Oathslide

Oathslide

Privacy policy

Effective September 24, 2026

Oathslide is designed to work without an account or cross-app tracking. The iOS app shows a small number of non-personalized ads to stay free; the web companion shows none. Most game data stays on your device. First-party product analytics is off by default on every platform and runs only if you opt in. Analytics and optional public scores use a random private install identifier that is created only when you opt in, sign the board, or report a player.

Who is responsible

Oathslide is published by Aleksandr (Alex) Simukovic, an independent developer, who is responsible for the data described in this policy (the data controller). Contact: support@oathslide.com.

Data stored on your device

Oathslide stores preferences, tutorial state, progress, achievements, best scores, and an interrupted run so play can resume. It also stores players you block, the private install identifier once one has been created, and, while offline, a qualifying score waiting to be sent. If you opt into analytics, a product event may wait on the device until it can be delivered. Most on-device game data is never sent to us.

First-party product analytics

Analytics is off by default on every platform. Oathslide does not record a product event, create an install identifier for analytics, or send anything to its analytics service until you turn the setting on yourself.

Native iOS analytics is off by default. The native iOS app does not activate analytics collection, access the random identity for analytics, or record product events unless you opt in through Home → Settings → Share limited product analytics, or answer “Share” to the one-time question the app asks after your second run.

The web companion works the same way. Analytics stays off until you turn on Menu → Settings → Share limited product analytics; until then the web build creates no install identifier and sends no product events. The same toggle withdraws consent.

If you opt in, Oathslide sends a small, fixed set of product events to its own Supabase backend so we can measure whether the first-run experience is working. The events cover first open, tutorial dismissal, first swipe, reaching turn 10, first Gloom defeated, first relic drafted, starting a Daily, run end, second run start, result sharing, and a return on a later day.

The run-end event records the score, the number of turns, and that the run ended. The iOS app and the web companion also record whether the run was Classic or the Daily, its difficulty, how many bosses you defeated (0 to 99), the kind of damage your Hearth took last (one of a fixed list, such as a weak strike or a Gloom timer running out), and how many times you used Unmake on an Eclipse (0 to 99). Only the iOS app records whether a full-screen ad was shown just before the run (since the previous run ended, in the same app session). We use these details to tune the game’s balance and to check that ads are not driving players away. None of them identifies you.

Each event contains the event time, app version, and the same random private install identifier used by the deletion control. Oathslide does not send an advertising identifier, account, contact information, location, device fingerprint, or third-party advertising data. There is no third-party analytics SDK, and the events are not used for advertising or cross-app tracking.

Crash and hang reports. With the same setting on, the iOS app also sends reports of its crashes and hangs to Oathslide’s own backend so we can fix them. A report keeps only where in the app’s code the problem happened, the app and iOS versions, the device model, and numeric error codes or durations. It carries no install or player identifier, no name, no message text and no location, and is not linked to your scores, your analytics events or you. We do not keep your IP address with it and record only the hour it arrived. Players the age check restricts never send reports, and turning analytics off stops them. You can also send the same reports yourself from Home → Settings → Share diagnostics.

If you also publish a leaderboard score, these product events are technically associated with the same private install identity. They are never shown to other players. We use the records only in aggregate to evaluate retention, first-run completion, and feature health.

Optional leaderboard data

If you choose to sign and publish a qualifying score, Oathslide sends the following to its leaderboard service:

Your display name, rank, score, turns, highest rank, bosses defeated, and a separate public player identifier may appear to other players. The private install identifier, seed, and replay are not public. We use them only to operate, verify, moderate, and delete leaderboard records. We do not use this information for advertising or tracking.

Moderation and safety

Reports include the reported score entry, a random reporter install identifier, and an optional reason. Reports are used to review and automatically hide repeatedly flagged names. Blocks are stored only on the blocking player’s device and filter the blocked player from that device’s leaderboard.

To protect the leaderboard, analytics and crash-report services from abuse, the server also limits how many score submissions, player reports, analytics batches and crash reports can come from one network address in an hour. It never stores the address itself. It keeps a salted, one-way hash of it (for an IPv6 address, of its network prefix only) in the rate-limit record for that request, for at most about 70 minutes. The salt is secret and never leaves our database. The hash is used only to count requests: it is not used for analytics or advertising, is never shown to anyone, and is not stored with your scores, analytics events or crash reports.

Advertising in the iOS app

The native iPhone and iPad app keeps gameplay banner-free. It occasionally shows a full-screen ad when you leave a finished run. Ads never interrupt play, never appear in the tutorial or the Oath Trials, and are not shown during your first three completed ranked runs or your entire first sitting. The optional one-time Remove Ads purchase turns off the ads between runs. The web companion shows none.

