Oratide — Privacy Policy

Effective 22 September 2026 (2026-09-22). Third version — see the change log.

Oratide is a Catholic fixed-hours prayer app: a bell that rings at the hours you set while the app is open, and the prayer for that hour. This document says what the app does with information, in plain words. Every statement in it is a statement about the code as it exists on the date above, and each one can be checked against that code.

Made by chibu. Questions go to support@chibuapps.com. A person reads them.

The short version

Oratide has no account and no server. Everything you put into it — your hours, the names you pray for, the record of days if you choose to keep one — is written to the app's own storage on your device, and it stays there. Nothing is uploaded, because there is nowhere for it to go. There are no analytics, no advertising, no crash reporter, and no third-party software inside the app that could report on you. You can export all of it as a plain file whenever you like, and you can erase it.

If a future version ever adds a way for the bell to reach you while the app is closed, that will need a server. It will be off by default, it will ask you first in plain words, and this document will change on the day it does.

That is the whole policy. The rest is detail, for anyone who wants to check it.

1. What this covers

The Android app on Google Play, package app.horarium.prayer. Inside it is a web app in a thin shell (Capacitor). Nothing is added to it beyond the shell itself.
A web version, if one is ever published. None is published today: the page at https://chibuapps.com/oratide describes the app and is not the app. §12 says what would change if a web version were published.
An iOS build, when one ships, will use the same shell and this document will be revised to cover it before it is listed.

2. What Oratide does not do

Each line here is a fact about the code, not a policy that could be quietly changed.

No account. Nothing asks who you are. There is no sign-up, no email address, no name, no age, and no question about your religion.
No server of ours. There is no backend. The app has no address to send anything to.
No analytics. No usage events, no session recording, no crash reporting, no attribution or advertising identifiers, no experiments run on you.
No advertising, and no slot in the interface that an advertisement could be put into.
No third-party SDKs. The shipped web app has exactly two runtime dependencies, React and React DOM — open-source libraries that draw the screens and make no network requests. The list is shown on the About screen, and a test fails the build if that list drifts from the real dependency manifest. The Android app adds only the Capacitor shell (@capacitor/core, @capacitor/android). Capacitor is an open-source container that carries the web app; it is not a service. No Capacitor plugin is compiled into the Google Play build: its plugin list is empty. The About screen lists four Capacitor packages for the Google Play build, including @capacitor/local-notifications and @capacitor/app, and the wrapper's package manifest still names both; neither of those two is in the build.
No third-party network requests. The app's Content-Security-Policy lets the page connect only to the host it is served from, and its service worker answers any GET request bound for another host locally with a 403 rather than letting it reach the network. The app has no code path that wants such a request; the refusal is there so that one could never slip in unnoticed.
No access to your location, contacts, camera, microphone, photos, calendar, or files — except a single file you yourself choose when you import an Oratide export.
No selling, sharing, or brokering of anything, because nothing is collected.

3. What is kept on your device

Everything below lives on the device you are using. None of it is sent anywhere.

What	What it holds	Starts as
Your Rule	The hours you named, the time and days of the week for each, and the prayers queued in each.	Whatever you set up in first run.
Intentions	The names you carry, an optional note, the day of the week each belongs to, when you named it, and — when you give thanks for one — the date and any line you wrote.	Empty.
The record	Off by default, and while it is off nothing at all is written. When you turn it on: the days on which a prayer period was finished, how many that day and which blocks, days you marked as rest, and a lifetime total that can only go up. There is no streak and nothing that can reset.	Off.
Reminder settings	Whether bells may appear as system notifications (off), whether announcements are on (off), the bell sound chosen per block, any "in 15 minutes" or "skip today" for the current day, a short log of the last sixty bells — when each was due and whether it reached you — and when you last fired a test bell.	Off, empty.
The player	Where you stopped in each block and how many times you have prayed it through; your pace, voice and ambient volume, silence length, Latin on or off, haptics on or off, and whether the words scroll as they are read.	Defaults.
Appearance	Light, dark or system theme; Compline night mode; prayer text size.	System.
Calendar	The 1969 or 1962 form of the calendar, and whether Ascension is kept on Thursday or Sunday.	1969, Sunday.
First run	Which step of first run you reached, when the first prayer was prayed, and which one it was.	Empty.
App usage	A count of launches, the first and most recent day the app was opened, and how many distinct days that makes. This exists for one purpose: deciding whether to invite you to install the app. It is not sent anywhere and is not a score.	Zero.
Install invitation	When the install invitation was offered, dismissed, or accepted, so it is not shown twice.	Empty.
Purchase	In the Google Play build nothing can be bought (see §9), so no purchase, charge or refund is recorded. Kept regardless: the days on which a prayer was completed — which is what decides whether the single offer may appear — and whether that offer was shown or dismissed.	Empty.

