Privacy Policy

Guardian exists to give parents real visibility into their child's devices, which means we handle genuinely sensitive data — including a minor's. This page describes what we collect, why, and how it's protected.

Who controls the data

A Guardian account belongs to a parent or legal guardian, not the child. All settings, reports, and data collected from a paired device are visible to the family account that paired it — Guardian does not sell, rent, or share your family's data with advertisers.

What we collect from a paired device

• Device identity and platform (e.g. Android, iOS, a specific TV OS) — needed to know what enforcement that device actually supports.
• App usage summaries and the policy/schedule state applied to that device.
• Location, only if "Share location" is allowed on that device. It can be skipped during setup and turned off in the device's settings.
• On iPhone and iPad, the apps a parent chose to block, as Apple's private tokens (not app names), encrypted at rest and sent only to that device.
• On Android phones, tablets and TVs, website blocking runs on the device. Each website the device looks up is checked against the blocked list on the device itself. Lookups for websites that aren't blocked are passed to Google Public DNS to be answered, like a device's normal internet settings would. Guardian doesn't receive or keep that browsing history.
• On Android phones and Fire tablets, only if notification filtering is part of the family's plan and Notification access is allowed on the device: the text of notifications from messaging and social apps is sent to Guardian to check for harmful words, so the device can hide them. The text is checked and not stored.

Guardian does not collect calls or text messages on any device. On Android, Google Play only lets the phone's main Messages and Phone apps read texts and call logs, so the Android app no longer asks for them. iPhone and iPad don't let any app read them.

Call and text history saved by an earlier Android version of Guardian stays encrypted at rest with AES-256-GCM, including message text, and is deleted automatically on the schedule below.

Account and billing data

We store your account email and a securely hashed password (never the password itself — Guardian uses Argon2 hashing). If you subscribe to a paid plan, billing is handled by Stripe; we store your subscription status and plan, not your card details, which never touch our servers.

We may ask the account owner for a phone number, confirmed with a one-time text code, used only to check whether you can start a free trial. We store it encrypted, plus a keyed hash of it (a one-way code made with a secret key only our servers hold) so we can spot the same number again without reading it. The encrypted number is kept for the life of your account and erased when your account is deleted; the keyed hash follows the 24-month rule below.

Free-trial fraud checks

Each person and household device gets one free trial. To enforce that, we keep a keyed hash of three things, recorded when you verify your email, verify your phone, or pair a device:

• your account email;
• your phone number;
• an identifier for each paired child device: an install fingerprint the Guardian app creates on Android, and an identifier kept in the device's keychain on iPhone and iPad.

These hashes can't be turned back into the email, number, or identifier. We use them only to decide whether a new account can start a free trial, never for advertising or tracking. We keep them for 24 months, even if you delete your account, so deleting and signing up again doesn't restart the trial. After 24 months they are deleted automatically.

Who else sees it

We use a small number of third-party processors, each only for what they need to do their job:

• Stripe — payment processing for paid subscriptions.
• Our transactional email provider — account verification and notification emails.
• Our cloud hosting/database provider — where your family's data is stored.
• Google Firebase — Firebase Authentication processes your phone number to send the text code, and Google runs a reCAPTCHA check on that step. Right after the code is confirmed we delete the Firebase sign-in record and sign out of Firebase. Firebase Cloud Messaging delivers rule updates and alerts to Android devices.
• Apple Push Notification service — delivering rule updates and alerts to iPhone and iPad.
• NextDNS — runs the family website filter when a parent turns it on. NextDNS answers the website lookups of devices set up with that filter and blocks the websites and categories the parent chose. Guardian turns NextDNS query logging off when it creates the filter, so NextDNS doesn't keep a history of the websites a child visits. If logging can't be turned off, Guardian doesn't turn the filter on.
• Google Public DNS — answers website lookups that Android devices pass on after Guardian's on-device blocking check.
• Gravatar (run by Automattic) — if you haven't uploaded a profile photo, the website asks Gravatar for your profile picture using a SHA-256 hash of your email address. Gravatar receives that hash, which it can match to a Gravatar account for the same email, along with your browser's request. Uploading a photo on your Profile page stops this, unless that photo fails to load.
• OpenStreetMap — maps and place names. Map images on the website and in the Android parent app (version 1.0.0 and later) are fetched by Guardian's server from OpenStreetMap's tile server, so the child's location is not sent to OpenStreetMap from your device; earlier Android test versions loaded map images directly from OpenStreetMap. OpenStreetMap sees Guardian's server asking for that map area, not your IP address or account. Place names shown with a location are looked up by Guardian's server from OpenStreetMap's Nominatim service using the location's coordinates.

Website analytics. The public pages of this website use Umami, an analytics tool we run ourselves on our cloud hosting provider, not a third-party analytics service. It sets no cookies, counts which public pages are visited and which buttons are used, and honours your browser's Do Not Track setting. Nothing after a question mark in a web address is sent, and the address of any page that needs a sign-in is dropped in your browser before anything is sent, so the parent dashboard and your family's data are not part of it.

Retention and deletion

Device activity is deleted automatically on a fixed schedule, even while your account is active:

• location history: 30 days;
• app usage summaries and the list of installed apps: 90 days;
• call and text history saved by an earlier Android version: 30 days.

Trial-eligibility hashes are kept for 24 months, as described above, and then deleted automatically.

If your subscription ends or a payment fails, your rules are paused, not deleted. Monitoring stops while they are paused: devices stop sending location and app usage. Your rules come back when you pay.

The rest of your family's data is retained for as long as your account is active.

You can delete your account yourself at any time from the account menu on the website, after entering your password (see how to delete your account). When you do, your subscription is cancelled straight away so you aren't charged again, your children's devices are disconnected and stop applying rules, you are signed out everywhere, and any other parents in your family get an email. Seven days later we permanently erase your children's profiles, devices and rules, location and app usage history, alerts, invites, activity history, the other parents' access to your family, and your sign-in, including your email, password, name, photo and phone number. If you sign in before then, the deletion is cancelled and your data comes back, but each device has to be paired again. If you help manage someone else's family, only your own sign-in and access are erased, that family's owner gets an email, and your past changes stay in its activity history without your name.

After deletion we keep only the trial-eligibility hashes described above, for 24 months. Stripe keeps the payment records it is required to keep by law; we ask Stripe to delete your customer profile when your data is erased. You can also ask us to delete your account by writing to the address below.

Children's privacy

Guardian is designed to be set up and controlled by a parent or legal guardian, not signed up for by a child directly. If you believe a child has created a Guardian account without parental involvement, contact us and we will investigate and remove it.

Your rights

You can access, correct, export, or delete your family's data by contacting us, and you can delete your account yourself from the website. Depending on where you live, you may have additional rights under local law (e.g. GDPR, CCPA) — we will honor requests made under those laws even before we've completed a full regional compliance review.

Contact

Privacy questions or requests: hello@myguardian.fyi.