Privacy Policy

This Privacy Policy explains how On Guard ("we," "our," or "us") collects, uses, and protects your information when you use our digital-discipline service.

1. Information We Collect

We collect account information needed to provide the Service, such as your email address and username. We also collect limited website usage information described in Sections 8 and 9. We do not collect your screen content unless you send us a screenshot yourself (Section 2), and we do not create a personal history of the sites and apps you use.

2. Local Processing

AI content detection, blocking decisions, and personal data analysis occur entirely on your device. Frames are checked and let go. No screenshots, screen content, or browsing history are transmitted to our servers unless you choose to send a screenshot or report a blocked site, as described below. One other narrow exception is the redirect described in Section 3: when On Guard redirects you, the flagged site's host or the name of the app you were in appears in the address of the hosted block or better-choices page, and is not stored or linked to your account.

You can turn on a live view that draws what the guard detects over your own screen. It shows nothing to anyone else and stores no images.

On a Mac, you can add the On Guard browser extension. It reads the page in view: its address, its visible text, where pictures and videos sit on the screen, and search terms you type. It hands them only to the On Guard app on the same computer, and sends nothing to our servers or to anyone else. The app keeps only the latest page, in memory, for detection. To aim Move on at the right post, it also notes, inside your browser and only for the current session, how far a page scrolled, where its posts sat for the last half minute, and when you switched tabs or a page changed its address. That never leaves the browser.

The use of information received from Google APIs will adhere to the Chrome Web Store User Data Policy, including the Limited Use requirements.

On a computer, when you tap "Move on" over X, Reddit, Instagram, Facebook, YouTube or TikTok, On Guard can act on that one post for you, such as marking it not interested, through the extension or your computer's accessibility features. Nothing about the post is sent to us.

If you tap "Think this is a mistake?", the tap sends us a short report so we can review the verdict: the kind of content the guard thought it saw, how confident it was, and the app version. The report never carries the page, the app, or the image.

After that tap, a second, separate tap on "Send this screenshot" sends us that one screenshot so we can fix a false alarm. You agree to it for that one screenshot, each time. It is never a standing setting, and nothing is sent without that tap. The screenshot is your whole screen as it looked at that moment, so it can show other windows. It comes with the outline On Guard drew and the detection scores, and it is linked to your account. It goes into a locked store that only On Guard admins can open, and no email carries it. Every view in our review tool is logged, and it is deleted after 90 days. We do not keep it longer. Your ally never gets it. The report without the screenshot stays the default.

On the hosted block page, "Think this is a mistake?" sends us the site's host name, so a wrongly listed site can be removed from the list. You sign in to send it, and the report is kept with your account so the removal path cannot be abused. Nothing else is sent.

On iPhone, if you turn on Guard every app, your phone sends its web-address lookups, the name of each site an app tries to reach, to On Guard's own encrypted resolver. It answers them in memory and never logs or stores them. Known adult sites get no answer, so they do not load. Every other lookup is passed to Cloudflare's public resolver to be answered. When a known adult site is blocked, the resolver tells our servers only that a block happened and when, with a one-time code and never the site's name, so your phone can show the block notice and your allies can get their text. About every six hours it also tells our servers the phone is still using the guard, with no site or address. Turn it off in your phone's Settings at any time.

3. Android Accessibility Service

On Android, On Guard runs its defense through Android's Accessibility service. Before you enable it, the app shows a disclosure and asks for your agreement; the service stays off until you turn it on in Android Settings, and you can turn it off there at any time. Your allies will know if you do.

Through that service, On Guard takes screenshots of your screen (each checked by a detection model that runs entirely on your device), reads the web address shown in your browser's address bar (reduced to the site's host), and reads the name of the app you are using. When explicit content is detected, On Guard can act on your behalf: it redirects the browser off the site by entering a block page address or closing the tab. When you tap "Move on" on a nudge, it sends your browser to On Guard's page of better choices, or dismisses the app you are in from your recent apps and returns you to your home screen before offering that page. The block page and the better-choices page are hosted by On Guard; the flagged site's host, or the name of the app you were in, appears in those page addresses so the page can respond, and is not stored or linked to your account.

All of this happens on your device, in memory. Screen images are discarded immediately after they are checked. No screen content, screenshot, or browsing history is uploaded, stored, sold, or shared, unless you send us a screenshot yourself as described in Section 2. When a known adult site is opened on your device, your ally receives a short check-in text that names the app, the device and the time, never the site, the page or the image.

4. Data Storage

Your screen content, browsing history, and digital habits stay on your device, unless you send us a screenshot yourself. Our servers hold what the Service needs to work: your account (email, display name, a verified phone number if you add one, and, when you joined through a shared link, the name of that channel), your ally links and their verified contact details, your settings, your subscription state, a liveness heartbeat from each signed-in device (that On Guard is running, and when it was last seen), payload-free detection events (that explicit content was gated on a device, with no site, page or image), the alerts the Service sends on your behalf and whether each one was delivered, a push-notification token for each phone, the mistake reports described in Section 2, and, only when you chose to send one, that single screenshot, linked to your account and deleted after 90 days, and, only when you report a blocked site as a mistake, that site's host name. Apart from that screenshot and that report, none of it names a site, a page, or an image. There is no history of the sites and apps you use.

