Privacy Policy

1. Who we are and what this covers

GuardianAI is made by GUARDIANAI, LLC, a Delaware company based in Holliston, Massachusetts ("we", "us"). This policy covers the GuardianAI apps for guardians and for children on Android, iPhone and iPad, computers, and web browsers; the website at guardianaiapp.com; and the services behind them.

GuardianAI is a family safety product. It is designed to be used by an adult guardian to supervise a child's devices, with the child's knowledge. It is never hidden on a device.

2. The words we use

• Guardian means the adult who runs the family account: a parent or legal guardian, or another adult with recognized responsibility for the child. Where a law uses the word "parent", read it here as guardian.
• Child means the young person whose devices are supervised. GuardianAI requires a child to be at least 6 years old.
• Family means a guardian, any co-guardians, their children, and the devices linked to them.
• Guardian Filter is our network-level content filter on a child's device. ScreenGuard checks what is on the child's screen. CallGuard listens for danger during phone calls. Safe & Sound is a guardian-started live audio check-in. Trusted Circle is cross-family contact verification. Guardian View is a guardian-started live look at the child's screen.
• Sealed means encrypted with a key that exists only on your family's devices. We store sealed data and pass it along, and we cannot open it.
• Readable means our systems can read it, because the product needs to, and we say so wherever that is the case.

3. Our standards, and how far along each one is

These are the rules we build to. Each one is marked with where it stands today. A standard marked in progress is a commitment about direction, not a description of the current product; the sections that follow describe the current product.

Standard	Status today
Privacy is literal, not marketing. When we say something stays on the device, it stays on the device. When we cannot say that, we say what actually happens instead.	In force. This policy was rewritten against a line-by-line map of our own database to make it true.
We never sell data, never run ads, and never build advertising profiles of anyone, least of all children.	In force. There is no advertising code in our apps. We removed the last analytics library from the Android app in August 2026.
Your child's own photos, messages and camera never leave their device.	In force. See section 5.
Everything expires. Nothing about a child is kept indefinitely, and the schedule is published.	In force. See section 15. The schedule is enforced by a daily job, not just written down.
Deleting is real, immediate for a child, and does not need our permission.	In force. See section 17 and our deletion page.
Never hidden, never shaming. The child always knows GuardianAI is on their device, and nothing we send a guardian frames the child as the problem.	In force.
Seal everything we can. Our goal is that alerts, location, activity, and settings all travel and rest sealed to your family's key, so that we could not read them if we were ordered to.	In progress. Sealed today: the encrypted sync store, and safety alerts sent from Android devices set up with a Family PIN. Not yet sealed: alerts from iPhone and the browser extension, location, activity detail, and contact names. Section 12 has the exact list and the order we are shipping it in.
Nothing about a child is sent to an AI service unless it is public content, and then only for a moment and with no name attached.	In force, with one narrow exception on Android that is disclosed in section 7 and scheduled for removal.
Outside experts check our work.	Not yet. We have not had an independent security review. One is being arranged for the fall of 2026. We will not describe ourselves as audited until it has happened.

4. What we collect

About the guardian

• Your name and email address, and a password we store only as a hash. If you sign in with Google or Apple, we receive the identifier and email those services provide.
• Your phone number, if you add one, so a child can reach you in Battery Protect and restriction modes.
• Your subscription plan and billing status. Card details are held by Stripe, never by us. Subscriptions are purchased on guardianaiapp.com, not through Apple or Google.
• If you start a free trial, we keep a one-way hash of your email address, not the address itself, so the same email cannot claim a second free trial. We keep that hash after your account is deleted, for that one purpose only. It cannot be reversed into your address.
• Your family's rules: allowed apps, schedules, content settings, approved sites, and age standards. These are readable, because every device in the family has to be able to apply them.
• Your setup interview, if you do one. It can contain sensitive things about your family, so it is sealed to your family's key the moment the interview ends and the readable copy is destroyed. We cannot read a finished interview.
• Your consent records: what you agreed to, when, how we verified you, and the address you did it from. The law requires us to keep these.

