Privacy Policy

Last updated: October 3, 2026

Overview

Kidfence is a parental control product made of two pieces of software with different jobs: Kidfence for iPhone, the parent's app, and Kidfence for Mac, the software on the child's Mac that enforces the parent's rules. Because they do different things, this policy describes each one separately in Part 1 and Part 2, and what they share in Part 3. If you are checking what the iPhone app collects, Part 1 is complete on its own.

The core principle: your data stays on your devices. What your child does is recorded on the Mac and stays there. Everything a parent sees about their child, activity reports, blocked attempts, open tabs, and screen-time charts, is end-to-end encrypted on the Mac and sent to the parent's iPhone. Our server relays the ciphertext and cannot read it.

We don't sell your data, show ads, or use third-party analytics or tracking. There is no account and no sign-up. Devices are paired with cryptographic keys, not personal logins. There is one optional feature that uses your Apple ID: a recovery link you can turn on from Settings, described in Part 1. It is not a login and it is not required.

Part 1: Kidfence for iPhone

The iPhone app is the parent's app. You use it to manage a child's Mac by texting Kidfence in plain English. It does not monitor, filter, or control the iPhone it runs on. It installs no profiles, changes no network settings, and reads nothing from the phone beyond what you type into it.

What the app never touches on your phone

• Your screen, keystrokes, or other apps
• Photos, videos, files, or the microphone
• Messages, email, contacts, or calendar
• Location
• Your phone's browsing or network traffic

The app asks for two permissions, both optional: the camera, used only while you scan the pairing code on your child's Mac, and notifications, if you want alerts when a report arrives. Nothing from the camera is stored or sent anywhere.

What stays on your phone

• Chat transcript, your conversation with Kidfence. Stored only on the phone. Deleting the app removes it.
• Your child's name and avatar, sent from the Mac to your phone end-to-end encrypted. They never reach our server in readable form.
• Activity reports, blocked attempts, open tabs, and hourly screen-time charts, everything you see about your child. Decrypted only on your phone.

What passes through our server without being stored

• Your commands. When you type "block Roblox", the text goes to our server, which sends it to our AI provider to work out the action. The server processes it in real time and does not keep it.
• Your display name and avatar. When you set them, the server forwards them to your paired Macs and forgets them. They are not written to any record.
• Encrypted reports from the Mac. The server relays ciphertext to your phone. It cannot read it and never sees which sites or tabs your child has open.

What our server stores

• Pairing records. Your phone's public key, that it is an iPhone or iPad, its iOS and app version, a device label (the model name, such as "iPhone 16e", or a name you choose in Devices), a random three-word handle, and the family it belongs to. No name, no email, and no hardware identifier.
• Your rules. The apps and sites you have blocked or allowed, time limits, bedtimes, screen-time budgets, and whether the Mac is paused. They are stored so the Mac can fetch them, and they describe your decisions, not your child's activity.
• The latest status from each Mac, as ciphertext only, kept until the Mac sends the next one. It lets the Devices tab show a summary when you open the app. The server cannot read it.
• Queued commands for a Mac that is offline, deleted after delivery or after 7 days.
• Subscription status. Which plan is active, when it expires, when a trial started, the transaction identifier Apple assigns, and any promo code you redeemed. Apple handles payment; we never see card or billing details.
• Co-parent invites. When you invite another parent, the invite carries your display name so they know who sent it. It is stored until the invite is accepted or removed.
• Usage counters. How many commands your family has sent today, for fair-use limits. Counts only, never the text.
• Setup analytics. During setup and a few key moments afterwards (for example, pairing completed or ownership transferred), the app sends an event name, the step you were on, a random identifier created for that installation, the platform, and the app and OS versions. We use this only to see where setup fails. It is first-party: no advertising network or analytics company receives it, and it is not tied to your key or your family. Kept for 90 days.
• Diagnostic log (beta). See below.

Optional Apple ID recovery

The family owner can link an Apple ID from Settings as a recovery key, so the family can be recovered on a new phone if every paired device is lost. The app works identically without it.

If you turn it on, our server stores two values: the identifier Apple assigns to you for Kidfence, and the email address Apple provides, usually an Apple private-relay address rather than your real one. We use them for one purpose, confirming it is you when you recover your family or transfer ownership. We never send email to that address and never use it to identify your child. To remove the link, contact us at the address under Contact.

