Your record never leaves your phone.

The short version

Your three non-negotiables, every mark you make, every day you let go, the reason you gave for letting it go, which form Oni has taken, every card Oni has drawn you, every reminder you set and every line on your list are stored on your device only. We cannot read them. They are not uploaded, not backed up to us, not analysed, and not used to train anything.

Onus works completely without an account. If you never open one, nothing at all is sent to us and there is no record of you anywhere.

If you open an account

An account exists for one reason: so Oni is still there on your next phone. It is optional and it is asked for late.

We store, and this is the complete list:

• Your handle — the name you chose. We do not ask for your email as your identity, so the handle is mapped internally to an address at a domain that receives no post. Nobody can write to it, including us.
• Your password — stored only as a cryptographic hash by our authentication provider. It is not readable by us or by anyone else.
• What Oni calls you — free text, may be blank, never used to identify you.
• A recovery email, only if you give one — optional, and most people do not. It is used for exactly one thing: sending you a password reset link when you ask for one. It is never used for marketing, never sold, and never shared.
• The date the account was created.

That is the entire profile. There is no table your ledger could be written to even if we wanted it. Accounts cannot see each other — there is no social graph, no leaderboard, no directory and no way to look up another keeper.

If you become a Custodian

Payment is handled by Apple through the App Store. We never see your card number, and we never receive it. We store only what you are entitled to: whether you are on Keeper or Custodian, which term you chose, whether the subscription is active, when the current period ends, and an anonymous identifier from the billing provider so a renewal can be matched back to your account.

Apple’s own handling of your purchase is governed by Apple’s privacy policy, not ours.

Reminders, the list, and notifications

A reminder you set is registered directly with iOS on your own phone and delivered by iOS. It does not travel through a server, ours or anybody else’s, so there is no push token to hold and nothing to intercept — which also means your reminders keep working with the phone offline. The words you wrote are visible to iOS because iOS is the thing that has to display them, and to nobody else.

The list is the same story with one thing fewer: it has no time attached, so it is never handed to iOS at all. It is text in the same local store as everything else.

Permission is asked for once, at the moment you set your first reminder rather than on first launch, and refusing it leaves every other part of the app working exactly as it did. You can withdraw it at any time in Settings → Notifications → Onus.

What we do not do

• No advertising, and no advertising identifiers.
• No third-party analytics or tracking SDKs, and no cross-app tracking.
• No selling or sharing of personal data with anyone, for any purpose.
• No training of machine-learning models on anything you write.
• No email beyond a password reset you asked for.

Children

Onus is not directed at children under 13, and we do not knowingly collect anything from them. If you believe a child has opened an account, write to us and it will be deleted.

Deleting everything

You can delete your account from inside the app — More → Account → Delete account. It removes your profile and your subscription record from our servers permanently and immediately. There is no grace period and no archived copy kept on our side.

Deleting the app from your phone deletes your ledger, because your ledger was only ever on your phone. That is the trade the design makes and it is worth saying plainly: total privacy and total portability are opposites, and Onus chose privacy.

You can also write to [email protected] and ask for a copy of everything held about you, or ask for it to be erased. We will answer within 30 days.

Where the data is held, and for how long

Account and subscription records are held on servers in the European Union. They are kept until you delete your account, at which point they are removed. There is no separate retention period, because there is almost nothing to retain.

Your rights

If you are in the UK, the EU or the EEA, you have the right to access, correct, export, restrict and erase your personal data, and to object to its processing. The legal basis for the little we hold is the performance of a contract — running the account you asked us to open. Most of these rights resolve to the same one button described above, because we hold so little. You also have the right to complain to your national data protection authority.

Changes

If this policy changes in a way that affects what is collected, the date at the top changes and the app will say so on the next open. A change that moved your ledger off your device would be announced before it happened, not after.

Who we are

Onus is made by an independent developer. For anything about this policy, write to [email protected].