Privacy

The short version

Your child's messages, contacts, phone numbers, locations and browsing history are encrypted on their phone, before they travel to yours, with keys that only your phones hold. We cannot read them (except that our web filter's name server sees the names of the sites the phone looks up, as described below). Neither can anyone who steals our servers, because what is stored there is encrypted to keys the servers do not have.

A few narrow things can travel to us, and each is described below: a problem report you send, a crash report your app sends automatically, a record of each thing you agree to, and — only if you separately agree to it — your own judgments on messages the screening sent you to review.

We also see the operational metadata needed to run the relay and the name server and, if you bought a prepared device, the order record that matches a setup code to an email address. We do not sell personal information, and we do not use a child's information for behavioral advertising.

Outside companies also help run the app, and they are not covered by that encryption: Google, for notifications and location services, and Mapbox, for the map and for turning a position into a street address; and, if you use the parent app on an iPhone, Apple, for that phone's notifications, its map and its street addresses. What each one receives is under Other companies that help run the app, below.

For a child under 13, another company, Epic Games, checks that you are an adult before some features turn on. See Confirming you're an adult, for a child under 13, below.

Who we are, and who this notice is for

This notice is given by Paired Parent LLC, a Florida limited liability company, 2310 S Hwy 77, STE 110 Unit 130, Lynn Haven, FL 32444. Email: privacy@pairedparent.com. Telephone: +1 (850) 296-2667.

It is our notice to parents under 16 C.F.R. § 312.4. For a child under 13, the app also shows you a short notice before it asks you to confirm you're an adult, and links back here.

The product is offered only in the United States. A Florida beta comes first. Expanding to other states does not change the encryption model; it may change additional state notices, which we will add rather than assume.

What never reaches us

The child app and the parent app talk to each other through our server, but they seal everything before it leaves the phone. The server carries sealed packages between two phones and cannot open them. That covers:

• Message content, and the messages kept on the child's phone — unless you agree to sharing this.
• Contacts, phone numbers and who a message was with.
• Locations, and the map history on your phone.
• Browsing history relayed to you.
• Alerts, including the message excerpts inside them.
• Every setting and command you send.

This is not just a promise that we won't do it. It is a property of the encryption: the keys are generated on the phones and never leave them. Simply put — we can't see it.

What our sync server can see

Carrying sealed packages still means seeing some things about the delivery:

• A random channel number that identifies a pairing — not a name, and not a phone number.
• Which direction each package went, how big it was, and when it arrived.
• The notification token needed to wake a phone up.
• The internet address the phone connected from, the same as any website you visit.
• The child's phone model, its Android version and security update level, the version of our app, and whether Android has offered it an update, so we can test that update before your child's phone installs it.
• Which kind each of your records is — an acceptance, a certification, a sharing choice or a request to delete — but not what it says. The server needs that much to keep your acceptance when you ask it to delete everything else.
• If we set up your child's phone for an order, the code it was set up with. That code is how a purchase finds its phone, so through it the pairing can be matched to the order and the email address it was placed with.
• Whether the phone's subscription is current, and until when.
• Whether your child's phone is paired with more than one parent's phone: the server links each added parent's pairing to the first one, so it knows they belong to the same phone.
• When each phone last contacted the server, and whether the service that wakes phones up has reported that our app is no longer on your child's phone.
• The age band you gave for the child — under 13, or 13 to 17 — and, for a child under 13, where confirming you're an adult stands: asked for, email sent, confirmed or withdrawn, when, and Epic's transaction number. If the email address on an order is used, the server holds only a masked form of it, such as b•••@gmail.com, to show you where the email will go.
• If someone at your child's phone asks for a code, to release the phone or to confirm a new main parent: that it was asked for and when, a masked form of the address we emailed it to, and a scrambled (hashed) copy of the code, so it can check the code typed on the phone. It is deleted a day later.

No readable message content, no contact names, no phone numbers. But a channel number, a push token, an internet address, a size and a time are still information about you, and we protect them as such rather than calling the list empty.

