The short version
- Seraph checks your child's screen on their phone. Screenshots never leave your child's device, and no child content is stored on our servers.
- Alert emails tell you only three things: the kind of concern, the app, and the time. No pictures, no message text, no child's name.
- From you, we need your email address, an age band for your child (not a name or birthdate) and a subscription through Apple or Google. That is about it.
- Pictures that Seraph keeps on the phone are encrypted. Pictures and quoted lines delete themselves after 7 days, and you can delete them any time.
- No ads. We never sell personal information. There are no tracking or advertising kits in the app.
- Seraph can miss things and can be wrong. It helps you. It doesn't replace you.
1. Who we are and what this policy covers
Seraph is made by Sanvito Technologies Inc., a Canadian company at 21 King St W, Hamilton ON L8P 4W7, Canada. In this policy, "we" and "us" mean Sanvito Technologies Inc. "You" means the parent or legal guardian who installs Seraph.
This policy covers the Seraph app for iPhone and Android, the website seraph.kids, and the emails we send you (alerts and verification codes). It explains what information is handled, where it goes, how long it is kept, and the choices you have.
2. How Seraph works with your child's information
You install Seraph on your child's phone. While protection is on, software running on that phone looks at what is on the screen for signs of nudity, graphic violence, grooming, bullying, a photo being sent to a stranger, risky accounts or pages, an unknown person asking questions, and signs that your child may be hurting.
All of that checking happens on the phone itself. Screen pictures and chat text are not uploaded anywhere for analysis. Screenshots never leave your child's device. No child content is stored on our servers.
On Android, Seraph skips capture in banking, payment, health, password-manager, authenticator and exam-proctoring apps (a starter list we add to), respects apps that mark their screens as secure, and never reads password fields or the keyboard. Your child always sees that Seraph is on. Android shows a persistent "Seraph is on" notification and iPhone shows the system screen-recording indicator. There is no hidden mode.
3. Information you give Seraph during setup
Most of this stays on your child's phone. Section 5 says exactly what reaches our server.
- Email address. You enter it during setup and confirm it with a code we email you. It is where alerts go. The address is kept inside a signed token on your child's phone. Our server reads it from that token each time it sends you an alert and does not keep a copy of the address. The only trace it keeps is a one-way hash used to limit how many verification codes go out in a day, erased at the end of that day (see section 5).
- Phone number (optional). If you add one, the pause screen shows a "Call my grown-up" button that dials it. It stays on the phone. Text-message alerts are not offered at launch.
- Parent PIN. The 4-digit PIN you choose stays on your child's phone in hashed form. It is never sent to us, which is why we cannot reset it for you.
- Child's age band. You pick Under 9, 9 to 12, or 13 to 17. It sets how strict Seraph is. No name, no birthdate.
- Trusted contacts (optional). You can list the names of people your child talks to. Those names stay on the phone and change how Seraph reacts to chats with them.
- Subscription status. You buy the plan through the Apple App Store or Google Play. We learn only whether this phone has an active plan and when it ends. We never see your card number.
- Device attestation. When it first registers (and again if it has to re-register, for example after a reinstall), the phone proves through Apple App Attest or Google Play Integrity that it is running the genuine Seraph app. We keep that record and the phone's public key so we can tell real installs from fakes.
4. Information that stays on the child's phone
When Seraph flags something, it keeps a small record on the phone so you can see why after entering your PIN:
- Events: the category, the app, and the time.
- Pictures: only for graphic violence and chat events. Frames that may show nudity, or a photo being sent, are never written to disk, not even blurred. Zero pixels. The report simply says "No picture saved. Images like this are never kept."
- Quoted lines: for chat events, up to 4 flagged lines. Never whole conversations.
Saved pictures are encrypted (AES-GCM) with a key kept in the phone's protected key store (Android Keystore or the iPhone Keychain). They are shown only in the Parent area after you enter your PIN. This storage is excluded from device backups, so it is not copied to iCloud or Google backups. Quoted lines are kept in the app's private storage behind your PIN. Pictures and quoted lines are deleted after 7 days. Event records are deleted after 30 days. You can also delete every saved picture and quoted line at any time in Parent, then Settings, then Delete saved pictures.
