Your recovery is nobody's business but yours.
Most content blockers make money by watching you — logging sites, emailing reports to a "partner", or renting the data out. Oath Light takes the opposite position: it can't leak what it never collects. Everything runs on your device, and the code is open for anyone to check.
Six promises, by design.
No telemetry
No analytics, crash pings, or usage stats. No code path in the repository sends anything about you anywhere on its own.
No accounts, no server
Nothing to sign into and nothing stored off-device. You never create an identity, so there is nothing to profile.
No cloud analysis
Filtering never sends a URL or page content to a server. There is no server. Every check runs on your machine.
No data selling
Your browsing can't be sold, rented, or handed to advertisers, because it is never collected in the first place.
No activity reports
Nothing emails a list of what you viewed to an "accountability partner". An optional trusted contact gets discrete events and your name — never history, never screenshots.
No diary of your worst moments
The event log records that something happened, never what you looked at. No URLs, no page content, no screenshots.
Three outbound calls exist. Here they are.
"Zero telemetry" is only meaningful if the exceptions are named. These are all of them — and two of the three don't exist until you configure them yourself.
Blocklist updates
A plain download: a signed file fetched from GitHub and checked against a key built into the app. The request sends nothing about you.
Your trusted contact
If you set one up, alerts go out over your own mail configuration and carry an event and your name. Not history, not screenshots, not scores.
Your AI mentor
Off until you add your own API key. It talks to your provider under your key; the project never sees, stores or relays a message, and the conversation is never written to disk.
Clear about the line.
No fine print. Here is exactly where Oath Light stands.
On-device, in memory, off by default.
An opt-in monitor analyses what's on screen to catch content the URL layers can't see. Because it touches your screen, it is built to the strictest standard in the project — and it stays disabled until you deliberately turn it on.
If you never enable it, it never runs. Nothing about it is silent or automatic.
An ONNX ensemble scores frames locally. No frame is ever uploaded for evaluation, to this project or anyone else.
A frame is scored in RAM and immediately thrown away. Nothing is written to disk — no gallery, no history, no evidence file.
It can cover the screen and open your own redirect. That is the entire set. Reporting a false positive shortens the pause and never makes the filter catch less.
Broad access, narrow purpose.
A content blocker has to see requests in order to block them, so the extension asks for wide host access. That access is used only to match and stop content locally. Here's the accounting, permission by permission — the same table that ships in the repo's SECURITY.md.
| Browser permission | Used for | Never used for |
|---|---|---|
| <all_urls> | Checking a page's hostname against the local blocklist | Reading, storing or sending page content |
| webNavigation | Catching a navigation before the page loads | Recording where you went |
| tabs | Sending a blocked tab to the block page | Building browsing history |
| cookies | Setting a site's own "no adult content" preference | Reading cookies for anything else |
| declarativeNetRequest | Enforcing SafeSearch and Restricted Mode | Inspecting your traffic |
| storage / unlimitedStorage | Holding your settings and the blocklists | Anything leaving the device |
| nativeMessaging | Talking to the desktop app on the same machine | Any remote connection |
| alarms | Blocklist update checks and reminders | Tracking |
The desktop app additionally asks for administrator rights once, at setup — used to write browser policy, point this machine's DNS at the local resolver, and register autostart. Nothing else. Decline it and the app still runs: the browser stays protected, and the DNS layer keeps asking until you allow it.
What Oath Light can't do.
It reduces access and buys you time. Real recovery also needs support, honesty, and often professional help.
Every Oath Light process runs as the user it protects, so an administrator who sets out to remove it has the operating system's help. That's stated plainly in SECURITY.md rather than papered over.
Expect rough edges and gaps. The desktop app installs from source and shouldn't be your only line of defense yet.
Per-item filtering covers 35 supported platforms. The AI monitor closes some of the rest, but only while it's on.
If you're struggling, you deserve real support. Consider reaching out to a trusted person or a professional — a blocker is a helpful guardrail, not a substitute for care. Found a hole? Report it in BYPASSES.md.