Privacy policy

Account data we collect

• An email address and a password (see "How passwords are protected" below) — used only to identify your account.
• Nothing else is required to register.

Per-child data we collect

• Name, age, and the resulting content-sensitivity settings you configure.
• Any custom keyword or domain rules you add.

Device data we collect

• A record that a browser is linked to a child's profile, plus a device credential, so that browser can be authenticated to fetch that child's settings.
• When a device redeems a linking code, we briefly record the IP address that made the request, solely to block brute-force guessing of linking codes. These records are kept only long enough to enforce that rate limit (about 10 minutes), then deleted — they aren't tied to your account or child's profile and aren't used for anything else.

Activity data we collect

• For each piece of content our filter acts on: which category it was flagged under, a confidence score, and what action was taken (allowed / blurred / removed).
• We deliberately do not log the actual text, the image, the video frame, the specific words matched, the page URL, or any other identifying detail of what was viewed — only the category-level verdict.

What we never store, under any circumstance

How passwords are protected

Passwords are never stored as entered. They're run through PBKDF2-SHA256 (100,000 iterations, a unique random salt per account) before storage — a one-way transformation; even we can't recover your original password from what's stored.

How sessions and devices are protected

• A parent's dashboard session is a cryptographically signed token (JWT, HMAC-SHA256) valid for 7 days. It carries no personal data beyond an internal account identifier and can't be forged without our server-side signing key.
• A linked device (browser) authenticates with a random, high-entropy token generated at link time.
• All traffic between your browser, your child's browser, and our servers is encrypted in transit (HTTPS/TLS).

How AI analysis works, and what leaves your device

• Some filtering — custom keyword matching, domain blocking, and applying your chosen sensitivity thresholds to a score — happens entirely on your child's own computer. Nothing is sent anywhere for this part.
• Actual content understanding (the judgment of text meaning or image/video content) runs on Cloudflare Workers AI — the same cloud platform that hosts our servers and database. The flagged text or image is sent there to be scored; it is not sent to any other AI company or third party beyond that.
• When an image needs to be fetched from its original website, our server fetches it — not your child's browser — specifically so the image's host never learns your child's IP address or that they're the one requesting it.
• In every case, the content sent for analysis is scored and then discarded — never written to a database.
• To avoid re-scoring the same image or video every time it's encountered, your child's browser keeps a short-lived local cache of image web addresses and their scores — capped at 500 entries, cleared after 24 hours. This cache stays on your child's device; it's never sent to us.

Data retention and deletion

• Account and profile data is retained for as long as your account exists.
• Activity records are retained alongside the profile they belong to, for as long as that profile exists.
• Deleting a child's profile permanently deletes their activity history along with it — nothing is left behind.
• Deleting your account permanently deletes everything: all child profiles, their settings and activity history, and all linked devices. This can't be undone.