5. What leaves the phone and where it goes
A few kinds of requests go from your child's phone to our small server, which runs on Cloudflare:
- Setup and deletion. At setup the phone registers its device key and attestation record. When you delete the account, the phone asks our server to erase that phone's account data.
- Alert emails. When Seraph pauses the phone, sends a heads-up, sees signs of self-harm, or is turned off, it asks our server to email you. Each alert carries only the category, the app name, and the time. No image, no chat text, no child's name, no links. Every alert email says: "To protect your child's privacy this message has no images and no message text. Details stay on their device: open Seraph on their phone and enter your parent PIN to review." Our server passes the alert through in memory and does not keep it. Test locks message nobody.
- The plan check. The phone confirms that it is a genuine install with an active subscription.
- Email verification. When you set or change your alert email, our server sends a code to that address.
What our server stores
- Per phone: its public device key, the attestation record, a random install id with the dates it joined, a one-way account id (a hash of that install id, with no name and no email), recent one-time challenge values, counters for registrations, account deletions and plan re-checks, the cached subscription status, and daily usage counters for the last 31 days (numbers only).
- Per verified email address: a one-way hash of the address with that day's code sends and failed code checks, erased when the day ends (UTC).
What our server never stores
- Chat text, screen text, app names or images.
- Your email address or phone number (the address lives in the signed token on the phone).
- Verification codes.
- Request bodies, headers, tokens or IP addresses in logs. The only log line is the route, the status, how long it took, and an error code.
6. The website
The seraph.kids website sets no cookies and uses no analytics. Like most websites, our web host and Cloudflare, which sits in front of the site, keep ordinary server logs (your IP address, the page requested and the time) to keep the site running and secure. The site loads its font files from Google Fonts, so Google receives your browser's request for those files.
7. Children's privacy (COPPA)
Seraph is a tool for parents. Your child is never asked for any personal information, and we do not create accounts for children. The only information about your child that reaches our server is what an alert carries: the kind of concern, the app name and the time. It passes through in memory to reach your email and is not stored. We handle it only with your consent as the child's parent or legal guardian, and only to alert you. The checking of your child's screen happens on their phone, and what Seraph keeps there is behind your PIN.
You, as the parent or legal guardian, consent to Seraph's use on your child's phone when you set it up, attest that you are the child's parent or guardian, and buy the plan. You can review everything Seraph kept on the phone in the Parent area, delete saved pictures at any time, and delete the account (see section 13). If you believe we have received personal information from a child in a way this policy does not describe, email [email protected]. We will look into it and delete it.
8. Canada (PIPEDA) and other laws
We use personal information only to send you alerts, confirm your email, confirm that a phone has a paid plan, keep the service secure, and answer your emails. We rely on your consent, given during setup. You can withdraw it by deleting the account and cancelling the subscription.
The person responsible for our privacy practices answers questions, access and correction requests, and complaints. Email [email protected] with "Privacy" in the subject, or write to the address in section 15. Our server keeps no name and no email address, so we cannot look up a record by who you are. What it holds about a phone is a device key, an attestation record, an anonymous account id, a cached subscription status and usage counts (see section 5). Everything else Seraph holds about you and your child is on the phone, where you can see and delete it in the Parent area. If you are not satisfied with our answer, you may complain to the Office of the Privacy Commissioner of Canada.
Our service providers may process information in the United States and other countries where they operate. While it is there, it is subject to the laws of those places, and their courts, governments and law enforcement may be able to reach it.
For residents of US states with privacy laws: we do not sell personal information, and we do not share it for targeted advertising.
9. Service providers we use
| Provider | What it does |
|---|---|
| Apple App Store / Google Play | Sell the subscription, handle payment and refunds, and provide App Attest / Play Integrity so we can confirm a genuine install. |
| RevenueCat | Tells our server whether a phone's subscription is active. It receives the store receipt and the phone's anonymous account id, not your name or email. |
| Cloudflare | Hosts our server and sits in front of this website. |
| Resend | Delivers alert and verification emails to your address. |
| Google Fonts | Serves the font files for this website only. The app ships its own copy of the font and does not contact Google Fonts. |
RevenueCat, Cloudflare and Resend act as our service providers: they handle the information only to provide their service to us. Apple and Google handle your purchase under their own privacy policies.