About the child

• Their first name, date of birth, and the settings that apply to them. We use the date of birth to choose age-appropriate defaults and to know when a child becomes an adult. When your youngest child turns 18 we ask you whether you want to keep the service, and we ask again every year. We never renew silently and never cancel silently.
• Any email addresses the guardian asks us to watch for phishing and stranger contact. We check messages for danger signals; we do not store their contents.
• Safety alerts, location, activity, audio-derived records, contact records, and page requests, each described in its own section below.

About devices

• A record for each enrolled device, a token so we can send it notifications, and a heartbeat so a guardian can tell if a device has gone quiet or been tampered with.
• The internet address a device connects from, kept for 90 days, used only to detect fraud and abuse.
• Crash and stability reports provided by the app stores. They contain no family content.

5. What never leaves your child's device

• Photos and videos your child takes, keeps, or views in their camera, gallery, and messaging apps. ScreenGuard treats those apps as private. Inside them, every check is made on the device, and if the device cannot decide, nothing is sent anywhere. It is decided locally or not at all.
• The screen itself, as a rule. ScreenGuard samples the screen every few seconds and checks it on the device. Frames are analyzed and discarded. The one exception, for public content only, is in section 7.
• The text your child types. We do not include a keylogger of any kind.
• Your child's address book. Trusted Circle checks contacts on the device against a privacy-preserving fingerprint. The address book is never uploaded. Section 10 describes the one moment a single number is sent, and why.
• Phone call audio. CallGuard transcribes on the device using the phone's own offline speech recognition and analyzes the words on the device. Nothing is recorded, and no audio is sent to us. Only a conclusion ("this call showed signs of a scam") leaves, as an alert.
• Biometrics. Face and fingerprint unlock are handled by the operating system. We never receive them.
• Your family's encryption keys. They are derived from your Family PIN on your own devices. We never hold the PIN or the keys.

6. What reaches our servers, and whether we can read it

For the product to work, some information has to travel from a child's device to a guardian's device, and it travels through us. This table is the honest account of what that is. "Sealed" means we store it but cannot open it. "Readable" means we can.

What	Today	Notes
Sync store (settings, activity summaries, digest data synced between family devices)	Sealed	Encrypted on the sending device with your family key. We have never been able to read it.
Safety alerts: what was detected, on which page, with a short excerpt of the matching text	Sealed from Android devices set up with a Family PIN. Readable from iPhone and the browser extension, and from Android devices not yet set up with a PIN.	We always see, and need to see, an alert's severity and which of four broad categories it falls in (content, contact, wellbeing, system), so it can reach the right guardian. Sealing the rest for every device is in progress; see section 12.
Location	Readable for most devices today. Sealed for devices already sending in encrypted mode.	See section 8.
Screen time by app, and time by website category	Readable	This is how the daily grade and screen-time limits work. We plan to seal it; see section 12.
Blocked-page requests: the address of a page the child asked to unblock, and the reason they typed	Readable	Denied requests are deleted after 6 months. Approved ones are kept because they are the standing permission the filter enforces.
Contact names and the app a contact came from, for contact approval and Trusted Circle	Readable	Phone numbers are stored only as a one-way fingerprint. See section 10.
Ride-Share Monitor: driver name, vehicle, pickup and destination, route	Readable	Kept 6 months after a trip ends. We plan to seal it; see section 12.
Distress signal, check-in, and Safe & Sound session records	Readable	These are emergency features. Their location and message text are deliberately readable so an alert can reach every guardian with zero delay. Kept 1 year.
Weekly digest	Readable	Encrypted at rest with a key we hold, which means we can read it. Digest emails carry only severity, category, and a generic line for any sealed alert, never alert detail.
Bleeped-media transcripts (see section 9)	Sealed for families with a PIN, otherwise readable	Dialogue from a show or video, not your child's voice. Kept 30 days.
Your family's rules and settings	Readable	By design. Every device has to be able to apply them.

7. Content we send to an AI service for a moment

To judge whether a web page or a video is appropriate, GuardianAI may send the page's text (up to about 10,000 characters) to an AI service, currently provided by Anthropic. Here is exactly how that works:

• The request carries no family, child, or device identifier. It asks "what is this page", never "who is looking at it".
• On the Free plan we count how many of these checks your household has used this month, against the monthly allowance. The count is tied to your family. The content is not.
• The text is processed in memory and is not stored by us. What we keep is the verdict, tied to the content, not to your child, so the next family whose child opens the same page gets an instant answer without another request.
• Your child's own messages, photos, and camera are never part of this. Section 5 governs those.

