Privacy policy
The short version.
- Dragonlock is for parents. You set it up on your phone, and your child's phone joins your family.
- Your family's quests, photos and settings live on your two phones and in your own iCloud. We (the people who make Dragonlock) can't open them.
- If you allow the AI helper, a quest photo and the quest's title are sent to Claude, an AI made by Anthropic (or sometimes Cloudflare's Workers AI), to check that the quest looks done, and the sentence you write quests in goes to Jev, an AI made by TypeSafe, to sort it into quests. Both travel through our checker on Cloudflare. None of it is used to train AI. Anthropic deletes it within 30 days unless its safety systems flag it (see below). Your child's profile name is not added separately to photo checks, but names or other private details written into a quest title or visible in a photo may be sent.
- Photos are deleted 7 days after they're taken.
- Which apps are locked stays on your child's phone. Apple's Screen Time never tells us which apps your child uses, or for how long.
- No ads. No tracking. We don't sell information or share it for advertising.
- Usage stays on your phone unless you choose Share. During setup we ask, once, whether you'll share anonymous app use to help us make Dragonlock better. Only from your phone, never your child's. You can change it in Settings › Privacy.
- You can delete photos, a child, or your whole family's data from the app at any time.
Who we are
Dragonlock is made by Sebastian Koning, an independent developer in Kelowna, British Columbia, Canada ("we", "us"). We're responsible for the personal information Dragonlock handles. Our person in charge of privacy is Sebastian Koning, and you can reach him at support@dragonlock.app.
Who Dragonlock is for
Dragonlock is a parental-control app. A parent or legal guardian sets it up and pays for it on their own iPhone. Their child's iPhone, signed in to a child Apple Account in the parent's Family Sharing, joins the family and shows the child their quests.
The parent is the account holder. There is no Dragonlock account and no sign-up: Dragonlock works through your Apple Account and iCloud. You decide what your child's phone shows, you give or refuse consent for the AI helper, and you can see, change or delete everything Dragonlock keeps about your child. Dragonlock isn't meant for a child to set up alone, and its setup on a child's phone needs the parent's Apple Account to approve Screen Time.
What Dragonlock handles, and where it goes
| What | Why | Where it lives |
|---|---|---|
| Your child's name or nickname, and their pet | So the app talks to your child by name and shows their pet | Both phones and your family's iCloud |
| Quests (what you write, in your words), which days they repeat, reward minutes and the names you gave the apps in the chest | To show your child's day and open the chest when it's done | Both phones and your family's iCloud |
| What happens during the day: quests done, approvals, "not yet", asks for more time and your answers, pauses, free days, bonus minutes, the streak | To run the day and keep both phones in step | Both phones and your family's iCloud |
| Proof photos your child takes in Dragonlock's camera | So the quest can be checked, and so you can see it | Both phones and your family's iCloud, for 7 days. Sent to the photo checker only if you allowed the AI helper (see below) |
| Which apps, categories and websites are locked | To lock them | Only on your child's phone. Apple's Screen Time gives Dragonlock sealed tokens; we can't read which apps they are, and they never leave the phone |
| Your child's phone's status: whether Screen Time is on, how many apps and categories are locked (counts only), whether notifications are on, the app version, when it last checked in | So you know the lock is working | Both phones and your family's iCloud |
| Whether your subscription is active, and until when | So your child's phone knows to keep the lock on, or to open everything if the subscription ends | Both phones and your family's iCloud. No payment details: Apple handles payment and never shares your card with us |
| Answers during setup: your first name, your child's age range, how much screen time they have, what's hard at your house, which apps pull hardest, what they're into | To suggest quests and show you a plan during setup | Your phone only. Your first name, the age range and the "how's it going" answers are used on screen during setup and not kept. The app names and interests become the chest's labels and your pet |
| Your voice, when you dictate quests | To turn what you say into text | Apple's speech recognition on your phone. When your phone can't do it on the device, Apple processes the audio under Apple's privacy policy. We never receive or keep audio |
| A signing key for each phone | So each phone can prove a message came from the other one, and nobody else | The private key stays in each phone's keychain. The public half is shared with the other phone |
| Small preferences (sound on or off, hints you've seen) | To remember them | The phone where you set them |
Dragonlock doesn't use your location, contacts, health data, browsing history, advertising identifier or any other identifier for tracking. Screen Time doesn't give Dragonlock your child's app usage, and we don't ask for it.
