Privacy policy
Last updated 10 November 2026
What you record in VisionShield stays on your phone, encrypted. Nothing is sent anywhere unless you add an ally or ask for an AI reflection, and then only what this page lists. There are no accounts, ads, analytics or trackers, and we never sell data.
Who we are
VisionShield is made by Xenova in Brisbane, Australia (“we”). We handle personal information under the Australian Privacy Act 1988 and the Australian Privacy Principles. You can reach us through the support page.
What stays on your phone
Your check-ins, urges, slips, reflections, plans, your reason for quitting, the hours you said are hardest, your settings and a short history of protection changes (stored as codes, such as “filter switched off”, never what you were doing).
All of it is kept in an encrypted database (SQLCipher, AES-256). The key is random, made on your phone, kept in the iPhone Keychain or Android Keystore as device-only, and never included in backups. We never receive any of it, and we can’t read it.
Blocking and filtering
To block adult sites, your phone uses CleanBrowsing’s family filter for DNS. Like any DNS service, CleanBrowsing sees the names of sites your phone looks up and your IP address, under its own privacy policy. It never sees pages or anything you write. VisionShield itself never sees your browsing and never reads, records or decrypts your internet traffic.
On iPhone, Apple’s Screen Time keeps the list of apps you choose to pause private to your phone; VisionShield can’t see which apps they are.
On Android, guard mode uses an accessibility service only to notice which app is opening, so it can close an app you chose to pause at hard hours. It doesn’t read what’s on screen, and nothing it sees leaves the phone.
If you add an ally
To share with an ally, your phone registers with our server (Supabase, hosted in Sydney, Australia). There is no account: the phone makes a random secret, keeps it in the Keychain or Keystore, and the server stores only a one-way fingerprint of it. The server then keeps:
| What | Why | Kept for |
|---|---|---|
| The name you choose to show | So your ally knows the page is about you | While sharing lasts |
| Protection’s level (on, a gap, off) and since when | The main thing your ally sees | While sharing lasts |
| When the app last checked in | To tell your ally if your phone goes quiet for two days | While sharing lasts |
| Weekly counts: urges, urges ridden out, days checked in, and slips only if you share them | Your ally’s weekly view | 12 weeks |
| Alerts, as codes and dates, such as “asked to turn protection off” | So your ally hears in time to talk | 90 days |
| If you lock protection on: until when, and when you asked to end it early | So your ally can see it, and let you out sooner if you ask | Until the lock ends |
| Your ally’s browser notification address | To send them notifications, if they turn them on | Until sharing ends |
| Your IP address, inside a counter | To stop abuse with rate limits | Up to 2 days |
If your phone doesn’t check in for 90 days, everything above is deleted. Your ally’s page is hosted on Vercel. The private part of the link (after the #) is never sent to Vercel or to anyone else; the page sends it only to our server, which keeps only its fingerprint. Notifications travel through your ally’s browser push service (from Apple, Google or Mozilla), encrypted so that service can’t read them.
If you ask for an AI reflection
AI reflections are off until you switch them on, and nothing is sent until you tap to ask. Then only that reflection’s words and the tags you chose are sent, through our server, to Anthropic’s Claude model, which replies with one pattern and one plan. Our server doesn’t keep the words or the reply. Anthropic processes them under its commercial terms, doesn’t use them to train its models, and may keep them for a limited time to check for misuse. If what you wrote mentions hurting yourself, nothing is sent at all.
To limit use to 10 a day, the request carries your phone’s random identity, so if you also have an ally, our server could in principle link the two. It doesn’t record that it happened beyond a daily counter.
The roadmap page
The roadmap loads its cards from our server. To count one vote per browser, the page makes a random code and keeps it in your browser’s storage; our server stores only a one-way fingerprint of it, next to the cards you voted for, until the card is removed. Clearing your browser’s site data forgets it.
A suggestion is stored with its words and the time, and nothing else: no name, email or code. Someone reads it before it can appear on the page, and it may be edited, declined or deleted. To stop spam, a one-way fingerprint of your IP address is kept inside a counter for up to 2 days.
What we never do
- No accounts, email addresses or phone numbers
- No advertising, analytics, tracking pixels or third-party SDKs that collect data
- No selling or sharing data for marketing
- No reading, recording or decrypting your internet traffic
Service providers
- Supabase, in Sydney: our database and server, only if you add an ally, use AI reflections or use the roadmap page
- Vercel: hosts this site and your ally’s page. The site doesn’t use cookies or analytics; the roadmap page keeps only the vote code above. Its photos come from Unsplash, fetched and resized by Vercel, so your browser never contacts Unsplash.
- Anthropic, in the United States: AI reflections, only when you ask
- CleanBrowsing: the DNS filter that blocks adult sites
- Apple and Google: app stores, Screen Time, and browser notifications for allies
Some of these providers may process data outside Australia, under their own safeguards.
Your choices
- Delete everything: in the app, You, then Privacy and data. This deletes every record on the phone and the key that encrypts them, and the server’s copy if you have an ally. Your chosen name and a single “sharing ended” note are kept for 30 days so your ally’s page can say sharing ended, then deleted.
- End sharing with your ally at any time. Like every change that weakens protection, it takes a day.
- Turn AI reflections off at any time.
- Access or correction: you can ask what we hold about you. Because there are no accounts, we may need your help to find it, for example from the app.
If you’re unhappy with how we’ve handled your information, contact us first. You can also complain to the Office of the Australian Information Commissioner.
Age
VisionShield is for adults aged 18 and over. We don’t knowingly collect information from anyone younger.
Changes
If this policy changes in a way that matters, we’ll say so in the app before it takes effect. The date at the top shows when it last changed.