Privacy policy

Account data we collect

• An email address and a password (see "How passwords are protected" below) — used only to identify your account.
• Nothing else is required to register.
• When you attempt to log in, we briefly record the IP address and email used, solely to block repeated password-guessing attempts. These records are kept only long enough to enforce that limit (about 15 minutes), then deleted — they aren't used for anything else.
• Requesting a password reset works the same way: we briefly record the IP address that made the request, solely to stop that page from being used to spam an email address with reset links. Kept about 10 minutes, then deleted.

Per-child data we collect

• An alias you choose for them (not required to be their real name), their age, and the resulting content-sensitivity settings you configure.
• Any custom keyword or domain rules you add.
• Your child's sensitivity settings and any custom keyword or domain rules are encrypted before being stored — even someone with direct access to our database can't read them in plain form.

Device data we collect

• A record that a browser is linked to a child's profile, plus a device credential, so that browser can be authenticated to fetch that child's settings.
• When a device redeems a linking code, we briefly record the IP address that made the request, solely to block brute-force guessing of linking codes. These records are kept only long enough to enforce that rate limit (about 10 minutes), then deleted — they aren't tied to your account or child's profile and aren't used for anything else.
• When your child's device requests content classification, we briefly record which device made the request and how many it's made recently, solely to prevent abuse of that feature. These records are kept only long enough to enforce that limit (about 5 minutes), then deleted.

Activity data we collect

• For each piece of content our filter acts on: which category it was flagged under, a confidence score, and what action was taken (allowed / blurred / removed).
• We deliberately do not log the actual text, the image, the video frame, the specific words matched, the page URL, or any other identifying detail of what was viewed — only the category-level verdict.

What we never store, under any circumstance

How passwords are protected

Passwords are never stored as entered. They're run through PBKDF2-SHA256 (100,000 iterations, a unique random salt per account) before storage — a one-way transformation; even we can't recover your original password from what's stored.

How sessions and devices are protected

• A parent's dashboard session is a cryptographically signed token (JWT, HMAC-SHA256) valid for 7 days. It carries no personal data beyond an internal account identifier and can't be forged without our server-side signing key.
• A linked device (browser) authenticates with a random, high-entropy token generated at link time. Only a one-way hash of that token is stored on our servers — like your password, the original value can't be recovered from what's stored.
• All traffic between your browser, your child's browser, and our servers is encrypted in transit (HTTPS/TLS).

How AI analysis works, and what leaves your device

• Some filtering — custom keyword matching, domain blocking, and applying your chosen sensitivity thresholds to a score — happens entirely on your child's own computer. Nothing is sent anywhere for this part.
• Actual content understanding (the judgment of text meaning or image/video content) runs on Cloudflare Workers AI — the same cloud platform that hosts our servers and database. The flagged text or image is sent there to be scored; it is not sent to any other AI company or third party beyond that.
• When an image needs to be fetched from its original website, our server fetches it — not your child's browser — specifically so the image's host never learns your child's IP address or that they're the one requesting it.
• In every case, the content sent for analysis is scored and then discarded — never written to a database.
• To avoid re-scoring the same image or video every time it's encountered, your child's browser keeps a short-lived local cache of image web addresses and their scores — capped at 500 entries, cleared after 24 hours, and also cleared immediately if the device is unlinked. This cache stays on your child's device; it's never sent to us.

Data retention and deletion

• Account and profile data is retained for as long as your account exists.
• Activity records are retained alongside the profile they belong to, for as long as that profile exists.
• Deleting a child's profile permanently deletes their activity history along with it — nothing is left behind.
• Deleting your account permanently deletes everything: all child profiles, their settings and activity history, and all linked devices. This can't be undone.

Contact

Questions about your account, this policy, or how WebSafe handles your family's data — email support@websafe.nz.