Identifiers used only to run the service. Some of the items above are persistent identifiers under the children's privacy rule. We use each one only to support the internal operations of the service: the channel number, to deliver sealed packages between your phones; the notification token, to wake a phone so it collects them; the internet address, to send the reply back and to protect our servers from overload, abuse and attacks; the setup code, to match a purchase to its phone and so to the address we send your service emails to; the web filter's per-phone filter number, to apply your filter settings to that phone; the number a problem report carries for one installation of the app, to tell reports from the same installation apart; the installation identifier Google's notification service uses behind the notification token, to deliver it; and the phone's model and software versions, to test a software update before your child's phone installs it. We do not use them to contact your child, to build a profile of your child, or for advertising. That is ensured by how the system is built, not only by a promise: the channel number is random and carries no name; the server cannot open what it carries; neither app runs analytics or advertising software; and we give these identifiers to no one except the companies named below, each only to do its own part of running the service.

What our operator console can see

The internal console we use to prepare handsets and support families can show, for an order or a pairing: the email address on the order and when the handset shipped; the setup code printed for that handset; whether a pairing later used that code; subscription status and term; the reference numbers and payment history Stripe sends us; the channel number; last-contact time; device model and app versions reported for update testing; for a phone we sold you, its serial number and IMEI, read from it at our bench before it ships and used to confirm that a returned phone is the one we sent; for a phone you set up at home with Paired Parent Connect, its serial number, maker, model, Android and One UI versions, the app version installed, whether it can place calls, whether texting was left on, and which setup checks passed; the age band you gave and where confirming you're an adult stands; and problem or crash reports you have sent. When someone at your child's phone asks for a code, the console emails it to the address on the order and keeps neither the code nor a copy of the email. It cannot open sealed packages. It cannot read messages, contacts, locations, browsing history, or alerts.

What the web filter can see

If web filtering is on, your child's phone asks our name server whether each site is allowed. That server therefore sees every domain the phone looks up, against a filter identity. We deliberately do not link that identity to your pairing anywhere in our data, so the filter side of the system does not know which family it belongs to.

We would rather say this plainly than claim more than we can deliver: a name server has to see the names it is asked about.

Those lookups are kept for at most 24 hours on the server, and in most cases are deleted from the server within minutes. The monitored browsing history is archived on your phone, for five days, and nowhere else.

Our website

Our website, pairedparent.com, keeps an ordinary visitor log. For each visit it records the internet address the visit came from, the page asked for and the time, with a few technical details of the request itself, such as whether the page was found. It does not record your browser, your device or the page that sent you to us. The log is kept for at most 90 days.

The site sets no cookies and has no advertising or analytics trackers. Its fonts and images come from our own server, not from another company's.

Other companies that help run the app

Companies that receive information about your child. DigitalOcean hosts our servers, so everything our sync server, operator console, name server and website keep is stored on its computers, including the channel number, notification tokens, internet addresses, your child's phone details and the web filter's lookups. Cloudflare runs our domain names, so it sees requests for the web-filter address set on your child's phone, which contains a number unique to that phone; during an internet outage, your child's phone may also briefly connect to Cloudflare and to Quad9 to check whether the internet is working, which shows them the phone's internet address and nothing else. Backblaze stores our nightly backups, encrypted before they leave our servers with a key Backblaze does not have. Google delivers notifications, provides location services on your child's phone under that phone's own Google settings, and hosts our email and phone number, so it receives anything you write or say to us. Mapbox provides the map in the Android parent app and turns your child's position into a street address when you view it there, so it receives that exact position; Apple provides notifications and the map in the iPhone parent app and turns your child's position into a street address when you view it there, so it receives that exact position too. If you choose, on the sharing screen, to share the text of messages and let third-party providers help label it, Anthropic, an AI company, receives that text to help label it for training our screening, as described under Sharing your judgments. Anthropic is the only such provider today; we will name any other here before it receives anything. When you email us, Anthropic, an AI company, helps us write a first draft of our reply, using your message and our earlier replies in that conversation. A person at Paired Parent reads every reply before it is sent. Under the terms we use Anthropic under, it may not train its models on your email or use it for anything but providing its service to us, except as the law requires. RunPod rents us the computers we train the screening model on, so shared judgments, and shared text if you allow it, are processed on its computers while a training run lasts. Each of these companies uses the information only to provide its service to us, except Google's location services on your child's phone, which Google provides under its own terms; Mapbox and Apple, which also use map requests to run and improve their maps; and Apple, which handles the iPhone's street-address lookups under its own terms. The details of what each one receives follow.

Companies that receive only your information. Kids Web Services Ltd, part of Epic Games, receives your email address and the card or Social Security number you confirm with, to check that you are an adult. Stripe receives your payment details and addresses to take payment. Brevo receives your email address and the emails we send you. Shippo, the service we buy postage through, receives the name and address for a phone we ship you. It makes the shipping and return labels, and when you buy the phone it checks the address with the US Postal Service. The Postal Service receives the name and address on those labels.

