Key principles
Guardian uses device, location and activity data only for transparent family safety features. Your child sees active protection, permissions and restrictions.
We do not build hidden listening, secret camera access, screen recording or interception of private conversations.
Which data categories the platform handles
Child location and data
Location is used for the last known position, safe zones, family timeline, safety check-ins and SOS. Last sync time and accuracy are shown alongside location, as the device may be disconnected or have limited permissions.
- location is not public or sold to advertisers
- access requires family membership and the appropriate role
- emergency data has a separate operational priority
- history is subject to plan and retention limits
Family controls and rights
Family owners initiate exports, deletion and session sign-outs in the portal. Operation status is visible in the product and admin panel.
Export
A JSON copy of account and family data, excluding passwords and device tokens.
Deletion
A controlled process with confirmation and a grace period.
Changes and corrections
Update profiles, devices and settings within the available features.
Session revocation
View active sessions and revoke unknown access immediately.
Retention and deletion
The matrix below comes from the platform's data register. Location and screen time history are also limited by the plan. Billing and audit data have longer, documented retention periods.
Technical services include PostgreSQL and Redis. Stripe payments and FCM/APNs notifications require separate configuration and integration testing. Cloud AI must be enabled for Guardian in Agent IDE and may process data outside the EEA. Before enabling it, the operator must establish appropriate agreements and transfer safeguards.
AI assistant, ratings and reports
The assistant is available only to signed-in parents. Core receives the entered question and limited screen context. The app does not automatically add location history, conversations or social media contents. Text entered by a parent may contain personal data — do not enter sensitive information.
The default route is local Core. If the operator enables cloud processing, the assistant shows its availability and labels answers with the provider used, OpenAI or Anthropic. Keys, limits and model selection are managed on the backend in Agent IDE, never in the installer.
Helpful / Not helpful ratings update aggregate counters without resending the conversation. Reporting an issue is separate: only after you select an initially unchecked consent box does Core store that question, answer and optional note in encrypted storage for 90 days. Reports are not accessible in the child app.
AI prepares suggestions; it does not change family rules on its own. Saving and sending a rule require parental approval. Rule features also work without an AI model.
Caregiver verification and free trial
Registration requires a full name, email, confirmation of adulthood and a phone number verified by SMS. No card, national ID number or document scan is required. Twilio Verify receives the number and verification code. The number is then represented by a keyed hash; this is not anonymous information. Trial-use evidence (phone, email, family and verification hashes) is retained for 730 days to limit repeated free trials. SMS rate-limit data is retained for up to 7 days and daily assistant counters for up to 90 days. We cannot guarantee identifying the same person after a phone or email change — we do not use invasive profiling.
The trial lasts 14 days from activation. After expiry, paid features are restricted, but the account, support, contact, SOS and safe unlocking remain available. We do not charge automatically without a payment instruction.
Providers, notifications and transfers
The operator supplies an up-to-date list of processors before opening registration. Data region: to be provided by the operator.
When push is enabled, the installation token is stored encrypted and linked to an active session. Google Firebase Cloud Messaging receives the token and a generic event notice, without coordinates or conversation contents. Signing out or revoking the session disables this access. Provider acceptance does not mean a message was read on the phone. Stripe payments, if enabled, take place on the provider's site; Guardian does not store card details.
The operator determines appropriate agreements, regions, any standard contractual clauses and non-EEA transfer conditions for enabled providers. APNs and store payments require separate Apple/Google implementation; entering keys alone does not activate them.
Safety and related documents
The platform separates roles, user sessions and device tokens. Privileged admin operations are access-controlled and audited. External service secrets are never part of the mobile client.
You may request access, correction, restriction, deletion or portability, and object where processing relies on legitimate interests. Withdrawing consent does not affect earlier processing. Accounting records required by law and essential payment evidence may remain in a restricted archive. We generally respond within one month, subject to lawful extensions. You may complain to Poland's UODO or the competent supervisory authority. AI does not independently make decisions with legal effects on a child.
Related documents: terms, cookie policy. You can send privacy questions via contact form.