Trust

What is stored

Your account, your devices, whether each device's protection is running, the categories and custom rules you chose (these are sensitive and are treated that way), your commitment dates, and counts of blocked attempts per category per fifteen-minute window.

The service never stores what you visit, search for or use. The tables that hold device events have no column for a URL, a path, a search term or an app name, so this is a property of the database, not a policy.

One exception, by design: when a device meets a site that its local lists cannot decide, it sends that site's name (never the page, never who asked) so the service can decide whether the site belongs to a blocked category. The service keeps one classification per site, with no user, device, time or count on it, and passes the site name to its classification provider, TypeSafe, under terms that forbid training on it. A site the lists already decide is never sent.

What a partner sees

Whether protection is running on each of your devices, when a device has not checked in for a day, and when a commitment is about to end. Nothing else, and you can end it at any time. Anyone in a difficult situation can use the safety path, which involves no partner, no payer and no device.

What a referring organisation sees

A clinic, a club or an employer can hand out a link to Vowius. If you sign up through one, the organisation is shown four counts about everyone who did: signed up, activated a commitment, protected right now, and commitments completed. A count under five is hidden. It never sees your name, your email, what you block, your devices or your dates; it cannot start, extend or end a commitment; and it does not become your partner. Settings has a button that takes your account out of its counts. Details on the organisations page.

What cannot be undone, and what always can

A commitment cannot be shortened or cancelled by you, by a partner, by whoever pays, by support, or by a failed payment. It can be extended. Ending it early takes an identity check, a day of waiting, a second confirmation and a human decision.

If the service ever stops, two release keys generated offline and never held by any server can release every commitment at once. Their public halves are built into every app and listed here. A release certificate is published in three independent places; any one of them is enough. If no certificate ever reaches a device, fourteen days of running after the commitment's end date without server contact releases it on its own.

Machine-readable: /.well-known/commit/release.json and /.well-known/commit/keys.json.

Known limitations

• An administrator can stop software on their own computer. Vowius detects and reports that; it does not pretend to prevent it.
• Devices that were never enrolled are not protected.
• On macOS, encrypted DNS configured system-wide bypasses the DNS layer; the connection filter remains.
• Ending a commitment fourteen days after its end date by keeping a device offline is possible by design: it bounds lock-in, it does not shorten anything.

Clients

• macOS: preview build, content filter and DNS proxy in a system extension.
• Windows: written and tested in development mode; not yet run on a Windows machine.
• Android: verified on an emulator; not yet on real phones.
• macOS beta: blocks at the resolver through a service the app installs; the signed release adds the system-level filter.