Privacy Policy

Effective September 28, 2026 · Snowleopard Labs LLC

In one sentence: no screenshots, no record of your normal browsing, no advertising IDs, no data sold or shared. The data we do keep is a small, deliberate set. Random ID, categories, partner emails, a 7-day record of blocked attempts, and subscription state. The full breakdown is below.

What we do not collect

No screen captures. The apps have no permission to read your display.
No record of your normal browsing. The sites you visit are answered and immediately forgotten. They are not logged and not stored. There is one exception, and it is a site you chose. A domain you put on your own allow list is recorded for 7 days when you use it, the same way blocked attempts are, so the app can show you how often you went there. That is spelled out in full below. Your partners only ever get a count of blocked attempts and the categories they fell under, never a list of sites.
No list of the apps you block. When you block apps on your phone, the choice of which apps stays on your phone. We never receive the name of any app you block or unblock. The most that leaves your phone is a count of how many apps you just unblocked, never which apps. That count powers your partner's alert and the 7-day accountability tally described below.
No engagement analytics. We run no analytics product, and we never record what you do inside the app. No screen views, no taps, no session history. Our server does note the time your device last checked in with it, which is covered below; that exists so your partner can be told the difference between a phone that is switched off and a filter that was taken out of the path. (Blocking apps does send your partner a count when you unblock them, covered below; that's the accountability feature you asked for, not analytics.)
No advertising IDs. Neither app reads your device's advertising identifier.
No location. Neither app asks for or receives location.
No contacts access. Partner email addresses are typed by you, one at a time.
No selling or sharing. We do not sell, rent, or share your data with advertisers, data brokers, or anyone else for their own use. The only third parties who touch your data are the ones we need to deliver the service. They're listed below.

What we do collect

A random ID for each device. Created on the device the first time you open the app, and kept in that device's secure storage. Used to associate your category preferences and partner list with you. If you add a computer — Sworn also runs on Windows, Mac, Linux and Chromebook — it gets its own random ID and is grouped with your phone, so one person's devices share one set of partners and one alert stream. We never store a name for any device. Your partner is told how many devices you have, never which.
Which categories you're blocking — pornography, gambling, social media, online shopping, gaming, advertising and tracker domains, known-malware sites, and tools that try to bypass the filter. Stored on our server, tied only to the random ID.
Your personal block list and allowed sites (only if you add any). Specific domains you choose to always block, or to always allow through, are stored on our server, keyed only by your random ID.
Partner email addresses (only if you add partners). Stored on our server, keyed only by the random ID. Used solely to send the consent invite, the confirmation back, and the alert emails you signed up for.
An optional partner label (only if you add one). When you invite a partner, you can choose a short label they'll see in their alert emails. It lets them tell your alerts apart from anyone else they support. If you fill this in, we store it on our server alongside the partner's email, keyed only by your random ID. Leave it blank and we store nothing for this field.
A 7-day record of blocked attempts. When one of your queries hits a blocked category, a site on your personal block list, or a site you've explicitly allowed, we store the domain, the category, and a running count, keyed only to your random ID, for 7 days. This powers the in-app view of what's been blocked (and lets you allow a site from it). Your partners only ever receive a count of blocked attempts and the categories those attempts fell under (for example, "Pornography") — never the domains.
One short debug line for some blocked attempts. At most one per minute per account, and never for ad, tracker, or malware blocks. The line names the site so we can investigate complaints like "why is gmail.com blocked?". Your random ID isn't in the line — just a short scrambled stand-in we can match to your account if you ask us to. It lives in our server's log file and is deleted after 14 days.
A network block in server logs, in a few cases. When a connection trips one of our abuse limits, or sets a new daily high for traffic from one source, our server's log notes the network it came from, shortened so it never names a single address (for example, 203.0.113.0/24). Your random ID is never in these lines. They exist only to protect the service from floods and misuse, and are deleted after 14 days.
The time your device last checked in — a single timestamp, overwritten each time, plus when the app's current run began. No history, no count of how many times you have opened the app, nothing about what you did in it. This is what lets us tell a device that is switched off apart from one that is awake while its traffic has stopped reaching us — the difference between saying nothing to your partner and saying something wrong.
A count of DNS queries per five-minute window, kept for 7 days. Counts only, no domain names. This powers the in-app Activity graph, and lets us email your partner if Sworn stops filtering — for example if the app was uninstalled, or filtered DNS got turned off in your phone settings. There are two levels. A soft heads-up goes out shortly after Sworn stops abruptly while your phone is clearly still in use, and a firmer notice once it has been quiet for a full day. A phone that simply goes idle or is put down for the night does not trigger the heads-up. Separately, if the app itself notices that your device has stopped routing through Sworn, say because you turned the filter off in your system settings, it tells our server directly rather than waiting for the silence to add up. It only does that when it can see the change plainly; when something else is carrying your DNS, such as a VPN, it says nothing, because it cannot tell that apart from you switching Sworn off.
A 7-day count of apps you unblock (only if you block apps). When you remove an app from your blocked apps, your phone sends us a count — never the app's name — so we can email your partner that you unblocked one or more apps. We keep that count (just the number, never any app name) on our server for 7 days as a running tally, so a partner can see repeated unblocking even if the app is reinstalled. After 7 days the count is deleted automatically.
Subscription status (only if you subscribe). We store whether your subscription is active, in a billing retry, on hold, or lapsed; the product you bought; the renewal date; and an Apple/Google-issued transaction identifier we use to keep that state in sync as your subscription renews or cancels. We do not store your name, address, card number, billing email, or how much you paid — Apple and Google handle all of that themselves. Your partners get one email saying your subscription ended and that blocked-site alerts are paused.

