Privacy notice
The short version
- You can study without an account. Then your study data stays on this device.
- We never ask for your Social Security number, A-Number, USCIS password, ID documents or answers to the N-400.
- No ads. No analytics. No tracking across other sites.
- You can export or delete your data in Settings at any time.
Who runs OathSteps
The OathSteps project (maintained by raychowdhury on GitHub) runs OathSteps. OathSteps is a private study tool. It is not affiliated with USCIS.
What stays on your device
These are saved in your browser’s storage on this device:
- Your settings, such as text size and theme.
- Your filing date and your state, if you enter them. Both are optional.
- Which questions you practiced, how it went, and when.
- Questions you saved, and your mock test results.
- Interview and appointment dates you enter, and your checklist progress.
- Sentences you write in writing practice.
- Answers you confirmed for questions whose answers depend on where you live.
- Issue reports you write about a question.
This data leaves your device only if you create an account and agree to sync. Settings, then Delete all data, removes it. Clearing your browser’s site data removes it too. Some browsers also delete site data you have not used for a while.
The app keeps a copy of itself and the question lists on your device so it works offline. That copy has no personal information.
If you create an account
- We store your email and the name you give.
- We store your password only as a one-way hash.
- We store your sign-in sessions, including the IP address and browser type used to sign in. We use them to keep your account safe.
- If you agree to sync, we store copies of the study data listed above, linked to your account, and a record of when you agreed.
Sync is off until you agree. Account, then Delete my account, removes your account, sessions and synced data right away. Backup copies are deleted when old backups are rotated.
We send email only to confirm your address and to reset your password. We use Brevo to send it. It receives your email address and the message. We do not send marketing email.
Voice practice
If you tap Say your answer, your browser’s speech recognition turns your voice into text. Depending on your browser, your voice may be sent to the company that makes it, for example Google for Chrome. OathSteps does not record or keep your audio or the text it hears.
You can type your answer or check yourself instead. Read-aloud uses your device’s voices. Some browsers use online voices.
The iPhone app
- Your study data is saved in a file inside the app on your iPhone, protected by the iPhone’s data protection. Deleting the app deletes it. Your iPhone or iCloud backups may include it.
- Answering aloud uses Apple’s speech recognition on your iPhone only. Your audio is not sent to Apple or to us. If your iPhone cannot recognize speech on the device, the app says so and you can type or check yourself instead.
- The app asks for microphone and speech recognition permission only when you choose to answer aloud.
- Reminders are notifications scheduled on your iPhone. Nothing is sent from our server. You can turn them off in the app’s Settings or in iPhone Settings.
- If you sign in, the app keeps a sign-in token in the iPhone Keychain, on that device only. It sends the token instead of a cookie.
Cookies and storage
OathSteps sets one cookie, only when you sign in. It keeps you signed in. We use no advertising or analytics cookies. We use your browser’s storage and a service worker, a small helper that lets the app work offline.
Server records
The server keeps the account data above and basic error logs. The logs do not contain your study data, emails or passwords. Our hosting service or server software may keep ordinary connection logs, such as your IP address and the time, to keep the service secure and to fix problems.
Who gets your information
We do not sell it. We do not share it for advertising. It goes to our email service, for the messages above, and to our hosting provider, which stores the data. We may share information if the law requires it.
Your choices
- Export your data: Settings, then Export.
- Delete the data on this device: Settings, then Delete all data.
- Delete your account and synced data: Account, then Delete my account.
- Change an answer or date: edit it in the app.
Depending on where you live, the law may give you more rights, such as asking for a copy of your data or for a correction. Contact us and we will answer.
Children
OathSteps is for adults. It is not meant for children under 13. If you believe a child gave us information, contact us and we will delete it.
Keeping data safe
Connections use HTTPS. Passwords are hashed. Sign-in attempts are rate limited. No system is perfectly secure, so please do not enter information the app does not ask for.
Changes
If this notice changes in an important way, we will say so in the app. The date at the top shows the latest update.