VEILUNE Privacy Policy (Online Notice)

1. Who we are

VEILUNE is operated by Veil Guard Technologies, Inc. We are the only operator collecting information through VEILUNE.

You can reach us with any privacy question or complaint at privacy@veilguard.ai. This is also our complaint intake channel for privacy concerns about VEILUNE.

VEILUNE helps you set screen time rules for your child's device. You, the parent, set the rules from your parent console. Your child's device enforces them locally. This policy explains, in plain language, exactly what information we collect, how we use it, how long we keep it, and the rights you have over it.

2. What we collect from your child's device

We designed VEILUNE to collect as little as possible. Here is the complete list of what your child's device sends us:

• A pairing identifier. When you pair your child's device, the device receives a random code that links it to your family account. It is not your child's name and it contains no information about your child. We use it so that your family's daily summary reaches your console and no one else's. It can be revoked at any time, which resets the device connection.
• The device's internet address (IP address). Any device that connects to the internet shares this with the servers it talks to. We use it only to deliver the connection securely, to protect the service against abuse, and for basic operation of the service.
• A daily summary, sent once each night. From an Android device it contains only: the calendar day it covers, the minutes your child spent in each of seven activity categories (social, games, video, communication, education, creative, and other), rounded to five minute steps, the number of times a limit boundary was reached that day, the version number of the rules the device is enforcing, and a simple health status showing whether the device is protected and in sync. From an Apple device, the category minutes are absent unless and until the device's permitted monitoring provides them, so an Apple daily summary may contain only the calendar day, the count of limit boundary events, the rules version number, and the health status.
• The device platform (Android or Apple), recorded once at pairing so we know which kind of device we are serving.

Even though the daily summary contains only counts and status values, it travels together with the pairing identifier, so we treat the entire summary as your child's personal information under the law, with all of the protections and deletion rights described in this policy.

3. What we never collect from your child

The following never leave your child's device and never exist on our servers: your child's name, birthdate, contacts, messages, browsing history, web addresses, which specific apps were used, timestamps finer than the calendar day, location, photos, videos, audio, device serial numbers, advertising identifiers, and any free text your child types. Our apps contain no advertising, analytics, crash reporting, push notification, or remote configuration software. This is not a setting you have to find. It is how the product is built.

4. What we collect from you, the parent

• Your parent account information: what you need to sign in, your contact information so we can reach you and deliver notices, and the link to your billing account.
• The rules you author: daily minute limits for each category, downtime windows (which days, start and end times, and which categories they cover), a grace period setting, and a scrambled check value derived from your parent PIN. The PIN itself never leaves your device and never exists on our servers.
• The child profile you create for each protected child: the age band you select, the profile's active status, and its created date. We store it under a random profile identifier; your child's name is never part of it and never exists on our servers.
• Your consent records: proof of when you gave consent, by which method, for which collection, against which version of this notice and in which language, and any revocation. These records exist to prove that collection was lawful.

Your rules and your family's stored data are encrypted at rest with an encryption key that belongs to your family alone.

5. How we use the information

• To show you, on your parent console, your family's daily summary: minutes per category, limit events, the rules in force, and device sync health.
• To deliver your signed rules to your child's device and confirm the device is enforcing the current version.
• To operate the service securely: connection handling, abuse prevention, and rate limiting.
• To keep the legal records of your consent and your rights actions.

That is the whole list. We do not build profiles of your child, we do not advertise to your child, and we do not use your child's information to develop or market anything.

6. Persistent identifiers and internal operations

The law allows a small set of "support for internal operations" uses of persistent identifiers without separate consent, and requires us to tell you exactly where we rely on that. We rely on it only here:

• The calendar day field of the daily summary, used to attribute the counts to the right day.
• The rules version number and the sync health status, used to confirm your child's device is enforcing the current rules and to show you the device is protected.
• The device's IP address and standard connection details, used to deliver the connection securely, prevent abuse, and operate the service.
• The platform field (Android or Apple), used to serve the right kind of device.

None of these are used to profile your child, to show advertising, or to track your child across other apps or websites.

7. Disclosure practices

We do not disclose your child's personal information to third parties for any purpose that is not integral to providing VEILUNE. There is no advertising disclosure, no data sale, and no sharing for marketing, and the product is built so that such sharing has nothing to draw on.

