How SafeCircle protects families, and what it does not do
The most sensitive part of SafeCircle, the content of a child’s messages, stays on the child’s phone. This page explains what leaves the device, how accounts and data are protected, and where our limits are.
- Sent to parent
- Category and a one-sentence reason
- Message text
- Stayed on the phone
- Sent to SafeCircle
- The short alert only, over an encrypted connection
What a parent sees
This is a sample. A parent sees the level, the category and the reason. The alert does not contain the messages.
- Reads the on-screen conversation
- Horizon classifies it on the device
Message text stays here
Grooming
An adult account asked your child to move the chat to a private app and keep it secret.
Suggested next step. Stay calm and talk to your child without blame. Keep the account details and report the profile to the platform.
Never sent: the conversation, the contact’s name, photos.
A demonstration with invented messages. Real alerts look like this, and no message text is ever sent.
What leaves the device, and what never does
The child app reads and classifies messages on the child’s Android phone, with a built-in keyword scan or the optional Horizon AI model. Only a short alert can leave it.
| Information | On the child’s phone | Sent to SafeCircle |
|---|---|---|
| The text of messages and chats | Read and classified on the phone (keyword scan or optional Horizon AI model) | Never sent |
| The alert: risk level, category and a one-sentence reason | Created on the phone | Yes, over an encrypted connection |
| The name of the app where the risky chat was seen | Known on the phone | Yes, as part of the alert |
Encryption and access
- 01
Encrypted in transit
The Android apps, the web dashboard and our servers talk over encrypted connections (HTTPS).
- 02
Limited access in schools
School accounts have roles. Owners and admins decide what each role can do, including who can see alerts, analytics, staff and the audit log.
- 03
Audit log for schools
Changes to school roles, policies and student records are written to an audit log that admins can review.
Accounts
- 01
Passkeys
Sign in with a passkey, so there is no password to type into a fake site.
- 02
Two-factor authentication
A second step at sign-in. Schools can require it for staff.
- 03
Active sessions
See the devices and browsers signed in to your account, and end any session you do not recognise. Changing your password ends the other sessions.
- 04
Device-bound sessions (rolling out)
On the web dashboard in Chrome, a session can be bound to the browser that signed in, so a copied session cookie is not enough. This is being rolled out. For now mismatches are logged and not yet blocked.
- 05
Bot and app checks
Sign-up and sign-in are protected by a bot check (Cloudflare Turnstile). Android builds also check that the app is genuine (Google Play Integrity).
Data retention
Your data is kept while your account is active. If a paid plan ends and the family is over the free limits, monitoring keeps running for seven days, then stops.
Three months after the subscription ended, we plan to delete the family’s data:
- the children, their devices, alerts, pairing codes and notification settings for each child,
- the photos uploaded for each child, removed from storage,
- your login account stays, so you can return and start again.
You get notices 30 and 7 days before. The notices never contain a child’s name. Paying, or removing children and devices until you are back within the free limits, cancels the deletion.
Deletion is not switched on yet. We are confirming the period and the scope of deletion with a lawyer, and we will publish the final rules before it runs. Deleted data cannot be restored. School data is handled under the school agreement and its data processing agreement, not these family rules.
Privacy by design
- 01
Designed with GDPR principles in mind
Our design follows the principles of the GDPR: collect only what the alert needs, use it only for that purpose, and keep it only as long as needed. This is a design approach. It is not a certification, and we hold no certifications.
- 02
No selling, no ads
We do not sell data and we do not show ads.
- 03
Read the policy
The privacy policy explains what we collect, why, and the rights you have over your data.
Open source and inspectable
Not everything is open yet. The Android apps, the dashboard and the backend are private repositories. We publish what we can, and we say what we have not published.
- 01
Orbit on GitHub
Orbit, the browser for families and schools, is a public open-source project on GitHub.
- 02
Models you can inspect
The Horizon and Vigil model weights are published on Hugging Face, so researchers can download and test them.
- 03
Public documentation
Our documentation is public, in English and Spanish, and covers how the platform works.
Infrastructure we use
Providers that process data for us, listed as the infrastructure we use today.
| Provider | What it does for SafeCircle | Where it is used |
|---|---|---|
| Cloudflare | Hosts our servers (Workers), stores media (R2), connects to the database (Hyperdrive), sends email, and runs bot checks (Turnstile) | Backend |
| Neon | PostgreSQL database | Backend |
| Google Firebase Cloud Messaging | Push notifications to the parent app | Parent Android app |
| Google Play Integrity | Checks that a sign-up comes from a genuine Android app | Android apps |
| Stripe | Web subscription payments, once billing starts | Billing |
| Google Play and RevenueCat | Android subscriptions, once billing starts | Billing |
Responsible disclosure
If you find a security problem, please tell us privately. Do not post details in a public issue, forum or social media post.
- Orbit: use the private reporting form in the Orbit security policy on GitHub.
- Apps, dashboard and servers: send us a message through Contact and mark it as a security report.
- Do not test on other families’ accounts or children’s devices, and do not include a child’s personal data in your report.
We will acknowledge your report and keep you updated while we work on a fix.
Warning
The limits, stated plainly
Horizon can miss risks, and it can flag harmless conversations. On chats like the ones it was trained on, it catches about 94% of risky conversations with the right category. On text written by models it never saw, that drops to roughly 63 to 68%, and about 10% of its answers are malformed on unfamiliar chats. Vigil is a research preview tested only on synthetic chats and is not in the app. An alert is a prompt to look, not a verdict, and it does not replace talking with your child.
Trust questions
Can SafeCircle read my child’s messages?
No. The child app reads and classifies the text on the child’s phone (keyword scan, or the optional Horizon AI model). Only a short alert (risk level, category and one-sentence reason) is sent to us. The message text is never sent.
Do you sell or share children’s data?
No. We do not sell data and we do not show ads. The details are in the privacy policy.
Are you certified?
We have no certifications, such as ISO 27001 or SOC 2. We design with GDPR principles in mind, and we are not claiming a certificate.
Can I protect my account?
Yes, passkeys and two-factor authentication are available, and you can review and end active sessions in the dashboard. Schools can also require two-factor for staff.
What happens to my data if I stop using SafeCircle?
Deletion of family data after three months is designed but not switched on, and it is not live yet. Before it runs, you will get notices 30 and 7 days ahead. See Data retention above.
Still have a question?
Questions about security, privacy or how alerts work? Send a message and a person will reply.
If your child is in dangerGet help now