Privacy Policy

Last updated: 24 October 2026

What changed: Oathset, the waitlist and the beta are for people 18 or older; campaign tags are no longer kept in your browser; a section on the beta; our Discord server; how fair play checks work; our hosting and backup providers named; visits to our website counted with Cloudflare Web Analytics; our address and company number added.

Oathset is a fitness game: you log your workouts and they level up your character. This policy explains what personal information we collect to run it, why, who we share it with, and the choices and rights you have. We collect only what the game needs. We don't sell your information and we don't show ads. It also covers the Oathset waitlist on our website.

1. Who we are

Oathset is operated by Sobosoftware Ltd., a company registered in New Zealand (company number 9432053) ("we", "us"). We are responsible for your personal information under the New Zealand Privacy Act 2020 and, where they apply, the Australian Privacy Act 1988, the EU and UK General Data Protection Regulations (GDPR), and US state privacy laws such as California's.

Sobosoftware Ltd., 19 Royal Road, Massey, Auckland, New Zealand
Privacy contact: [email protected]

2. What we collect

We don't collect your location, contacts, photos, or data from Apple Health or Health Connect, and we don't use advertising identifiers.

Your workout logs

Workout logs say something about your physical activity. We use them only to run the game for you and to show them to the friends and guildmates you choose to play with. In places where the law treats this as health information, we process it because you have chosen to log it. You can delete individual workouts, or your whole account, at any time.

The waitlist

You can join the waitlist on our website with just your email address, before Oathset is released. We'll email you devlogs, updates about the game, and an email when it's released, and nothing else. Every email has a link to unsubscribe, and you can unsubscribe at any time.

After you join, we email you a link to confirm your address. Only confirmed addresses get a place on the waitlist or receive its updates. If you never confirm, we delete your sign-up 30 days later. Once you confirm, you get your own page on our website, reached by a private link we email you, showing your place, your invites and your rewards. You can leave the waitlist from that page too.

When you join, you get your own invite link. If someone joins with it, we record that you invited them so we can move you up the list and give you the rewards shown on our website. We don't show your email address to the people you invite, or theirs to you. Invite rewards are given to the Oathset account you create with the same email address. Our Terms of Use explain how invite rewards work.

The beta

The closed beta runs on the real service, so everything in this policy applies to it. Ourbeta terms explain how it works. On top of that:

• On Android, you join the test by joining our Google Group with your Google account, so we see that account's email address while you're in the group. Google Play's testing track then delivers the beta to you.
• On iPhone, you join through a TestFlight public link. Apple's TestFlight passes us crash reports, the feedback and screenshots you choose to send through it, and details of your device. If we invite you by email, it also passes us your name and email address.
• We don't upload waitlist email addresses to Apple or Google.
• If you send us feedback, by email or on our Discord, we keep it to improve Oathset.
• Your beta account and progress carry over to the full game at launch.

Fair play checks

To keep the game fair for everyone, our servers automatically check how much each account logs. If an account logs more in a day or a week than even elite athletes train (for example, more than 40 sets in a day), it's under review for the next 28 days. While it's under review, its guildmates see it marked "under review", and players outside its guild can't see or find it. It never loses rewards, its workouts still count, and the app looks the same to its owner.

We also note logs that look unusual, such as sessions logged seconds apart, to see how common they are. These notes don't change anything in your game. If you think a check has affected you unfairly, contact us and a person will review it.

3. Why we use it (legal bases)

• To provide Oathset to you (performing our contract with you): your account, the game, social features, memberships, and service emails.
• Our legitimate interests: keeping the service secure, preventing cheating and abuse, and fixing bugs. We keep these uses limited, and you can object to them (see section 7).
• Your consent: push notifications, which you allow or refuse in your device's settings, logging workout information that may count as health information, and the waitlist: its emails, invites and email tracking. You give that consent when you join the waitlist, and you withdraw it by unsubscribing.
• Legal obligations: for example, keeping records where the law requires it.

4. Who we share it with

We share personal information only with service providers that help us run Oathset, under contracts that require them to protect it and use it only for us:

• Hetzner (Germany): hosts our servers and database, in Germany.
• Cloudflare R2: holds encrypted copies of our database for up to 30 days, in its Oceania region.
• Cloudflare (USA): routes and protects traffic between the app or the waitlist form and our servers, runs the check on the waitlist form that stops automated sign-ups (Turnstile), and counts visits to our website without cookies (Web Analytics). Because it handles the connection itself, it processes everything you send us while it's in transit, including your sign-in details and workout logs.
• Resend (USA): sends our emails: account emails, and the waitlist's confirmation, invite and update emails.
• RevenueCat (USA): manages memberships bought through Google Play and the App Store.
• Google (Google Play, Firebase Cloud Messaging, Sign in with Google) and Apple (App Store, Apple Push Notification service, Sign in with Apple): payments, push notifications, sign-in if you use it, and the closed beta (TestFlight, and Google Play's testing tracks with our Google Group: see The beta).
• Expo (USA): delivers push notifications to Google's and Apple's notification services, and delivers app updates.
• Sentry: crash and error reports, stored in the EU.

