XOR is only one implementation of one time pad, it is also commonly used with modular addition. If you do it with letters then it effectively becomes a Vigenère

XOR is only one implementation of one time pad, it is also commonly used with modular addition. If you do it with letters then it effectively becomes a Vigenère cipher with a long key. The one-time-pad is a special case of any number of poly-alphabetic substitution ciphers, XOR just being one that happens to be implemented on lots of silicon. Considering this is all about an app that has very short keys (a few numeric digits) it's perfectly legitimate to criticise the use of a substitution cipher as they are especially poor when used with short keys compared to real crypto libraries that will use that short key as the passphrase for a real key.