Where it is. All of it is one document in the browser's local storage, under the key horarium.state. Before a migration, an import, or an erase, a copy of the previous document is written to horarium.backup. If the app ever finds a document it cannot read, it moves it to horarium.quarantine and starts clean, rather than deleting it. The app's own files are also kept in the browser's cache so that it opens with no network. In the Android app, "the browser" is the app's private WebView, whose storage belongs to the app alone.

How it is protected. By your device: its lock screen, its app sandbox, and its disk encryption if it has it. Oratide does not add a cipher of its own on top of that. Anyone who can get past your lock screen and open the app can read what is in it, the way anyone who opens your missal can read the card inside. If a name is sensitive, treat the note field accordingly and use the device lock.

How it could be lost. Browsers can discard a site's storage: when you clear browsing data, and in some browsers after a long stretch without opening the site. An installed app is far less exposed to this than a browser tab, but the only copy we can promise you is the one you export (§10).

Android backup. The Android app allows Android's own backup. If you have backup to your Google account switched on for the device, Android may include Oratide's data in that backup. That copy is made by Android, under Google's terms and Google's encryption, not by Oratide, and you control it in your device's Settings under Google → Backup.

4. Intentions — the names you carry

The names you pray for never leave the device. There is no code in the intentions feature that touches a network, and no network for it to touch.

They are yours to take with you, always. From the Intentions screen and from Settings you can export them as plain text (readable on any machine, printable, fit for a missal) or as JSON (which comes back in whole). There is no entitlement check anywhere in the export code, and there is deliberately no place to put one. The free tier limits only how many names you carry at the same time; reading, editing, giving thanks, and exporting are never limited, for anyone.

The whole-app export from Settings (§10) carries a line of its own: "This file is yours. It never left your device to be made." That line is true. The intentions-only files carry no such line.

5. The record of days

The record is off until you turn it on, and the switch sits next to the words "Missing a day is not a failure." While it is off, nothing is written — not hidden, not deferred. When it is on, it keeps a calendar of the days you prayed, a monthly count, and a lifetime total. None of those can go down. It is kept on the device with everything else and is included in the whole-app export.

6. Notifications

Oratide delivers a bell in three ways, and names them honestly on the Bells screen:

In the app. A timer in the page, worked out from your Rule and the clock, sixty days ahead, with no network and no server. This is the one that always works, while the app is open.
As a system notification, while the app is running. The app's own service worker posts the bell so it can reach you behind another app. This needs your permission and is off by default. The Android app on Google Play cannot do this in its current release: its web view has no notification interface, so the switch cannot be turned on and the permission is never asked (§11).
While the app is closed. Not available in this build. See §7.

Permission is only ever asked when you press a button that says so — on the bell step of first run, or on the Bells or Reminder Health screens. It is never asked on launch.

What a notification contains. The name of the block you set (for example "Lauds"), the time, and the name of the bell sound, or for a test bell, a line saying it is a test. A notification appears on your lock screen like any other, so someone looking at your phone could see that you keep an hour. Name your blocks with that in mind. Nothing from your intentions or your record is ever placed in a notification.

What tapping does. "Pray now" opens the block it named. "In 15 minutes" opens it with a deferral. "Skip today" closes it and nothing else happens; the skip is remembered only until the day turns, and then it is forgotten.

Announcements. There is a second class of notification for anything that is not one of your hours. It is off by default, capped at one a week; the cap is shown on the Settings screen, and the cap and the count for the last seven days on the Bells screen. With no server, an announcement can only come from the app itself.

Reminder Health tries a real test bell through the same path a real bell takes (in the Android app on Google Play it reports that no notification can be posted), and then tells you the actual state of things on your device — permission, whether the app is installed, whether the last bells were delivered — in the words your own phone's settings use. Where the limit is the platform's rather than yours, it says so instead of letting you blame your phone.

7. Push — the honest account

The web has no way to ring a bell at a set time with the app closed. The only mechanism that could is web push, and web push needs a server.

Oratide has no server, so this build does not offer push. In the code, the delivery key that push would require is declared and set to nothing; no push subscription is ever created; the Bells screen says "While Oratide is closed, it does not ring" and explains why, rather than showing a switch that does nothing. The service worker does contain the receiving end — the few lines that would show a bell if a push message ever arrived — but there is no sending end, and no message can arrive.