The app also contains an optional "second check for chats" that would send up to 12 flagged chat lines (never pictures), with names, contact details, addresses and links replaced and no child or account identifier, to an outside text-classification provider. It is not available at launch. If it is ever added, this policy will say so, it will name the provider, and it will be a separate choice you turn on yourself in the app. It is never on by default.
10. No ads, no selling, no tracking
Seraph shows no ads. We never sell personal information. The app contains no third-party analytics, advertising or session-replay kits. Seraph does not do face recognition and never computes or stores face templates.
11. Security
On the phone, saved pictures are encrypted with a key in the phone's protected key store and are shown only after your PIN, quoted lines are kept in the app's private storage behind your PIN, and the PIN is stored only as a hash. Five wrong PIN entries make the PIN pad wait, starting at one minute and doubling up to an hour. Our server only talks to phones that proved, through Apple or Google, that they run the genuine app, and every later request is signed with a key locked in the phone's hardware.
No system is perfectly secure. If we learn of a problem that affects your information, we will post a notice on this page and do what the law requires, including telling the authorities where that is required.
12. How long things are kept
| What | Where | How long |
|---|---|---|
| Saved pictures (graphic violence and chat events only) | Child's phone, encrypted | 7 days, or until you tap Delete saved pictures |
| Quoted chat lines | Child's phone, behind your PIN | 7 days, or until you tap Delete saved pictures |
| Event records (category, app, time) | Child's phone | 30 days |
| Nudity and photo-sending frames | Nowhere | Never saved |
| Parent PIN (hashed), email token, phone number, age band, trusted contact names, settings | Child's phone | Until you remove the app from the phone. Deleting the account erases our server record, not what is on the phone. |
| Alert content passing through our server | Our server, in memory | Seconds, then gone |
| Cached subscription status | Our server | Until you delete the account |
| Device key, attestation record, account id | Our server | While the phone stays registered. Deleting the account does not remove the registration; a reinstall registers as a new phone. |
| Daily usage counters (numbers only) | Our server | 31 days |
| Hashed email address with the day's code counts | Our server | Until the end of the day (UTC) |
| Subscription record | RevenueCat and the store | Kept while any subscription on it is active, including a cancelled one until it expires. Erased when you tap Delete account after that. Apple and Google keep their own purchase records under their own privacy policies. |
| Emails you send to support | Our mailbox | As long as we need them to answer you and handle any follow-up |
13. Your choices
- Change your alert email in Parent, then Settings, then Alerts. A new address is confirmed with a code.
- Pause protection for 15 minutes or 1 hour from the Parent home screen.
- Delete saved pictures at any time in Parent, then Settings, then Delete saved pictures. This removes every saved picture and quoted line.
- Delete the account in Parent, then Settings, then Plan, then Delete account. This erases this phone's account data and cached subscription status on our server. The phone's registration (its device key and attestation record) stays so it can subscribe again. Anonymous daily usage totals remain until they leave the 31-day window. Your customer record at RevenueCat is erased only if no subscription is active when you tap Delete account. A cancelled subscription counts as active until it expires. If you delete while it is still running, RevenueCat keeps the purchase record; keep Seraph installed until it expires, then tap Delete account again to erase it. It does not erase what Seraph keeps on the phone: delete saved pictures first if you want to, then remove the app.
- Cancel the subscription in the store. Deleting the account does not cancel it. iPhone: Settings, your name, Subscriptions. Android: Google Play, Payments & subscriptions, Subscriptions.
- Email us at [email protected] with any question or request. If you email us, we receive your email address and what you write, and we keep that correspondence so we can answer you and handle any follow-up. Please never email screenshots or pictures to support. We do not open them.
14. Other people's messages
Chats on your child's phone include messages written by other people. Seraph reads those messages on the phone, the same way it reads everything else on the screen, and nothing about them is uploaded. Reports show flagged lines only, never whole conversations.
Some places require the consent of everyone in a conversation before it is recorded or reviewed. You are responsible for knowing and following the laws where you and your child live, and for using Seraph in good faith, only on your own child's phone, for your child's safety.
15. Changes to this policy and how to contact us
If we change this policy, we will update the date at the top of this page. If a change affects what leaves the phone or who we share information with, we will say so clearly at the top of this page before it takes effect. Please see our Terms of Use and Support pages too.
Sanvito Technologies Inc.
21 King St W
Hamilton ON L8P 4W7
Canada
[email protected]