The narrow exception, disclosed and scheduled for removal. On Android, when ScreenGuard sees an image in a public app (a browser, a video platform, a social feed) that its on-device model cannot judge, it may send one compressed screenshot of that image to the same AI service for a verdict. The screenshot is processed in memory, never written to disk or to our database, never linked to your family, and discarded immediately. Camera, gallery, and messaging apps are excluded from this entirely. We are building a stronger on-device model to replace this step, after which no image of any kind will leave a child's device.

8. Location

Your child's location exists so that you can see it, so it travels from their device to yours, through us.

Today, for most devices, our servers can read the coordinates. Location history is deleted after 90 days. Geofence crossings ("left the school zone") are kept 6 months. Distress-signal and check-in locations are kept 1 year, because they are emergency records.

Where we are going, and where some devices already are: location leaves the child's device sealed with the family key, our servers store and pass along an envelope they cannot open, and it is readable only on your family's devices. Devices already sending this way are sealed today. The rest join as the encryption rollout in section 12 reaches them. Emergency locations in a distress signal will stay readable on purpose, so that nothing can delay them.

9. Audio, calls, and Safe & Sound

There is no always-on microphone anywhere in GuardianAI. We decided against building one, permanently. Every use of a microphone is bounded and started by a person:

• CallGuard transcribes and analyzes on the device. No audio leaves. See section 5.
• Safe & Sound lets a guardian open a live audio check-in from the child's device, capped at 30 minutes, with a visible indicator on the child's screen the whole time. The audio is streamed live and is not recorded or stored by us. We keep a record that a session happened, who started it, and how long it lasted, for 1 year.
• The distress signal may stream live audio and location to every guardian during an emergency. Same rule: streamed, not stored.
• Talking to the app (the child or guardian using the voice assistant) sends that speech for transcription while they are speaking. It is not kept.
• Bleeping is different, and worth explaining. When a family turns on live profanity muting for shows and videos on a computer or in a browser, the audio of that show is streamed to a transcription service so it can be muted a moment before the word plays. That audio is the movie, not your child. Short excerpts of the show's dialogue around a flagged word are kept for 30 days so the mute gets faster over time, sealed to the family key where one exists.

10. Contacts and Trusted Circle

Trusted Circle shows a verified badge next to contacts who are also GuardianAI children, and lets families warn each other about high-risk contacts, without anyone's address book being uploaded. Phone numbers are turned into a one-way fingerprint on the device, and only fingerprints are compared.

The one moment a number is sent: when a guardian is asked to approve a new contact, the child's device sends that one phone number to us so we can create the fingerprint. The number is not stored; the fingerprint and the contact's display name are. We are moving the fingerprinting onto the device so that the number never travels at all.

On Android, with the guardian's permission, GuardianAI also reads the call log to show contact patterns: who the child talks to, how often, and when. Never the content of a call.

11. Guardian Filter

Guardian Filter checks website names on the child's Android device against your family's rules and our blocklist, and blocks the ones that should not load. It runs on the device. No web traffic is sent through our servers.

Name lookups that the filter allows are resolved over an encrypted connection to Cloudflare's public resolver, so your internet provider cannot see them. Cloudflare's own privacy policy governs what it does with resolver queries. Names the filter blocks never leave the device.

Guardian Filter checks names, not connections. A site reached by a direct address, through a proxy, or from a server shared with allowed sites is not checked at this layer. That is a limit of the technology, and it is why ScreenGuard and the browser extension exist as separate layers.

12. Encryption, exactly

Everything between your devices and us is protected in transit with TLS. Our apps additionally pin our server's certificate, so a network attacker cannot impersonate us. Everything at rest on our servers is encrypted. Those two things are standard, and every serious company does them.

What we are building on top of that is end-to-end sealing: encryption with a key we never hold, derived from your Family PIN on your own devices, so that even we cannot read your family's data. Here is exactly where that stands.

