Privacy, in plain words.

Your browsing is yours. Here is exactly what happens to data. If a line here is ever untrue, that is a bug — tell us.

On your device

• Every decision about a site happens on the device you are holding: the protection lists are checked locally.
• Pauses — including the site a pause names — stay on that device.
• This week's counts are counted on the device. They leave only as totals, and only if that person turns sharing on.

What the family shares

• When someone flags a site for everyone, or a scam warning is passed along, the site’s name is shared with that family. That is the protection working — the family sees one shared list.
• The weekly totals are counts per category, like “blocked 4,212 trackers”. No member’s name is attached to any count, and nothing says who saw what.
• Both directions are consent switches, off by default. Off stays off.

What our service keeps

• Your account: a name and a way to sign in.
• The family’s shared list of sites — the flagged ones and the warned-about ones. That list is the only place a site’s name lives on our service.
• Weekly totals per family. Not per person, not per device, not per site.
• We do not have anyone’s browsing history. There is no history to have: no one, including us, can ask “what did Dad visit”.

Leaving

• Deleting the account removes that person’s membership, devices, invitations and files, and everything stored for them. It cannot be undone.
• What remains is only what belongs to the family itself: its shared list and its weekly totals.

When something breaks

• Diagnostics a person sends us (from the app’s Me screen) are redacted first: no sites, no addresses, no account details. Crash notes stay on the device they happened on.
• The app has no analytics. Nothing reports what anyone taps, and nothing reports where anyone browses.

This page describes what the service stores today, not what it might store someday. When that changes, this page changes first.