What on-device detection means

The engine runs on your Mac, Windows PC, or Android phone. It looks at what is on your screen, decides clean, suggestive, or explicit, and throws the frame away. What crosses to the internet is a heartbeat, an event, and your account. Never the picture, unless you choose to send one screenshot after a false alarm.

On this page

The engine lives on the device

On Guard installs a small engine on the device itself. On a Mac or a Windows PC it reads the screen. On Android it reads the screen through the Accessibility permission you grant, along with the browser address bar and the name of the app in use. It samples frames as you scroll and browse, and a vision model on the device classifies each one in memory, then discards it. No frame is written to disk or uploaded to be checked somewhere else. There is no cloud vision service in the loop.

What stays on your device, and what leaves it

Your device

What is on your screen

Frames are sampled as you scroll and browse.

On Guard, on your device

Classifies each frame locally, then lets it go.

A verdict

Clean, suggestive, or explicit. The frame is discarded.

Crosses the boundary

A liveness heartbeat
A detection event, with no content
Your account, settings, and billing
One screenshot, only if you send it

Never crosses it

Any other screenshot or frame
URLs or browsing history
What you were looking at

The frame stays in the dashed box unless you choose to send it. The verdict leaves without the frame.

That is the meaning of on-device. It is not a marketing phrase. It is where the work happens, and it is why the privacy claims further down are structural rather than promises.

Three verdicts

Clean. Nothing happens. This is almost everything.
Suggestive. The deliberately soft tier: sexualized but not explicit. It earns a short nudge on your screen, and nothing else.
Explicit. A gate goes up before you go further, with a way to move on. When it is a known adult site, your ally also gets one check-in text.

The tiers are not a moral ranking. They are three different actions, chosen so that the loud one fires only when the engine is confident, and the quiet one can afford to be more sensitive without bothering anyone but you.

What happens on a detection The gate, Move on, and the text, step by step.

What leaves the device, exactly

The honest line

Some things must cross to our servers, or accountability could not work. Here is the exact list, so you never have to take "on-device" on faith.

Crosses to our servers

A liveness heartbeat: when each device was last seen, and whether its engine and permissions are on. This is how "Gone quiet" is known.
A detection event when a gate fires: that it happened, with no content attached. When the gate was a known adult site, this is what sends the ally text.
Your account, ally links, settings backup, and subscription state.
Crash reports, with no screen content.
One screenshot, only if you send it after a false alarm: your whole screen at that moment, with the outline On Guard drew and the detection scores, linked to your account and deleted after 90 days.

Never crosses

Any other screenshot, frame, or pixel. Each frame is discarded after it is classified.
URLs, page titles, or browsing history.
What a detection was about: no site, app, image, or category, unless you send a mistake report or a screenshot yourself.
Anything from the suggestive tier. Nudges are on-device only.

The backend cannot unblock anything, and detection does not depend on being online or paid up. Offline, the gate and the nudge still work on your screen. The check-in text needs a connection; if the device is offline at that moment, the text may not go out.

iPhone is different

iOS does not let an app read the screen the way a Mac, a PC, or Android does, so On Guard runs no detection engine of its own on iPhone or iPad. There, On Guard works through Apple's Screen Time controls: the Safari adult-content filter, and blocking or nudging the apps you choose. The ally check-in, your account, and your settings work the same on every platform. It is the detection layer that differs, because the operating systems differ.

Install On Guard on iPhone or iPad What the iPhone setup actually turns on.

Questions

Does On Guard upload my screen to check it?

No. Frames are classified on the device and discarded. Checking never needs an upload. The only image that reaches us is a screenshot you choose to send after a false alarm. It goes to a locked store only On Guard admins can open, and it is deleted after 90 days.

Can you see what I was looking at when a gate fired?

No. The event that reaches our servers says that a gate fired on a device. It carries no site, app, image, or category, and there is no field in the system to put one in.

Does the engine work offline?

Yes. Detection, the gate, and the nudge run on the device without a connection. The check-in text needs a connection, so a gate that fires while the device is offline may not text your ally.

Which platforms have the engine?

Mac, Windows, and Android. On iPhone and iPad On Guard uses Apple's Screen Time controls instead of a detection engine of its own.

Checked September 17, 2026 against the shipping app. If something here no longer matches what you see, email team@stayonguard.app.