If a later version adds it, here is what it would involve, so that you can weigh it when you see the switch:

You would turn it on. It would be off by default, on its own switch, with the cost stated beside it, and it would never be required to use the app.
Your browser or operating system would create a push subscription. That is a unique address (an "endpoint") at a push service run by the maker of your browser or phone — Google for Chrome and Android, Apple for Safari and iPhone, Mozilla for Firefox — together with a pair of keys that let only our server send to it, and only your device read what is sent.
That endpoint, and the times to ring, would be sent to a server of ours and kept there, so that it could ask the push service to wake your device at your hours. That would be the first piece of information about you to leave the device, and this document would say so.
The push service would see that a message went to your device, and when. It would not see what the message said, because push payloads are encrypted to your device.
Turning it off would tell our server to forget the endpoint. Uninstalling the app, or clearing site data, revokes the subscription at the browser's end as well.

This document will be revised, dated, and logged below before any of that goes live.

8. What the app reads from your device, and keeps to itself

To do its job the app reads a few things about the device it is running on. None of them are stored beyond what §3 lists, and none of them leave the device.

The clock and time zone, to ring at the right hour and to recompute the schedule when you travel or the clocks change.
The browser's identification string, to tell an iPhone from an Android phone from a desktop, so that Reminder Health can give the right instructions in the right words, and to know whether the app is installed or running in a tab.
Whether notification permission is granted, and whether the app is running in its own window.
Your system preferences for dark mode and reduced motion, which the app honours.
Vibration, for one soft tap when a bell comes due or is put off, and — if you leave haptics on in the prayer controls — one when a block begins and one when it ends.

9. Buying Oratide, and what the store sees

Oratide is free to use, in full, without paying: every prayer text, every reminder, the calendar, offline use, and accessibility are covered by the Free Core Covenant shown in the app. When paying opens, it will be a one-time purchase of $9.99; in the Google Play build today nothing can be bought. There is no subscription, no renewal and no trial — a fact worth stating in a privacy policy, because there is therefore no recurring billing relationship to keep any record of. The only thing paying would change in this version is the limit of seven carried intentions. The Support screen also names seasonal companions as what the money pays for; those are not written yet, and nothing in the app is gated on them.

In the Google Play build, nothing can be bought. The purchase screen says that purchases are not open yet and that nothing can be charged; no payment method is asked for, and no purchase, charge or refund is recorded. Only the development version run from source uses a sandbox store, with a mock ledger kept on the device, so that the purchase, refund and restore flow can be tested without a store account.

When Oratide is sold through Google Play, and later the App Store, this is how it will work, and it follows from the fact that Oratide has no server:

The purchase is made by the store, on the store's own screens, with your store account and the payment method the store has on file. Oratide never sees your name, your email address, your card, or your billing address.
What the app receives from the store is the fact of an entitlement — that this device's store account has bought Oratide, and on what day — and it has nowhere to send even that. There is no expiry date in it, because a purchase does not expire. If the store's answer is missing or cannot be understood, the app grants full access rather than showing a paywall.
The store sees what it always sees for any purchase: the item, the price, the date, and your store account. That is governed by Google's privacy policy or Apple's, not by this one.
Refunds are handled by the store under its own rules: a refund is issued by Google Play, back to the payment method that was charged. The app will point you there; no ticket or email to us is involved. (The Google Play build has no refund button, because nothing can be bought in it.) There is nothing to cancel, so there is no cancellation flow of any kind, in the app or at the store.
Emails about a trial ending or a subscription renewing will never arrive, from us or from the store, because there is no trial and no renewal. Any receipt the store sends goes from the store to the address it holds for you. It cannot come from us, because we do not have your address.

10. Taking your data with you, and erasing it

Export everything. In Settings, one tap saves the whole document — Rule, intentions, record, and preferences — as a JSON file. The intentions can also be exported alone, as text or JSON. In the Android app, saving these files has not yet been confirmed on a real device: the app hands each file to its web view as a download, and the Capacitor shell registers nothing to receive downloads, so on Android it may save nothing.
Import. The same screen reads an export back in, after first backing up what is there.
Erase everything on this device. In Settings, behind one confirmation. It clears the document and keeps one backup copy of what was erased in the same storage, in case it was a mistake. That copy stays until the next import, erase or data migration replaces it; ordinary use does not remove it. To remove it, erase a second time (the copy is then replaced by what was there after the first erase), clear the site's data in your browser, or uninstall the Android app.
Nothing to delete anywhere else. Because nothing was ever sent anywhere, there is no copy on a server to ask us to remove.
How long it is kept. On your device, until you erase it or uninstall the app (the erase above keeps one backup copy until the next import, erase or data migration). Nowhere else: the only copy outside the app's own storage is an Android backup, if you have backup switched on (§3), and that is kept under Google's rules, not ours.

