Privacy
What Guardian keeps, and what it never does
Guardian exists to help people keep boundaries with the support of people they trust. That only works if you can trust Guardian too, so here is exactly what it stores.
What Guardian never collects
- The websites you visit or what you search for. Blocking happens on your device. Your browsing is not sent to us or to your guardian.
- What you do in other apps, including your messages.
- Your protection password. When a guardian sets it on this site, their browser turns it into a fingerprint and only the fingerprint is sent. It is passed to your device, and deleted from our servers as soon as your device confirms it has it.
- Advertising or tracking data. This site has no analytics or advertising scripts, and nothing is sold.
What Guardian stores
| Your account | Your email address, the name you chose, and your password, which is stored only as a secure hash by our sign-in provider. |
|---|---|
| Your devices | The name of each device you connect (for example, its computer name), what kind of device it is, and when it last checked in. |
| Blocked request count | How many requests Guardian has blocked on each device: a number only, never which sites. The total across every device is shown on the Guardian page. |
| Your guardians | Each guardian's email address and name, and whether they have confirmed their invitation. |
| Alerts | A short record of protection events, such as protection being paused, a device going quiet, or a blocked app being stopped from opening. A record includes the time, the device's name, and sometimes a short description, which can include the name of a blocked app. Alerts never include websites visited. |
| Your circle's conversation | Messages you and your guardians write to each other on this site or in the apps. |
| Requests | Requests to pause or remove protection, any reason you give with one, and the outcome. |
| Email delivery | Which alert emails were sent to which address, and when, so a failed delivery can be noticed. |
| Signing in from a phone | When a phone signs in by scanning a code, the network address of each attempt is recorded so repeated guessing can be stopped. These records, and the sign-in codes themselves, are deleted automatically within 25 hours. |
Who can see it
You can see everything about your own devices.
A guardian can see a device's status, its alerts and its conversation only after confirming the invitation you sent them. They can't see devices you haven't invited them to, and nothing about your browsing.
People in your circle can see each other's names and email addresses, so the conversation makes sense.
These limits are enforced by the database itself, not just by the pages you see. Project Nehemiah can access stored data to run and repair the service.
Services we use
We use a small number of established providers to run Guardian. Each handles only what its job needs:
- A database and server provider stores the data above and runs Guardian's server.
- An email delivery service sends alert and invitation emails.
- A website host serves this website.
Questions and deleting your data
A contact address for privacy questions and deletion requests will be published here before the apps launch.
Last updated 30 September 2026.