Service providers who help us run VEILUNE, under written confidentiality and security commitments:

• Microsoft, whose Azure cloud hosts our servers and your family's encrypted data.
• Stripe, who processes parent payments. Stripe holds parent payment information only. No child personal information reaches Stripe.
• Apple and Google, as the app distribution platforms.
• A console contractor working under purpose limitation, no secondary use, deletion on instruction, and breach notice obligations.

8. Your rights as a parent

From your verified parent console you can, at any time:

• Review everything we have about your child. The complete reviewable list is: the rules currently in force (as you authored them), the count of limit events per day, the device's sync health, the version of the rules the device confirms it is enforcing, and, from Android devices, the daily category minute summaries. The reviewable list also includes the child profile you created: the age band you selected, whether the profile is active, and the date you created it, held under a random profile identifier and never under your child's name. On Apple devices the category minutes are absent unless and until the device's permitted monitoring provides them, so on that platform the reviewable set is the rules in force, the limit events, the sync health, and the rules version confirmation. Nothing else about your child exists on our servers to review.
• Delete your child's information. When you delete, we destroy your family's encryption key. From that moment, everything we have stored for your family, including every backup copy, is permanently unreadable, forever. There is no recovery and no undelete. We keep a small record that a deletion happened, containing only your account identifier and the date, and nothing about your child; that record is itself removed after 30 days. Consent records are kept separately as legal proof, as described in Section 9.
• Refuse further collection. You can revoke your consent at any time, and this is separate from your billing: revoking consent is not the same as requesting a refund. Revocation stops all collection from your child's device and all syncing to the console.
• Update your contact information and re-read the current version of this notice.

Every one of these actions is written to an audit log so it can be proven later.

On Apple devices, your console shows the rules in force, the daily count of limit events, the device's sync health, and confirmation of which rules version the device is enforcing. The seven category activity minutes are reported from Android devices; on Apple devices they are absent from the console unless and until the device's permitted monitoring provides those aggregates, because Apple's platform does not export that detail off the device by default. We never promise category minutes for an Apple protected device. Where that detail exists, it renders on your child's device itself; that is the design, the detail stays in your family's hands on the device rather than passing through our servers.

9. How long we keep information

We never keep your child's personal information indefinitely. Our full retention schedule:

• Daily summaries (category minutes, limit events, rules version, sync health): kept for a rolling 12 months. Each night, anything older than 12 months is deleted. We keep a year so you can see trends and season over season context.
• Your rules: the current version is kept while it is in force. Older, replaced versions and their signed confirmations are kept for 90 days after being replaced, to help resolve support questions, then deleted.
• Consent records: kept while your consent is active, plus 5 years after revocation or account closure, as legal proof that collection was authorized. These are the one category that survives account deletion, and only for that period.
• Parent account information: deleted 90 days after account closure. The window exists so an accidental closure can be undone. Deletion requests also go to service providers holding parent data, such as Stripe, and their completion is logged.
• The child profile you create (a random profile identifier, the age band you selected, whether the profile is active, and the date you created it, and never your child's name): kept while the profile is active. If you remove a child from your family, the profile is deleted 90 days after removal; the window exists so an accidental removal can be undone. If you delete your family's data or revoke consent entirely, the destruction of your family's encryption key makes the profile permanently unreadable immediately.
• Server operational logs, which can contain your child's device IP address and pairing identifier: deleted after 30 days. The audit log of consent and parental rights actions, which contains parent process history only: deleted after 12 months.
• Deletion records (the small record that a deletion happened): removed after 30 days. After that, a deleted family is indistinguishable from one that never existed.

If you ask us to delete while your account is active, we destroy the key immediately; we do not wait for the schedule. If your account simply lapses, the schedule above governs. Retention never affects your child's protection on the device; it governs only what data exists on our servers.

Any change to these periods requires a new version of this notice.

10. Changes to this notice

This notice is version controlled. Every version is hashed, and your consent record stores the exact version and language you were shown. When we change this notice in any meaningful way, you will be shown the new version, and material changes to what we collect or how we use it require your renewed consent before they apply to your child.

11. Contact

For any privacy question or complaint, contact us at privacy@veilguard.ai, or use the privacy section of your parent console. We are the complaint intake channel for privacy concerns about VEILUNE.

Operator contact information:

• Veil Guard Technologies, Inc.
• 8 The Green, STE B, Dover, DE 19901, United States
• +1 510-828-4407
• privacy@veilguard.ai