We also run a community server on Discord (USA). Joining it is up to you. What you post there, and your Discord account, are handled by Discord under its own privacy policy, and other members can see what you post.

Other players see what the game shows them: your username, character, level and training activity if you're friends or in the same guild or party. We may also disclose information when the law requires it, to protect someone's safety, or as part of a sale or restructuring of our business (in which case this policy will continue to protect it). We never sell personal information or share it for advertising.

5. International transfers

We are based in New Zealand. Our servers and database are in Germany, our database backups are held in Oceania, and some providers above are in the United States. When personal information moves between countries, we make sure it stays protected to the standard the law requires: for example, through the European Commission's Standard Contractual Clauses or the EU-US Data Privacy Framework, and, under New Zealand law, with comparable safeguards.

6. How long we keep it

• Your account and game data: for as long as you have an account. When you delete your account, we erase it from our live systems straight away, and it disappears from our backups within 30 days as they rotate.
• Membership records: your RevenueCat record is deleted with your account. Google and Apple keep their own purchase records under their privacy policies.
• Server logs and error reports: kept for short periods, normally no more than 90 days.
• Email links (verification, password reset, account deletion): expire within 24 hours.
• Unconfirmed waitlist sign-ups: 30 days, then deleted.
• The waitlist: until you ask us to delete it. When you leave (unsubscribe, or leave from your waitlist page), we stop emailing you and keep your entry marked as left, so we never email you again and your invites are still yours if you join again.
• Invite records: until 6 months after Oathset is released, so the rewards can go to your account when you create it, or until you ask us to delete them. Unsubscribing from the emails doesn't delete them.

7. Your rights

Depending on where you live, you can ask us to:

• give you a copy of your personal information, including in a portable format;
• correct information that's wrong;
• delete your information (you can also do this yourself, see below);
• restrict or object to how we use it, including our legitimate-interest uses;
• withdraw consent you've given, without affecting what we did before.

To stop the waitlist emails and leave the waitlist, use the unsubscribe link in any of them, or leave from your waitlist page.

You can delete individual workouts, and some other data, without deleting your account: seedeleting your data.

You can delete your account at any time in the app (Settings → Delete account) or on the web atour account deletion page. For anything else, email[email protected]. We'll respond within 30 days, or sooner where the law requires. We may need to confirm it's really you first.

If you're unhappy with how we've handled your information, please tell us first. You can also complain to the Office of the Privacy Commissioner in New Zealand (privacy.org.nz), the Office of the Australian Information Commissioner (oaic.gov.au), the data protection authority where you live in the EU, or the UK Information Commissioner's Office.

8. California residents

If you live in California, the California Consumer Privacy Act gives you the right to:

• Know what personal information we collect about you, where it comes from, why we use it and who we disclose it to, and get a copy of it;
• Delete it, which you can also do yourself by deleting your account;
• Correct it if it's wrong;
• Opt out of the sale or sharing of it. We don't sell or share personal information as California law defines those terms, so there is nothing to opt out of;
• Not be discriminated against for using these rights: we won't charge you more or give you a worse service.

Sections 2 to 6 describe what we collect, where it comes from, why, who receives it and how long we keep it. In California's terms, that is identifiers (such as your email address, username, account ID and IP address), commercial information (your membership status), internet or other electronic network activity (gameplay and request logs), and sensitive personal information (your account sign-in details, and workout logs if they count as health information). We use sensitive personal information only to provide Oathset to you and keep it secure and fair.

To use these rights, email [email protected]. Someone you authorise can ask for you; we'll ask for proof of their authority and may ask you to confirm your identity directly. We'll respond as described in section 7.

9. Children

Oathset, including the waitlist and the beta, is only for people 18 or older. If we learn an account or a waitlist sign-up belongs to someone under 18, we delete it. If you believe someone under 18 has given us their information, contact us.

10. Security

Everything between the app and our servers is encrypted in transit. Passwords are stored only as secure hashes, access to our systems is restricted, and our database is backed up. No system is perfectly secure, but we work to protect your information and will tell you and the authorities about a serious breach as the law requires.

11. Changes to this policy

If we make significant changes, we'll let you know in the app or by email before they take effect. The date at the top shows when this policy last changed.

12. Contact

Sobosoftware Ltd., 19 Royal Road, Massey, Auckland, New Zealand
New Zealand company number 9432053
[email protected]