Google services are used for Android location/geofencing and push messaging; a push only wakes a phone, and carries the notification token and the fact of a wake-up, never message text. On an iPhone, Apple's push service delivers the parent app's notifications instead: Apple receives the phone's notification token, the fact and time of each notification, a fixed text that is the same every time ("New activity. Open the app to see it.") and a number identifying which encrypted item the app should fetch, never what it says. Mapbox supplies the parent app’s map on Android; on an iPhone the map is Apple's, so Apple receives that phone's map requests, and the areas requested can reveal the location being viewed. Map requests disclose network and request information to Mapbox, and requested map areas can reveal the location being viewed; the map's software is also built to send Mapbox a license check, which carries an identifier for this installation of the app, the phone's model and its operating system version, with the time and the version of Mapbox's software. When the Android parent app looks up a street address, Mapbox also receives your child's exact position; on an iPhone, Apple does instead. Its software may also support telemetry; optional telemetry involving child information is not enabled. Unless you chose to let third-party providers help label it, no outside company sees the text you share except RunPod, whose computers we train on. Required attribution and applicable telemetry controls remain available. Device operating systems and mobile carriers separately process information under their own services.

Street addresses. When the parent app shows your child's location and it is not inside one of your saved places, the app asks Mapbox, the company that provides the map, to turn that position into a street address, so the page can show and read out where it is. That sends the exact position to Mapbox. It happens automatically each time the page shows such a position. Mapbox handles it for us under its data processing terms, and the address is shown and read out but not saved. It does not go through our servers. On an iPhone, the parent app asks Apple's map service instead, so Apple receives that exact position and handles it under Apple's own terms; there too the address is shown and read out but not saved, and it does not go through our servers.

Confirming you're an adult. For a child under 13, Epic Games' Kids Web Services, with its payment processor Stripe, receives your email address and whatever you use to confirm. What each receives, and what comes back to us, is in the next section. Location and the street-address lookup above stay off for that child until you have confirmed.

Emailing you a code. When someone at your child's phone asks for a code, to release the phone or to confirm a new main parent, we send it to the address on your account through Brevo, the email service we use. Brevo receives that address and the email, and handles them under its own terms.

Paying. When you buy a subscription or a prepared phone, you pay on a checkout page run by Stripe, our payment processor. Stripe receives your email address, your billing address, a shipping name and address, and the payment details you enter there, and handles them under its own terms. Checkout asks for a shipping address on every purchase, including one with nothing to ship; we use it only to send a phone you bought from us. If the Postal Service cannot confirm that address, we email you to check it before the phone ships. We never see your card number, and we do not copy your billing or shipping address into our own systems: if an address needs correcting, the corrected one is kept with Stripe, and we keep only whether the Postal Service confirmed it. Stripe tells us your email address, its own reference numbers for you and your subscription, what you bought, the amounts charged or refunded, and when each paid period ends. We keep those with your order records.

When the law requires it. We disclose information if the law requires it, or to protect a person from imminent harm. Because we cannot read sealed packages, a lawful demand for “the child's messages” will not produce message text from our servers. It may produce the metadata listed above, order records, consent records, and any judgments you chose to share.

We do not sell personal information as that phrase is used in state privacy statutes, and we do not share it for cross-context behavioral advertising.

Confirming you're an adult, for a child under 13

When you connect a child's phone, the app asks how old the person using it is: under 13, 13 to 17, or 18 or older. We keep only that band, never a birth date. Paired Parent is not set up for someone 18 or older; that answer disconnects the phone.

For a child under 13, US law asks us to check that the parent setting up supervision is an adult. We use Kids Web Services, a service of Kids Web Services Ltd, part of Epic Games, to do it:

• We pass Kids Web Services an email address, and it emails you a link. It is the address on your order if you choose that, or one you type. A typed address is sealed on your phone so that our sync server cannot read it; only our operator console opens it, to hand it to Kids Web Services, and the sealed copy is deleted from the sync server once the email is sent, or within 24 hours if it cannot be.
• You confirm with a credit or debit card — a 5-cent charge, made through Epic's payment processor, Stripe, and refunded — or with your Social Security number, which Kids Web Services checks against a national database. We never see your card or your number.
• Epic keeps a scrambled (hashed) copy of your email address in its AgeGraph, so that if you have already confirmed for another product that uses Kids Web Services you may be recognized without doing it again. Epic handles all of this under its own terms and privacy policy.
• What comes back to us is that you are confirmed, and Epic's transaction number. Epic's notice to our server also contains your email address; the server checks the notice is genuine and discards the address without writing it anywhere.

