contact

We will post changes here and update the date above; important changes will also be shown in the app. Questions or requests: mobile@gelotto.io.