The texts your allies receive name the app, the device and the time. Our SMS provider, Twilio, delivers them; once Twilio confirms a text was delivered or could not be, we delete it there. Your alert log keeps the kind of alert, the app, the device, the time and whether it was delivered for 90 days, and only you can see it.

5. Data Sharing

We do not sell your personal information. We disclose limited account and service data to providers that operate On Guard, including Firebase for account services (two On Guard projects, described in Section 9), RevenueCat for subscription management, Stripe for desktop payment processing, Twilio for the opt-in accountability messages described below, and Apple and Google for delivering push notifications to phones. We also use Google for website analytics, with your consent, and Cloudflare for abuse prevention through Turnstile. These providers process information under their applicable terms and privacy policies to provide those services. We do not disclose your screen content to them, except that a screenshot you send us (Section 2) is kept in our locked store on Firebase.

6. Data Security

We implement appropriate security measures. Since most processing occurs locally, you remain responsible for the security of your device and local data.

7. Your Rights

You have the right to access, update, or delete your account information. See our data deletion page.

8. Cookies and Website Analytics

We use Google Analytics to understand website traffic and interactions, such as page views, button clicks, downloads, and account-flow events. It runs in consent mode: until you accept on the consent bar, it sets no cookies and stores nothing in your browser, and any measurement it sends is cookieless. If you accept, Google Analytics may use cookies to tell repeat visits apart. If you decline, it stays cookieless. Your choice is kept in your browser's local storage so the bar does not return on every visit.

Either way, we configure it so the page address and referrer sent with an event are limited to the website origin and path. Query strings and fragments are removed, and certain sensitive routes do not send page-view events. We do not intentionally send Google Analytics your email address, screen content, or query-string values. Google may process other information associated with an analytics request under its own privacy policy.

9. Third-Party Services

We use Cloudflare Turnstile on forms and email/password account flows to help distinguish people from automated abuse. Cloudflare is contacted only when a page displays a Turnstile challenge. When it does, Cloudflare may process information associated with that request under its own privacy policy. On Guard sends the resulting challenge token for server-side verification.

Purchases are handled through RevenueCat, our billing platform: on iPhone and Android via App Store or Google Play billing, and on the web via RevenueCat Web Billing, whose payments are processed by Stripe. The desktop app opens the branded checkout at stayonguard.app/checkout, and invited members can sign up and check out directly at stayonguard.app/join. We send RevenueCat the signed-in account identifier, selected plan, your account email address, any promo code applied, and checkout attribution; payment details are entered directly into Stripe's secure embedded form and are not received by On Guard servers. We also use Firebase Authentication for sign-in, including optional Google and Apple sign-in. These services have their own privacy policies. On Guard does not intentionally send them your screen content or browsing history.

On Guard runs on two Firebase projects. The product's own project holds your account and the data listed in Section 4. An earlier On Guard project still verifies Turnstile challenges for this website and resolves ally links that were created before the move. It receives the challenge token or the invite token for that one request, and nothing about your account or your devices.

On iPhone and Android, the app registers a push-notification token with Firebase Cloud Messaging so the Service can deliver alerts, for example an ally-related notice, or a block notice on iPhone. The token identifies the device for delivery only. Notification text never carries a site, an app, or an image. Turn notifications off for On Guard in your phone's settings at any time.

10. SMS / Text Messaging

On Guard offers an opt-in SMS accountability program. If you become an ally for an On Guard member, you may receive ally check-in text messages at the mobile number you verify. These texts tell you what happened, on which device and when, and prompt you to check in with the member. They name the app, never the site, a URL, an image or browsing history. The check-in goes out when a known adult site is opened on the member's device.

Alert texts arrive in a group text with the member and one ally, so both read the same message. Allies never share a thread with each other. The welcome and removal texts go to the ally alone.

We delete each alert at Twilio once it is delivered or fails for good. What you and the member write to each other in the group text is deleted at Twilio after 30 days, and the whole thread is deleted when the ally link ends. When you reply STOP, HELP or START, we keep a record of that reply for 4 years to show we honored it. The record holds the keyword, the time and a coded form of the number, never the message.

• Consent. You opt in by verifying your mobile number and confirming acceptance on the ally invitation page. Consent to receive texts is not a condition of any purchase.
• Message frequency. Varies, up to 8 messages a day.
• Rates. Message and data rates may apply.
• Opt out. Reply STOP to cancel or HELP for help at any time. You can also withdraw consent in the product.

We do not sell or share your mobile phone number or SMS opt-in information with third parties for marketing purposes. Phone numbers are used solely to operate the accountability messaging you opted into, and are processed by our SMS provider (Twilio) only to deliver those messages. No mobile information is shared with third parties or affiliates for their own marketing.

11. Data Retention

We retain account information only as long as necessary to provide the Service. Local data on your device is retained until you delete it or uninstall the Service.

12. Children's Privacy

The Service is not intended for users under 18. We do not knowingly collect information from children.

13. Changes

We may update this Privacy Policy. We'll notify you of material changes.

14. Contact

Questions? Reach out to team@stayonguard.app or via /contact.