Data	Sealed today?
Sync store	Yes, always has been
Setup interview transcript	Yes, since August 2026
Bleeped-media transcript excerpts	Yes, for families with a Family PIN
Safety alerts from Android	Yes, for devices set up with a Family PIN
Safety alerts from iPhone and iPad	Not yet. Next in line.
Safety alerts from the browser extension	Not yet. The extension has no way to receive the family key today; that is being designed.
Location	Partly. Devices in encrypted mode, yes; the rest, not yet.
Screen time, website time, ride-share detail, contact names	Not yet. Planned after alerts and location.
Weekly digest	No. Encrypted with our key, which we can use. Planned.
Alert severity and broad category, family and device identifiers, timestamps, your rules	No, by design. This is what routing an alert to the right guardian requires, and it contains no content.

While this rollout is incomplete, our systems still accept alerts in readable form from devices that have not been updated. When every device type can send sealed alerts, we will stop accepting readable ones, and this policy will be updated to say so.

What "sealed" means for you: if you lose your Family PIN and your recovery phrase, sealed data is gone. We cannot recover it, because we cannot read it. Keep the recovery phrase somewhere safe.

13. How we use information, and what we never do

We use the information described in this policy to run the family safety features you turn on, to deliver alerts and the daily grade to guardians, to enforce the rules you set, to bill you, to secure the service against fraud and abuse, and to meet legal obligations.

We do not, and will not:

• Sell or rent anyone's data.
• Show advertising, or share anything with advertisers or data brokers.
• Build behavioral or advertising profiles of children or guardians.
• Use your family's content to train AI models.
• Read a family's sealed data. We cannot.
• Read a family's readable data except to operate, debug, or secure the service, or when the law requires it. Access to production systems is limited to the people who run them, behind multi-factor authentication, and is logged.

14. Companies that process data for us

These companies process data on our behalf, under contracts that limit them to providing their service to us. None of them is permitted to use your family's data for their own purposes.

Company	What they do for us	What reaches them
Amazon Web Services	Hosting, database, encrypted backups, and outbound email	Everything we store, encrypted at rest; the emails we send you
Anthropic	AI classification of public content	Page text and, on Android, the occasional ambiguous screenshot of public content, with no family identifier (section 7)
Deepgram	Live transcription	Streamed audio for bleeping and for the voice assistant (section 9)
Cloudflare	Encrypted name resolution for Guardian Filter	Website names the filter allows (section 11)
Stripe	Payments	Billing identifiers and your Stripe customer record. Card details stay with Stripe. Apple and Google are not involved in payment.
Apple and Google	Push notifications	A device token and the notification body. For sealed alerts, the body is a generic line with no child name or detail. For readable alerts, it may carry the alert title.

We use no advertising networks, no tracking pixels, and no third-party analytics in the apps.

15. How long we keep things

The amended Children's Online Privacy Protection Rule prohibits keeping children's data indefinitely and requires a published schedule. This is ours. It is enforced by a job that runs every day.

Record	Kept for
Safety alerts	45 days
Bleeped-media transcript excerpts	30 days
Device tamper records	30 days
Location history	90 days
Device internet addresses	90 days
Device heartbeats	90 days
Geofence crossings	6 months
Completed check-ins	6 months
Completed ride-share trips	6 months
TV and streaming activity	6 months
Denied page requests	6 months
Screen time and website time	1 year
Distress signal, SOS, and Safe & Sound session records	1 year
Approved page requests	Until you revoke them; they are the permission itself
Your rules, settings, and sealed sync store	As long as your family uses GuardianAI
Account, subscription, and device records	As long as your account exists, then deleted per section 17
One-way hash of a guardian email that has used a free trial	Kept after account deletion, to prevent a second free trial. Not reversible into the address (section 4)
Consent records	7 years, required by law
Billing and tax records	As required by law, typically 7 years
Reports to NCMEC (section 18)	1 year minimum, required by law

Deleting a child's profile removes that child's records from every table above immediately, ahead of any schedule. Deleted data is gone from live systems at once and from encrypted backups within 30 days.

16. Children's privacy and COPPA

GuardianAI is built for supervising children, so we collect information about children by design, and we take the Children's Online Privacy Protection Act seriously as the rulebook for doing that honestly.