Diagnostic log (beta)

During the beta the iPhone app sends us its technical log so we can diagnose problems such as a report that never arrived or a pairing that failed. Every line is scrubbed on the phone before it is sent: email addresses, cryptographic keys, full URLs, and website names are replaced with placeholders. The log never contains your chat messages, your child's activity, or the contents of any report. It carries the app version, the OS version, and that the device is an iPhone or iPad, never the device's name or a hardware identifier. Logs are kept for 14 days and then deleted. You can see the log's identifier in Settings, and the log itself under Share Debug Log.

Part 2: Kidfence for Mac

The Mac software runs on your child's Mac and enforces the rules set from the iPhone app: blocking apps and sites, screen-time budgets, bedtimes, and pauses. What your child does stays on the Mac, and what you see about it is encrypted for your phone alone.

What stays on the Mac (never sent to our server)

• App usage data, which apps are active and for how long. Stored only on the Mac.
• Domain visit history, domain names (for example "youtube.com") used for web filtering. Stored only on the Mac. No full URLs, page content, or search queries.
• Blocked attempt logs, records of blocked apps and sites. Stored only on the Mac.
• Your child's name and avatar, received from your phone end-to-end encrypted and kept on the Mac.

What the Mac sends to your phone, end-to-end encrypted

Activity summaries, blocked attempts, open tabs, and hourly screen-time charts are encrypted on the Mac with keys that exist only on your devices, then relayed through our server to your phone. The server cannot read them and never sees which sites or tabs your child has open. The Mac also keeps its latest status on the server as ciphertext, replaced each time it sends a new one, so your phone can show a summary when you open the app.

What the Mac sends to our server

• Pairing record. The Mac's public key, that it is a Mac, its macOS and Kidfence version, a device label (by default just "Mac", or a name chosen from the parent app), a random three-word handle, and which child in the family it belongs to as an opaque identifier. No account name, no email.
• Rule fetches. The Mac periodically fetches the rules you set from your phone, and reports back that it applied them.
• Site categorization requests. Described in the next section.
• Update checks. The Mac asks whether a newer Kidfence build is available.
• Diagnostic log (beta). Described below.

Site categorization

To decide what kind of site a web address is, gaming, streaming, gambling, adult, and so on, Kidfence first checks a built-in library of known sites. For a site it does not recognize, the Mac fetches that site's public front page itself, as an anonymous visitor with no cookies and no sign-in, so it can only see what any stranger visiting the site sees, and sends a small snippet, the page's own title and meta description, capped at about 1 KB, to our AI categorization provider so it can label the site.

This is information about the public website, not about your child. It is not your child's screen, keystrokes, session, or personal pages. It is the site's front page, not the page your child was viewing, fetched independently of your child's browsing session. The request is identified only by the Mac's device key, and it is never used to profile your child. We keep only the resulting category for that host, in a shared table keyed by host name alone so every family gets the same answer; the snippet itself is not retained, and the table records nothing about who asked.

What We Never Collect

• Screenshots or screen recordings
• Keystrokes or text input
• Photos, videos, or files
• Message content (iMessage, email, social media)
• Your child's browsing content, full URLs, or search queries (to label a site it doesn't recognize, Kidfence reads only that site's own public description, see Site categorization)
• Camera or microphone data
• Location data
• Contacts or calendar data

No VPN, no proxy, no traffic decryption

Kidfence does not route your child's traffic through a VPN or a proxy, and it cannot decrypt HTTPS. Web filtering uses Apple's Network Extension content filter, which sees the server name at the start of each connection and answers allow or block. That interface cannot read or alter encrypted content. HTTPS connections remain end-to-end encrypted between your child's browser and the website.

About the setup profile and its certificate. The setup wizard offers two paths. Quick Setup installs a Kidfence configuration profile, the same kind schools use, so Kidfence's own components are approved in one step and future versions install silently. Manual Setup installs no profile and no certificate: macOS asks you to approve each component yourself, about seven prompts, and you re-run the wizard for updates. Manual Setup is the right choice for a Mac already managed by a school or workplace, and either path gives your child the same protection.