Who else touches your data

Resend delivers the email messages. They see the destination email address and the text of the message. The text is short and never names the sites you tried to visit. Examples of what Resend actually sees: Your partner had 3 blocked attempts in the last 24 hours. or A friend has added you as their accountability partner. When you turn a category off, the email names that category (for example, They removed Pornography from their blocked categories.) so your partner knows what changed. Resend never sees your random ID or anything else about your account. Partner email addresses and message contents are never shared with third parties for marketing purposes. (Resend's privacy policy.) Every email includes a one-click unsubscribe link.
Our hosting provider rents us the servers Sworn runs on. As any hosting provider does, they have physical and infrastructure-level access to the machines we rent, but do not access account data in the ordinary course.
Cloudflare hosts this website and stores our database backups (R2 object storage). When you load a page on sworn.snowleopard.dev, Cloudflare sees your IP address, the page you requested, and a timestamp. The site has no analytics, no cookies, and no third-party trackers. Separately, Cloudflare holds the continuous backup of the account database described under "How long we keep things". They store those objects for us and do not read them.
Apple (App Store) and Google (Play Store) process payment when you subscribe. They handle your card and tell us only that your subscription is currently active or has lapsed — Sworn never sees card numbers, billing addresses, or what you paid. We send Apple a small token (appAccountToken) and Google a similar one (obfuscatedAccountId) so the platform can associate your subscription with your random ID, and we keep a server-side record of that association so renewals and cancellations apply to the right account.

How long we keep things

Your random ID, categories, partners, partner labels, subscription state, and the personal block list / allowed sites you've configured are kept until you ask us to delete your account.
Per-domain blocked / allowed events. When a query you make hits a blocked category, or a domain you've explicitly allowed, we keep a row with the domain, the category, and a running count. These rows power the in-app view that shows you what's been blocked and lets you allow a site. We keep them for 7 days, after which old rows are deleted automatically.
Per-five-minute DNS query counts — we keep a count of how many DNS queries your device made during each five-minute window over the last 7 days. Counts only — no domain names, no per-query records. This powers the in-app Activity graph and the partner emails that go out when Sworn appears to have stopped filtering (see “What we collect” above for the two levels). Older than 7 days, rows are deleted automatically.
Blocked-apps unblock count — if you block apps, we keep a running count of how many apps you've unblocked (a number only, never any app name) for 7 days, so a partner sees repeated unblocking even across a reinstall. Older buckets are deleted automatically.
Server logs (including the throttled debug line and the network blocks described above) live in the operating system journal on each server and are deleted after 14 days. We don't archive them.
Email sent via Resend is retained by Resend per their retention policy (linked above); we don't keep a separate copy.
Backups. The retention windows above describe our live systems. Because we keep disaster-recovery backups of the account database, a copy of a deleted or expired record can persist in backup storage after it is gone from the live system: up to 8 days in Cloudflare R2, and up to 1 year in the daily archive on the German standby server. Backups are not searched, mined, or used to serve the product. They exist only to restore the service after a failure, and these copies age out on their own schedule with no further action from you.

How to delete your data

Email sworn-support@snowleopard.dev and ask us to delete your account. The Support page lists what to include so we can find your record. We delete it from our live systems within 30 days and confirm by reply. Backup copies age out automatically on the schedule described above; we do not restore a deleted account from them.

Why we collect what we collect

For users in the EU, UK, and other jurisdictions that require a legal basis (GDPR Article 6 and equivalent), here it is:

Random ID, categories, personal block / allow lists, partner emails, partner label, blocked-attempt records, query counts, blocked-apps unblock counts — processed to perform the contract you signed up for (Article 6(1)(b)): blocking the categories you chose and emailing the partners you chose. Without this data the service can't function.
Subscription status + transaction identifier. Processed to perform the subscription contract (Article 6(1)(b)) and to satisfy tax / consumer-protection record-keeping (Article 6(1)(c)).
Short debug log line (max 1/min/account). Processed under legitimate interests (Article 6(1)(f)) to investigate user complaints. You can object to this processing at any time using the contact below; we'll suppress logging for your account.
Network blocks in server logs. Processed under legitimate interests (Article 6(1)(f)) to keep the service available and secure against floods and misuse.