Until you confirm, for that child: web filtering, Location and Places stay off, so the child's phone does not use our name server and nobody asks where it is; problem reports wait on your phone, for at most 60 days before they are deleted unsent, and your judgments on alerts are not sent to us; and the child's phone keeps its own diagnostic and crash reports to itself. Everything else works as usual. Confirming is up to you, and you can do it later from the app.

You can withdraw it in the parent app under Advanced, Parent verification. Withdrawing works exactly like never confirming: those features turn off again, and nothing is deleted. For a child aged 13 to 17 none of this applies.

Children's information, and your rights as a parent

Paired Parent is a service for parents. It is not directed at children acting on their own: pairing is done by a parent, who certifies that they are the child's parent or guardian. Information about a child is collected because you set the product up to supervise that child's device.

Accepting the terms and this policy is the contract signature, and the guardianship certification is your authorization. Neither is verifiable parental consent under 16 C.F.R. § 312.5. For a child under 13, that consent is the separate step described under Confirming you're an adult, above.

You may review what we hold about your child, refuse further collection, or ask us to delete what we hold, at any time: write to privacy@pairedparent.com or call +1 (850) 296-2667. Withdrawing your confirmation in the app, declining to share judgments, or releasing the phone stops the collection each one covers, at once. We respond within 45 days. We cannot delete the message archive on the child's phone, which we cannot see, and we can find a judgment you shared only by the receipt your phone kept for it; both are explained below. For the same reason we cannot show you a judgment you shared: nothing on our side says which ones are yours, but Delete My Data can delete them.

What can reach us

Problem and crash reports never include your child's messages, contacts, phone numbers or location. They carry version numbers, your phone's make and model, settings, timings and diagnostic detail. All of these are encrypted to a key of ours. Our servers hold its private half only locked to a passkey on the operator's own device, and it is unlocked only in that device's memory, to read a report.

Sharing your judgments, if you choose to

Sharing is a separate permission from using Paired Parent. It is off unless you turn it on, it is not needed for the service, and saying no changes nothing about it. The app asks as the last step of setup, and again if this choice's wording ever changes or after you use Delete My Data. Nothing is selected when it asks, and nothing is saved until you have read the whole agreement to its end, chosen an option, checked the confirmation and saved.

What it is for. We use what you share only to test and train Paired Parent's message-screening model, which is built into the app on every family's phone. The model does not contain your messages, but what it learned from them cannot be taken back out.

What is shared. With numbers only: whether you agreed with an alert, the category, score and severity the screening gave, whether the message was sent or received, its length, which model and settings decided it, and the day you judged it. With text, also the words of messages your child sent that you judge or mark as missed, with phone numbers and email addresses removed on your phone first. The words of a message your child received are never shared, because the person who wrote it has not agreed to this.

A shared judgment carries no name field, no device, no pairing, no app version, and only the day it was made, not the time. That is de-identified, not anonymous, and we would rather tell you than reassure you. Names, places and schools in a message are not removed on your phone, so a message can still point to somebody. We do not try to work out who a submission came from, and the design gives us nothing to work from.

Who sees it. People at Paired Parent who work on the screening, and the computers we own or rent to train it (RunPod rents us the training computers). Third-party providers that work for us, such as artificial intelligence and machine learning services, help label shared text only if you chose that answer on the sharing screen, which is a separate answer from sharing text labelled only by us, and only after we remove the names, places and numbers we can find; that removal can miss things too. Today that is Anthropic, an AI company, and we will name any other here before it receives anything. Under the terms we use them under, they may not train their own models on it or use it for anything but providing their service to us, except as the law requires.

A child under 13. Nothing about a child under 13 is shared until a parent has confirmed they are an adult (see “Confirming you're an adult”), and this permission is separate from the one you gave to use Paired Parent.

Changing your mind. You can change or withdraw the choice at any time in the app's sharing settings, which stops all further sharing at once; what you already shared stays, with the choices it was shared under, until you delete it or it reaches 24 months. Each judgment is sent with a random receipt number that only your phone keeps; nothing else in it says it was yours. Delete My Data sends those receipts back, and we delete what that phone shared from our server at once, and from our own working copy the next time we collect from the server. Asking shows our server, while it handles the request, which shares were yours; it does not write that down, but our encrypted backups from before the request could still link them to your pairing until those backups are deleted, at most 90 days later. We cannot find a judgment shared before this version of the app; from a phone that has since been reset or replaced; after the last child phone has been removed or released, when the app can no longer ask; or beyond the most recent 4,000 from one phone. It is still deleted at most 24 months after we receive it. A model already trained on what you shared does not unlearn it.