The Quick Setup profile includes a certificate authority named "Kidfence Device Identity CA." It exists for one purpose. During setup your Mac creates its own private key and a certificate request; our server signs that request with this CA, and the Mac then uses the resulting certificate to prove its identity to our device-management server. This is the standard mechanism of Apple's device-management protocol, and the CA is used nowhere else in Kidfence. It is not a traffic-interception certificate: decrypting HTTPS would additionally require a proxy in the network path presenting forged website certificates, and Kidfence has no proxy, tunnel, or other component that terminates connections. The CA's private key never leaves our server; your Mac holds only its public certificate. Our own servers use publicly issued TLS certificates, so this CA is not used to secure any connection your devices make.

The CA certificate is restricted so that it can only sign Kidfence's own device-identity certificates. It carries a name constraint that permits no real host name or address and a key-usage restriction to client authentication, so a certificate issued by it can never validate as a website's certificate in Safari, Chrome, or Firefox, even on an enrolled Mac. Nothing in the product depends on that restriction; it removes a capability we would otherwise hold and never use.

Device management (Quick Setup only)

If you choose Quick Setup, the Mac enrolls in Kidfence's device-management server so that Kidfence's own system extensions and content filter are approved without repeated password prompts, and so they can be updated silently. Enrollment uses Apple's device-management protocol and sends our server the identifiers that protocol requires: a device identifier, the model, the macOS version, and a push token. We use it to install and update Kidfence's own configuration profile and nothing else. We do not query installed apps, location, or any other inventory, and we do not lock, wipe, or otherwise control the Mac through it. Manual Setup never enrolls, and removing the profile ends enrollment.

Diagnostic log (beta)

During the beta the Kidfence software on the Mac sends us a technical log so we can diagnose problems such as a site blocked in error or a filter that stopped responding. Every line is scrubbed on the Mac before it is sent: user folder names, email addresses, full URLs, cryptographic keys, and website names are replaced with placeholders. The log never contains URLs, page contents, search terms, open tabs, screenshots, or anything your child typed. It carries the Kidfence version and the macOS version, never the Mac's name or a hardware identifier.

Two beta exceptions you should know about. When a site is blocked, its domain name is included so we can confirm what the filter did. And the identifier of the app in the foreground, for example a browser or a game, appears in status lines so we can verify the screen-time features. We expect to narrow both before general release. Diagnostic logs are kept for 14 days and then deleted.

Part 3: What both share

End-to-End Encryption

Reports from the child's Mac to the parent's iPhone are encrypted with Curve25519 key agreement and AES-256-GCM. The keys exist only on your devices. Our server acts as a relay and cannot decrypt them. All connections to our server also use TLS, and keys are stored in the Keychain.

Data Retention

• On the iPhone: chat transcript and decrypted reports, until you delete the app.
• On the Mac: activity data, until Kidfence is uninstalled, which removes all local data.
• On our server: pairing records and rules while a device is paired; queued commands 7 days; encrypted status until replaced; diagnostic logs 14 days; setup analytics 90 days; subscription status while your family exists; the Apple ID recovery link until you ask us to remove it; site categories indefinitely, since they describe websites, not people.

Third-Party Services

• AI providers (Anthropic, Google). From the iPhone app: your commands, to turn your words into an action. From the Mac: the host name and public-page snippet described under Site categorization. Processed by large-language-model APIs, currently Anthropic (Claude) and Google (Gemini). Inputs are sent via API and are not used to train their models. Subject to Anthropic's and Google's privacy policies.
• Apple. Subscriptions are purchased in the iPhone app through the App Store and handled by StoreKit. The optional recovery link uses Sign in with Apple. Subject to Apple's privacy policy.
• Cloudflare (1.1.1.3 Family DNS), Mac only. Kidfence configures the Mac to use Cloudflare's Family DNS resolvers for network-level filtering of malware and adult content. DNS queries are resolved by Cloudflare's servers. Subject to Cloudflare's privacy policy.

Children's Privacy (COPPA)

Kidfence is a parental control tool installed and managed by parents. We do not collect personal information from children. The Mac software records only app usage and domain data, keeps it on the Mac, and sends what the parent sees to the parent's phone encrypted. Your child's name and avatar exist only on your devices, encrypted in transit; our server holds only an opaque identifier for each child.

Your Rights

Unpairing a device removes its server-side pairing record. Deleting the app removes everything stored on that device. To have the remaining server-side records for your family deleted, or to remove the optional Apple ID recovery link, email [email protected].

Changes

We will notify you of material changes to this policy in the app. Continued use after a change constitutes acceptance.

Contact

Privacy questions: [email protected]