Photos, and where AI is used
Your child takes a photo of a finished quest (a made bed, a fed cat) inside Dragonlock. It can't pick a photo from their library. Before any photo or quest sentence leaves a phone, you choose, as the parent, whether to allow the AI helper:
- AI helper allowed. The photo and the quest's title (for example "Make your bed") are sent over an encrypted connection to our photo checker, a small service we run on Cloudflare that passes them to Claude, an AI model made by Anthropic. Sometimes, for example when Claude is unavailable or a usage limit is reached, an AI model on Cloudflare Workers AI answers instead. The AI answers questions like "does this look done?", "is this a photo of a screen?" and "is a face in the picture?". The request also includes random identifiers used to verify the result for the right quest and family. Your child's profile name and your name are not added separately. The quest title is sent as written, so names or other private details in the title or the photo may be sent too. Avoid including them. If a face is in the picture, or the photo doesn't show the quest done, your child is asked to take it again. If the answer is a clear yes, the quest is done (unless you chose to check every photo yourself, below). If the AI isn't sure, or the check fails, the photo goes to you to decide.
- AI helper not allowed. No photo or sentence is sent to the checker. Every photo goes to your phone for you to approve, and Dragonlock sorts your quest sentences on your phone. Everything else works the same.
"I'll check every photo myself." A separate setting in Settings › Privacy, not a consent: with it on, no quest counts as done until you approve the photo, even a clear yes. If the AI helper is allowed, it still asks your child for a retake when a photo won't do. It changes nothing about what is sent.
Writing quests in a sentence. When the AI helper is allowed, the sentence you write or dictate on your phone ("bed made, teeth brushed, 20 minutes of reading") is also sent to the same checker, along with the quests your phone drafted from it, so Jev, an AI model made by TypeSafe, can keep the quests that fit what you wrote and pick a picture and a kind of proof for each. Dragonlock replaces known child and family names in this sentence with placeholders before sending it. This does not remove every possible identifying detail, and it does not redact the separate quest title sent during a photo check. Without the AI helper, Dragonlock sorts your sentence on your phone, without AI.
What Anthropic does with it. Anthropic processes the photo and title to give the answer, as our service provider. Under its commercial terms it doesn't use them to train its models, and it deletes them within 30 days. The one exception: if Anthropic's automated safety systems flag something as breaking its usage policy, Anthropic may keep it for up to 2 years to enforce that policy, and it keeps anything the law requires it to.
What TypeSafe does with it. TypeSafe processes your sentence and the drafted quests to give the answer, as our service provider. It doesn't train Jev on customer requests, and under its data processing terms it keeps them only as long as that processing needs. The sentence reaches TypeSafe with known child and family names replaced, as described above.
What Cloudflare does with it. Cloudflare runs our checker, and sometimes answers photo checks itself (Workers AI) instead of Claude. It processes the photo, title or sentence only to give the answer, as our service provider, and says it doesn't use customer content sent to Workers AI to train AI models or to improve its services. Our checker doesn't save them anywhere and doesn't log them. Like any internet service, Cloudflare sees the network address (IP address) of the phone to send the answer back; we don't store it. To stop the checker being abused, it checks that a request really comes from Dragonlock on a real device, using Apple's App Attest, and counts requests per install; that check uses a random key made for the app, not your child's identity.
Where photos are kept. Your child's phone sends the photo to your family's iCloud, and your phone shows it on the quest's note. Each photo is deleted 7 days after it's taken: Dragonlock removes it from both phones and from iCloud. iCloud has no timer of its own, so the deletion happens the next time either phone opens Dragonlock after the 7 days; an expired photo is never shown or downloaded again. You can also delete all photos now in Settings › Privacy. A phone that isn't paired with a family keeps the photo only in memory while it's checked.
iCloud and pairing
Dragonlock has no servers that store your family's data. Your family's information is kept in Apple's iCloud (CloudKit), in a private area of the parent's iCloud account that is shared only with the child's Apple Account. Apple stores it under Apple's privacy policy and protects it with encryption. We can't open it or search it.