Your rights

Wherever you live, you can email us to exercise any of these rights. If you live in California, the EU, the UK, or another jurisdiction with its own privacy law, the same address handles those statutory requests; we don't run a separate process.

For California residents: the rights below cover the access, deletion, and correction rights guaranteed by the CCPA / CPRA. Sworn does not sell or share personal information for cross-context behavioral advertising, so the statutory right to opt out of sale or sharing is already a no-op, by design.

Access. Get a copy of what we have on you.
Rectification. Correct anything that's wrong.
Erasure ("right to be forgotten"). Delete your account and the data tied to it, within 30 days of your request.
Restriction — ask us to pause processing while a dispute is resolved.
Portability. Receive a copy of your data in a structured, machine-readable format (JSON). Given how little we store this is a short file, but you're entitled to it.
Objection — object to legitimate-interest processing (currently the debug log line and the network blocks in server logs, both described above).
No automated decisions with legal effect. The only automated decision Sworn makes is whether to block a DNS query based on the categories you chose. That has no legal or similarly significant effect on you under GDPR Article 22.
Complaint to a supervisory authority — if you think we've mishandled your data you can complain to your national data-protection authority. UK users: Information Commissioner's Office (ICO). EU users: your country's data-protection authority (list at EDPB).

International data transfers

Sworn's DNS resolver answers your queries from two United States regions — Virginia (US-East) and Oregon (US-West). Your DNS traffic is processed only in the United States.

Backups are a partial exception, and we'd rather be exact about it. The account database (the random ID, categories, partner addresses and labels, subscription state, and your personal block / allowed lists) is continuously replicated to Cloudflare R2 object storage for disaster recovery, and a copy is pulled once a day to a standby server in Falkenstein, Germany. That standby is not published in DNS, so no device is directed to it and it serves no user traffic; it holds backup copies only, not the live account database. It exists so that losing our US infrastructure and our object storage on the same day does not lose your account. It means a copy of your account record does rest in the EU. We plan to add resolver regions in other parts of the world; if that changes where queries are processed, we'll update this section.

Snowleopard Labs LLC is a US company. For users in the EU and UK, transferring your account data to the US is necessary to provide the service you've signed up for, and we rely on GDPR and UK-GDPR Article 49(1)(b) (transfer necessary for the performance of a contract between the data subject and the controller) as the legal basis for that transfer. We also apply the technical safeguards described elsewhere in this policy: encryption in transit, data minimization, no advertising IDs, no profiling.

Our sub-processors (hosting provider, Resend for email delivery, and Cloudflare for this website and for backup object storage) transfer the operational data described in "Who else touches your data" under their own GDPR transfer safeguards (Standard Contractual Clauses and, where applicable, EU-US Data Privacy Framework certification).

If something goes wrong

If we discover a security problem that exposes your data, we'll post a notice at the top of this page within 72 hours of finding out, and we'll tell the relevant authorities where the law requires us to. For accountability partners, whose email address we hold so we can send the alerts you signed up for, we'll also email directly when a breach affects partner data. For Sworn app users we don't hold an email address, so the notice on this page is the channel you'll learn through; bookmark it if you want to check.

Children

Sworn is set up by adults. If a parent installs Sworn on a kid's phone, the parent is the one who agreed to our terms and picked the categories — the kid never signs in or gives Sworn any information directly. We don't knowingly collect data from children under 13, or under the higher age set by local law (for example, 16 in some EU countries, under GDPR Article 8). If a child's data ends up with us by mistake, email sworn-support@snowleopard.dev and we'll delete it.

If this policy changes

We'll bump the effective date at the top of this page when the policy changes. If you want to know what's current, this page is the source of truth.

Representative in the EU and UK

Snowleopard Labs LLC has not designated a representative in the European Union or the United Kingdom under GDPR Article 27 / UK-GDPR Article 27. The processing we do is narrow and low-risk: minimal personal data (random device ID, blocked-category preferences, partner emails you choose to add), no special-category data under Article 9, no criminal-offence data under Article 10, no profiling, and no automated decisions with legal or similarly significant effects under Article 22. If the nature or scope of our processing materially changes, we'll appoint a representative.

Contact

Snowleopard Labs LLC
sworn-support@snowleopard.dev

The LLC's registered agent address is on file with our state of formation and obtainable via that state's public LLC registry for any matter requiring formal legal service. For privacy, data-subject-rights, and support inquiries, please use the email above. That's how we route every request.