The record of your consent

The record of what you chose, when, and the exact wording you agreed to is tied to your account and device, like the other records listed above, and it is kept. A consent that cannot be shown demonstrates nothing, and that record is what lets either of us say what was agreed.

It is kept even if you decline, and it shares no identifier with the pool of judgments — nothing there says which submissions are yours.

It is kept until five years after your service with us ends, and asking us to delete what we hold about your family does not remove it before then. Deleting the proof of what you permitted, while the sharing it covers may still be relied on, would defeat the reason it exists. The request to delete is itself kept, for the same reason and for the same time.

How long things are kept

Where a row counts from the end of your service, your service ends on the day it is canceled, or at the end of the period you had already paid for, if that is later. Until then, those records are kept.

Our servers are backed up every night, and the backups are encrypted. Anything deleted — when its time above runs out, by Delete My Data, or at your request — can remain in those backups for up to 90 days, until those backups are deleted.

Deleting your data

• Delete permanently, under Removed children in the parent app's Advanced settings, removes everything your phone kept for a removed child.
• Remove or Release deletes the pairing from our server, with what it needed to run: sealed packages still waiting to be delivered, the child's phone software details and its subscription status. Problem and crash reports that name the pairing are not deleted with it — they expire on the schedule above, or use Delete My Data first. A released phone keeps its own message archive, for the person then holding it.
• Delete My Data, in the parent app under Advanced settings, deletes every problem and crash report your phones have sent us, and every judgment this phone shared that it still holds the receipt for. It works on the spot and needs no email: the app is already signed in as your pairing, so it can ask on your behalf. That is also why it has to be used before you remove or release.
• What we keep, on purpose, is the record of what you agreed to — that you accepted these documents, that you certified you are the child's parent or guardian, the age band you gave, that you agreed to confirm you're an adult or withdrew, and when it was confirmed, what you chose about sharing, and that you asked us to delete. Those are the proof of the permissions everything else was collected under. Deleting them would leave us holding data with no record of your having allowed it, which helps nobody. They are kept until five years after your service ends, as the table above says.
• You can also write to privacy@pairedparent.com with anything the app cannot do for you.
• A shared judgment without its receipt is beyond reach, for the reason given above: nothing else in it says it was yours. That is the trade the sharing screen states, and it is why shared judgments have a time limit of their own as well.

The messages on your child's phone are a special case, and the honest answer is blunt. They are kept twelve months and then deleted automatically. As the phone's texting app, Paired Parent also keeps each text in Android's own message store, as every texting app must; that copy is protected by the phone's own encryption rather than ours, and it is deleted on the same twelve-month schedule while Paired Parent supervises the phone. Once the phone is released, that store is the holder's own texting history, and we leave it alone. You cannot shorten that period, and we cannot reach that archive to delete it for you — it is encrypted on a phone we have no access to, which is the same property that stops anyone else reading it. A subscription that ends does not delete it. Ending supervision with Release hands the phone and its archive back to the person holding it; otherwise, destroying the archive outright means a factory reset. Clearing the app's data and uninstalling it are deliberately blocked, because on this phone both would take the pairing and the keys with them.

Security and breach notice

Keys are generated on the phones and do not leave them. Problem and crash reports are encrypted to a key of ours whose private half our servers hold only locked to a passkey on the operator's own device; it is unlocked only in that device's memory, to read a report. Access to the operator console is limited to people who prepare handsets or answer support mail.

If we discover unauthorized access to personal information we hold, we will notify affected parents and, where Florida's Information Protection Act or another applicable statute requires it, the Attorney General, in the time that statute sets.

If this policy changes

If a change would alter what is collected or shared, the app asks you to make the choice again, and sharing pauses until you answer — nothing new is shared under wording you have not seen. Your previous agreement covers the wording you actually agreed to, and nothing else.

Contact

Questions, or a request to review or delete what we hold: privacy@pairedparent.com · +1 (850) 296-2667
Paired Parent LLC, 2310 S Hwy 77, STE 110 Unit 130, Lynn Haven, FL 32444