11. The Android app in particular

The app's files are inside the package. The shell serves them to its own WebView from a local address. Opening the app makes no request to the internet.
Permissions. The manifest declares five permissions: INTERNET, which the Capacitor shell template declares; VIBRATE, for the soft tap described in §8; and POST_NOTIFICATIONS, SCHEDULE_EXACT_ALARM and RECEIVE_BOOT_COMPLETED, which were declared for a native notification plugin that is not compiled into this build. Nothing in this build asks for or uses those last three. Beyond those five, the build carries only a permission that the AndroidX support library defines for the app's own internal use. The Android system WebView is not expected to offer the web notification interface, so in the Android app the bell is the in-app card while the app is open, and Reminder Health should report that state on the device rather than promising more. This has not yet been confirmed on a real device.
Android backup. See §3.
What Google sees. Installing from Google Play records the install against your Google account, and Android reports crashes and unresponsive-app events to the developer's Play Console in aggregate if you have "usage and diagnostics" sharing on for the device. That is Google's collection under Google's policy. The same setting lets Android System WebView, which draws Oratide's screens, send Google its own usage statistics and crash reports, under Google's policy. Oratide does not currently opt out of the WebView's usage statistics. Oratide adds no crash reporter of its own and receives nothing beyond that aggregate.

12. A web version, if one is published

No web version of Oratide is published today; the app is the Android app. If a web version is published, this is what it will mean, and this document will name its host and that host's log retention on the same day.

Loading the app. The first time you open it in a browser, and whenever it checks for an update, your browser fetches the app's files from its host. Like any web request, the host sees your IP address, the file requested, the time, and the identification string your browser sends with every request. Oratide adds nothing to that: no cookie, no identifier, no query string, and the app sets no cookies.
After that, the service worker serves the app from its cache, so a launch is answered without the network. A few seconds after load, when the device is online, the app asks that same host once whether a newer build exists, and if so fetches only the app's own files.
Any request to another host is refused by the service worker before it reaches the network (§2).

13. Children

Oratide is not directed at children under 13 and has no feature that asks anyone's age. Since it collects nothing from anyone, it collects nothing from children.

14. Your rights

Laws such as the GDPR and the CCPA give you rights to see, correct, delete, and take away the data an organisation holds about you. The app gives us none, so there is nothing of the app's for us to act on; the tools to do all of those things with the data on your device are in Settings (§10). The one thing we can hold is a message you choose to send. If you write to support@chibuapps.com, we then have your address and what you wrote, because you sent them; the message reaches us through Cloudflare's email forwarding (Email Routing) and is kept in a Gmail inbox, so Cloudflare and Google handle it under their own policies. It is used only to answer you, never added to a list and never shared. Ask, and we delete the conversation. A person will answer. If you are in the European Union or the United Kingdom, you also have the right to complain to your data protection authority.

15. Changes to this document

The effective date at the top changes whenever this document does, and each change is summarised in the log at the end. If a future version begins to send anything off the device — push (§7) is the one we can foresee — that version will say so in the app, ask before it does so, and this document will be revised the same day.

16. Contact

chibu — support@chibuapps.com

By post: chibu, 2112 Broadway St NE Ste 225 #535, Minneapolis, MN 55413, United States

Change log

2026-09-22 — Published at https://chibuapps.com/oratide/privacy/. The contact address is now support@chibuapps.com, which reaches the same person, and §16 adds a postal address. Before publishing, every statement was checked against the build on Google Play, and the ones that were wrong were corrected: §1 and §12 now say plainly that no web version is published; §11 now lists the five permissions the Android manifest declares, not one; §2 now says what the About screen actually lists; §9 and the §3 purchase row now say that the Google Play build has no store and no purchase ledger; §4 no longer promises a line in the exported file that the file does not carry; §10 now says how long the pre-erase backup really lasts; and §14 now says what happens to an email you send us. The bell is described as ringing while the app is open, because in this build that is the only time it can. What the app collects, where it is stored and what leaves the device did not change: the answer to all three is still nothing.
2026-09-09 — §9 rewritten. Oratide became a one-time $9.99 purchase; the subscription, the fourteen-day trial and every renewal were removed from the product, so this policy no longer describes a recurring billing relationship, a cancellation path, or trial-reminder emails. The four paid promises that needed people or a server — recorded readings, sung settings, offline audio, household sharing — were withdrawn from the product on the same day, so §9 no longer names them among what the money pays for. Nothing about what is collected, where it is stored, or what leaves the device changed: the answer to all three is still nothing. The §3 table's "Subscription" row is now "Purchase".
2026-09-03 — First version. Describes the build in which there is no server, no account, no analytics, no push, and a sandbox store in place of store billing.

This website

Everything above is about the app on your phone. This last part is about this website, chibuapps.com, which is a different thing.

What it collects. Nothing. The pages are plain files: no form, no script, no cookie of ours, and no analytics of ours.
Who serves it. Cloudflare. Like any web host, Cloudflare sees the IP address, the page requested, the time and the identification string your browser sends, in order to deliver the page, and handles that under its own privacy policy: cloudflare.com/privacypolicy.