Security

The same honesty standard we apply to what each platform actually enforces, we apply here: real practices already in place, described plainly, with no claims we can't back up.

Data in transit and at rest

• All traffic between your devices, the dashboard, and our servers is encrypted in transit (TLS).
• Parent phone numbers, and any call and text history saved by an earlier Android version of Guardian, are encrypted at rest with AES-256-GCM, independently of database-level encryption. Guardian no longer collects calls or texts on any device.
• Passwords are never stored in a recoverable form — we hash them with Argon2id.
• The apps you choose to block on an iPhone are encrypted at rest and only sent to that iPhone. The website and other apps only ever see how many were chosen.

Device credentials

A device is enrolled using a short-lived, single-use pairing code (not a long-lived secret) entered on the device itself. Once paired, the device holds a long-lived credential that we only ever store as a hash — never the raw value — the same principle used for password storage. Pairing codes are also rate-limited, so a short human-readable code can't be brute-forced against our pairing service.

Sessions

Access tokens are short-lived; a longer-lived refresh token is used to obtain a new one without asking you to log in repeatedly. Device sessions use a separate, short-lived device token distinct from your own parent login.

Changes made from the Android or iPhone parent app need your Guardian password again ("Confirm it's you"), checked by our server, and stay unlocked for 10 minutes or until you tap Lock. After 5 wrong passwords you have to wait before trying again. A phone or browser you've signed in on before is remembered, so someone guessing your password can't lock you out.

Payments

We use Stripe for payment processing. Card details are entered on Stripe's own hosted checkout page and never touch our servers — we only ever see a subscription status and plan identifier, never a card number.

Checked on our servers

A device can never claim a feature its platform doesn't actually have. Every change a device sends is checked on our servers against what that kind of device can really do, never taken on the device's word.

Responsible disclosure

If you believe you've found a security issue, please email us before disclosing it publicly — we take real reports seriously and will respond promptly. security@myguardian.fyi.