Privacy Policy

1Who we are#

PCGuard provides the service and is the controller of your account and billing data. For anything about privacy or your data, email [email protected].

2In short#

• We collect what we need to run your account, take payment through Stripe and provide the features you use.
• In Cloud mode, the child PC sends us its status, running apps, rule results and daily totals per website domain. It never sends full web addresses, page content, search terms, keystrokes or screenshots.
• In Direct mode, monitoring data stays on the child PC and your own devices and travels over your Tailscale network. We receive only account, licence and device-count information.
• We do not sell personal data, show adverts or use analytics or advertising cookies.
• You can ask to see, correct or delete your data at any time.

3Parents, children and our role#

The account holder is a parent or guardian. They decide which child PCs to supervise and which rules to set. We process data about the child PC on the account holder's instructions, only to provide PCGuard to them. We do not use it for our own purposes, such as advertising or profiling. The Children section explains more.

4The data we collect#

Your account

• Your name and email address.
• Your password, stored only as a one-way hash, so we cannot read it.
• Sign-in tokens for the dashboard and Parent apps. They are stored as hashes, with the time they were last used, and deleted when you sign out.
• Whether the account belongs to our own staff (an administrator flag), and when the account was created and changed.

Billing

• Your Stripe customer and subscription IDs, plan, subscription status, renewal date, whether a cancellation is scheduled, and the number of extra child-PC slots.
• Records of the Stripe events we have processed (event IDs only).
• A record of your acknowledgement at checkout: the date and time, the plan and the policy version you accepted.
• You enter card details directly with Stripe. We never see or store card numbers. We give Stripe your email address and an internal account number.

Licence checks and device limits (all plans)

• When a Parent app asks for its licence, it sends a random installation ID that the app created. We do not store this ID; we place it in the signed licence we send back to that app.
• To enforce your plan's device limit, we store an ID and the name of each child PC you add. This applies in Direct mode too.

Cloud mode: data from the child PC

The browser extension reads only the domain name of the active tab. It never sends full web addresses, page titles, page content, form entries, search terms, keystrokes or screenshots, to us or anywhere else.

Direct mode

In Direct mode, rules, app lists, usage reports and commands go straight between the child PC and your Parent app over your own Tailscale network. We do not receive this data. We receive only your account, subscription and licence requests, and the IDs and names of child PCs for your device limit.

Technical data

To deliver and protect the service, our servers and Cloudflare process IP addresses and request details. For example, we limit sign-in attempts per IP address; those counters are kept for about a minute. Our database does not store IP addresses or browser details with your account or activity log. Server and network logs kept by our hosting provider and Cloudflare for security can contain IP addresses. If you open a page served directly by our API server in a browser, a standard short-lived session record, including the IP address and browser details, may be created.

When you contact us

If you email us, we keep the message and our reply so we can help you and keep a record of what was agreed.

5How we use data and our lawful bases#

We do not send marketing emails, sell data or use it for advertising. We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.

6Children#

PCGuard is for parents and guardians who supervise their own children's PCs. Account holders must be 18 or older, and children do not have PCGuard accounts. The data we process about a child is data about their PC, sent on the parent's instructions.

Parents are responsible for using PCGuard lawfully and for telling their child, in a way that suits their age, that PCGuard is installed and what it does. We design PCGuard to collect as little as possible: website domains instead of full addresses, and no content, messages or screenshots. In doing so, we take into account the principles of the ICO's Age Appropriate Design Code, such as data minimisation and transparency.

If a child, or a parent on their behalf, has a question about their data, they can email [email protected].

7Who we share data with#

We share personal data only with service providers that help us run PCGuard, and only as much as they need:

We may also disclose data if the law requires it, to protect people's safety or our rights, or to a buyer if our business is sold. We would tell you before your data became subject to a different privacy policy.

8International transfers#

Some providers may process data outside the UK and the European Economic Area, for example in the United States. When they do, we rely on appropriate safeguards, such as UK adequacy regulations, the UK International Data Transfer Agreement or Addendum, or the EU Standard Contractual Clauses. Email us for more details.

9How long we keep data#

• Account, devices, rules, commands, activity logs and website usage: kept while your account is active, and deleted within 30 days of an account deletion request.
• Running apps: we keep only the latest snapshot for each PC, and each new report replaces it.
• Pairing codes: expire after 10 minutes and cannot be reused.
• Billing records, including Stripe IDs and checkout acknowledgements: kept as long as the law requires, typically 6 years in the UK.
• Sign-in rate-limit counters: about one minute. Sign-in tokens are deleted when you sign out.
• On the child PC: local usage history is kept for up to 90 days. Cached rules and settings stay until PCGuard Child is removed.

10Data stored on your devices#

• Child PC: PCGuard Child keeps a local cache (rules, pending commands, diagnostics and usage totals) in a folder that only Windows administrators and the system can open. Its device credential is encrypted with Windows Data Protection (DPAPI).
• PCGuard Parent for Windows: your sign-in and licence are encrypted with Windows Data Protection (DPAPI) in your Windows profile. Connection details for your child PCs are kept in a local database.
• PCGuard Parent for Android: your sign-in and licence are kept in Android's encrypted secure storage, available on this device only while it is unlocked.
• Web dashboard and website: see our Cookie Policy.

11Security#

We protect data with encrypted connections (HTTPS), hashed passwords and tokens, encrypted credential storage on your devices, and access to production systems limited to the people who need it. A parent never receives a child PC's device token. No system is completely secure, so please use a strong, unique password. If we learn of a breach that puts your data at risk, we will tell you and the ICO as the law requires.

12Your rights#

Under UK GDPR you have the right to:

• access the personal data we hold about you;
• have inaccurate data corrected;
• have your data deleted;
• restrict or object to some processing, including processing based on legitimate interests;
• receive your data in a portable format; and
• withdraw consent at any time, where we rely on consent.

To use these rights, or to delete your account, email [email protected] from your account email address. It is free. We reply within one month, and we may ask you to confirm your identity first.

If you are unhappy with how we handle your data, please tell us. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk (opens in a new tab) or on 0303 123 1113.

13If you live in the European Union#

If you live in the EU or EEA, the EU General Data Protection Regulation gives you the same rights listed above, and our lawful bases are the same. You can also complain to the data protection authority in the country where you live or work.

14Cookies#

We use only strictly necessary cookies, for signing in and remembering your language. There are no analytics or advertising cookies. Our Cookie Policy has the details.

15Changes to this policy#

We will update this policy when our practices change. The date at the top shows the latest version. If a change matters to you, we will tell you by email or in the apps before it takes effect.

16Contact#

For privacy questions and requests: [email protected].