Ads are served by Google AdMob (Google LLC) and are non-personalized: every request asks Google for contextual ads only. Oathslide never asks for App Tracking Transparency permission, so the app never reads the advertising identifier and no ad is targeted to you across apps. To serve and measure an ad, Google’s software receives your IP address (used for a coarse location and to choose ads for your region), a device identifier that Apple scopes to this app, basic device and app information, the ads you were shown and whether you tapped them, and crash and performance diagnostics about the ad software itself. Google processes this data under the Google Privacy Policy. Google uses cookies and device identifiers for non-personalized ads too, including frequency capping, aggregated ad reporting and fraud prevention. See How Google uses information from sites or apps that use its services. Oathslide does not add its own analytics, your scores, or your name to ad requests.

If you are in the European Economic Area, the United Kingdom or Switzerland, the app asks for your consent choices before it requests any ad, using Google’s consent message. You can review or withdraw those choices at any time under Home → Settings → Advertising privacy options. Without consent, Google serves only limited, non-personalized ads or none.

To report an ad you consider inappropriate, tap the AdChoices mark on the ad itself, or contact support with a screenshot and we will report it to Google.

Service providers

Supabase hosts the leaderboard, score-verification, and first-party analytics services; the project runs in the European Union (AWS eu-west-1, Ireland). Vercel hosts this website, the web companion and a small public status file (/status.json). The iOS app reads that file when it starts and when you return to it, to learn whether ads or leaderboard features are temporarily switched off and whether there is a short service notice to show; the request carries no identifier or cookie. Like any web host, Vercel keeps short-lived request logs that include IP addresses for security and operations; we do not use them for analytics. Supabase and Vercel process this data only on our instructions, under their data-processing terms, to deliver Oathslide; we require them to protect it under standards at least as protective as this policy and not to use it for their own purposes.

The developer checks service health daily. Optional external operational alerts can use ntfy.sh for push notifications and Healthchecks.io for a heartbeat showing that the alert check is running. Alerts and summaries contain only counts and service figures, such as the number of new reports, the number of scores waiting for review, or the size of the database. They never contain an install or player identifier, a display name, a score entry, a report reason, or contact details, and the heartbeat is an empty request. These optional services receive no personal data about players.

Google acts as an independent controller for the advertising in the iOS app: it decides how it uses the data in an ad request, under the Google Privacy Policy. Because every request is non-personalized, Google does not use your past activity to choose ads, but it does use the request for contextual ads, frequency capping, aggregated reporting, and fraud prevention. The web companion sends nothing to Google.

Apple sells the optional Remove Ads purchase in the iOS app and handles the payment; we never see your card or Apple Account. Apple sends us signed notices when that purchase is made, refunded, or revoked. From each notice we keep only its type, the product, the date, whether it came from Apple's test or live store, and a one-way hash of Apple's transaction number. None of this is linked to your install, player, or analytics identifier.

Supabase, Vercel, and Google are US companies and may process data in the United States. Where they do, they rely on the safeguards European law recognises for such transfers, such as the EU–US Data Privacy Framework or the European Commission’s Standard Contractual Clauses (with the UK Addendum).

How long data is kept

Your choices

Your rights

Depending on where you live, you have the right to access the personal data we hold about you, to correct it, to delete it, to receive a copy in a portable format, to restrict or object to its processing, and to withdraw consent at any time. You can see what is public on the board itself and delete everything tied to your install identity with the control above. For any other request, contact us through Oathslide Support; we answer within one month. Because Oathslide has no accounts, we may ask for your display name and a recent score to find your records.

You also have the right to complain to a data-protection supervisory authority, in particular in the country where you live or work or where you believe your rights were infringed. In the UK this is the Information Commissioner’s Office (ICO).

Age range in the iOS app

Where iOS says an age check is required, the iOS app asks iOS for your age range once, using Apple’s Declared Age Range feature. You choose whether to share it. The app uses the answer only on your device, to decide whether ads, a public leaderboard name, product analytics and the Remove Ads purchase are available. It keeps only that decision and when it was made, never your age range, and never sends either to us, Google or anyone else. If iOS indicates you are under 18, if you choose not to share, or if the check cannot finish, the whole game stays available, and ads, public leaderboard names, analytics and the Remove Ads offer are turned off. The web companion does not ask for an age range.

Children

Oathslide is not directed to children under 13 and does not knowingly collect personal information from them. If iOS tells the app that a player is under 13, the app turns off ads, public leaderboard names and analytics for that player. Public display names are filtered and moderated; players should never put contact details or other personal information in a display name.

Changes and questions

Material changes will be reflected here with a new effective date. For troubleshooting, data controls, and the current release contact route, visit Oathslide Support.

Oathslide · No cross-app tracking · Non-personalized ads on iOS only · Optional public scores