• Only a guardian can create an account, add a child, or enroll a device. A child cannot sign up for GuardianAI. We verify that the person creating the account is an adult before any supervision begins, and we keep a record of that consent for 7 years, as the law requires.
• Children must be at least 6. When a child turns 18 we ask you whether to continue, and again each year after that, rather than deciding for you.
• We collect from children only what the safety features you turn on need, and each section above says what that is.
• We do not advertise to children, profile them, or share their information with anyone who is not a service provider in section 14.
• A guardian can review and delete a child's information at any time, and can withdraw consent by deleting the child or the account. Section 17 explains how.
• The child is told. GuardianAI is never hidden on a device. Before you install it, your child should know it is there. That is how the product works and it is not optional.

Where two guardians share a family, either can add or remove a child, and either can delete the family account, which requires the account password.

17. Your rights, and how to use them

These rights are yours regardless of where you live. Where a state or national law gives you more, you have that too.

• See it. Request a copy of everything we hold about your family from Settings, Privacy, Export my data, or by email. We provide it within 30 days, in a machine-readable format. Sealed data is included as we hold it: sealed.
• Delete a child. In the app, from Settings, Children. Immediate, complete, and cannot be undone.
• Delete the family. In the app, from Settings, Account, Delete Account, with your password. A 30-day grace period follows, during which nothing is deleted, protection keeps running, and you can change your mind from a link we email you. After 30 days every device is released and everything is permanently deleted, except the three legally required categories listed on our deletion page and one item of our own: the one-way hash of your email described in section 4, kept so the same email cannot claim a second free trial. Your Stripe customer record (name, email, and saved payment methods) is deleted with the account. Stripe keeps the transaction history the law requires it to keep. If a child is missing and the account is under a safety hold, deletion waits until the hold ends; holds expire on their own and cannot delay a deletion indefinitely.
• Correct it. Names, dates of birth, settings, and family structure can be changed in the app at any time.
• Withdraw consent. Deleting a child or the account withdraws consent for that child or family. Turning a feature off in Settings stops that feature's collection from then on.
• Ask a person. Email privacy@guardianaiapp.com from the address on your account. We reply within 5 business days. We will never delete an account for someone who cannot prove they own it, because for this product that would itself be a safety risk.

18. Reports the law requires

If GuardianAI detects known child sexual abuse material, United States law requires us to report it to the National Center for Missing & Exploited Children. The report contains a digital fingerprint of the image, never the image itself, and federal law requires us to preserve the report's contents for at least one year. We cannot withdraw such a report, and it survives account deletion. This is rare, mandatory, and we would rather tell you here than surprise you later.

If we receive a lawful demand for data, we comply only to the extent the law requires, and we can only hand over what we can read. Sealed data is sealed from us too.

19. Security

• TLS for everything in transit, with certificate pinning in our apps.
• Encryption at rest for everything we store, on infrastructure that is independently certified (SOC 2 Type II).
• Production access limited to the people who operate the service, behind multi-factor authentication, and logged in a tamper-evident audit trail.
• A tamper monitor on every child device that tells the guardian if protection is turned off, revoked, or goes quiet.
• No independent security audit yet. One is being arranged for the fall of 2026, and we will publish a summary of its findings.

If we ever have a breach that affects your family's data, we will tell you directly, promptly, and in plain language, and we will tell regulators where the law requires it.

20. Changes to this policy

When we change this policy, we update the date at the top. For a change that affects what we collect about children or how we use it, we email every guardian at least 30 days before it takes effect and, where the law requires, ask for consent again. Each version notes what changed.

September 13, 2026. Full rewrite. The previous policy (April 28, 2026) said that location, page addresses, contact names, and alert detail never reached our servers. That was not true of the product as built, and it should not have been published. This version was written against a line-by-line audit of our own database so that every sentence matches the code. The product had no public users at the time.

21. Contact

GUARDIANAI, LLC, Attn: Privacy Team
3 Eagle Path, Holliston, MA 01746, USA

Privacy questions and requests: privacy@guardianaiapp.com
Security concerns: security@guardianaiapp.com, with URGENT in the subject line for anything involving a child's safety
Phone: 617-285-4460

We respond to privacy requests within 5 business days.