Trust

What is stored

Your account, your devices, whether each device's protection is running, the categories and custom rules you chose (these are sensitive and are treated that way), your commitment dates, and counts of blocked attempts per category per fifteen-minute window.

The service never stores what you visit, search for or use. The tables that hold device events have no column for a URL, a path, a search term or an app name, so this is a property of the database, not a policy.

What a partner sees

Whether protection is running on each of your devices, when a device has not checked in for a day, and when a commitment is about to end. Nothing else, and you can end it at any time. Anyone in a difficult situation can use the safety path, which involves no partner, no payer and no device.

What cannot be undone, and what always can

A commitment cannot be shortened or cancelled by you, by a partner, by whoever pays, by support, or by a failed payment. It can be extended. Ending it early takes an identity check, a day of waiting, a second confirmation and a human decision.

If the service ever stops, two release keys generated offline and never held by any server can release every commitment at once. Their public halves are built into every app and listed here. A release certificate is published in three independent places; any one of them is enough. If no certificate ever reaches a device, fourteen days of running after the commitment's end date without server contact releases it on its own.

Machine-readable: /.well-known/commit/release.json and /.well-known/commit/keys.json.

Known limitations

• An administrator can stop software on their own computer. Vowius detects and reports that; it does not pretend to prevent it.
• Devices that were never enrolled are not protected.
• On macOS, encrypted DNS configured system-wide bypasses the DNS layer; the connection filter remains.
• Ending a commitment fourteen days after its end date by keeping a device offline is possible by design: it bounds lock-in, it does not shorten anything.

Clients

• macOS: preview build, content filter and DNS proxy in a system extension.
• Windows: written and tested in development mode; not yet run on a Windows machine.
• Android: verified on an emulator; not yet on real phones.
• macOS beta: blocks at the resolver through a service the app installs; the signed release adds the system-level filter.