To pair the phones, your phone shows a six-letter code that works once, for 10 minutes. While pairing, the two phones leave a short message for each other in a part of iCloud that belongs to Dragonlock: a random family number, each phone's public key, the iCloud link to your family's shared area, and identifiers that iCloud assigns only within Dragonlock (they don't reveal your Apple Account's name or email). No names, quests or photos. The link only opens for your child's Apple Account. These records are kept after pairing so an old code can never pair another phone.
Notifications (for example "Maya sent a photo") travel through Apple's push notification service. They never contain the photo.
Anonymous app use (only if you say yes)
During setup, on the screen where you choose whether to allow the AI helper, Dragonlock asks a separate question: whether you'll share anonymous app use. Both answers work the same; nothing in the app depends on it, and it has nothing to do with the AI helper or your subscription. Usage stays on your phone unless you choose Share. Until you choose, Dragonlock notes what happens in the app (for example, which setup screens you saw) in a small file on your phone only: at most 500 notes, each deleted 7 days after it was made, never backed up. If you choose Share, those notes are sent and the file is deleted; if you choose Don't share, or never choose, the file is deleted and nothing is sent. You can change your answer any time in Settings › Privacy.
If you say yes, your phone sends PostHog, an analytics service hosted in the European Union (Frankfurt), events like "a setup screen was shown", "the plans were shown", "a purchase went through or was cancelled", "the phones paired", "the first quest was set" and "the app was opened today". With each one: your plan, whether your subscription is active, the app's version, your iPhone's iOS version and your App Store country. Events carry a random ID made for this purpose, not your Apple Account or your phone's advertising identifier.
It never gets names, photos, quests or anything you type, your child's age, anything from Screen Time (which apps are locked, minutes, times), anything from your child's phone, your location or your phone's advertising identifier. Dragonlock asks PostHog not to look up a location from your network address, and our PostHog project discards network addresses. We use it only to see where setup gets stuck and what to improve; never for advertising, and we never try to tie it back to you or your family.
Because the ID is random and isn't tied to you, we can't pick out your past events to show or delete them. Turning the switch off, or deleting your family, stops sending and replaces the ID with a new one. PostHog keeps events for up to one year, then deletes them. PostHog handles them only for us, under its data processing terms, with the same protection this policy describes.
What we don't do
- No advertising, and no ad networks.
- No analytics on your child's phone, and no crash-reporting services in the app. Beyond the anonymous app use you may choose to share (below), we see only the anonymous totals Apple gives every developer (downloads, and crash reports from people who chose to share them with developers in their iPhone settings).
- No tracking across apps or websites, and no data brokers.
- We don't sell or rent personal information, or share it for advertising.
- Screen Time information is used only to run Dragonlock's controls for your family. It is never shared, sold or used for anything else.
- No one at Dragonlock looks at your child's photos. They go to the checker (if you allow it) and to you.
How long things are kept
| What | How long |
|---|---|
| Proof photos | 7 days from when they're taken (deleted from both phones and iCloud as described above), or sooner if you delete them |
| Photo, title or sentence sent to the checker | Our checker and Cloudflare: only while the check runs (a few seconds), not stored. Anthropic (photos and titles): deleted within 30 days, or up to 2 years if its safety systems flag it. TypeSafe (sentences): only as long as its processing needs, under its data processing terms |
| Your family's quests, settings and day | Until you delete the child or the family in the app, or delete Dragonlock's data from iCloud |
| Setup answers you weren't asked to keep (your first name, age range, "how's it going") | Only while setup is on screen |
| Pairing records | Kept so codes can't be reused. They hold no names, quests or photos |
| The photo checker's App Attest key for each install (a random key, with a request counter) | Kept while that install may still use the checker, to stop abuse. It isn't linked to you or your child |
| Anonymous app use, before you choose | On your phone only, each note deleted after 7 days (at most 500); deleted at once if you choose Don't share |
| Anonymous app use, if you chose Share | Up to 1 year at PostHog, then deleted |
| Emails you send us | As long as we need to help you, then up to 2 years in case you write again, unless you ask us to delete them sooner |
Deleting your family's data
- Delete photos now: Settings › Privacy › Delete photos now.
- Delete a child: Settings › that child › Delete. Their quests, photos and day are removed from your phone, their phone and iCloud.
- Delete the family and all data: Settings › Privacy › Delete the family. Removes everything from both phones and iCloud, and opens every lock on your child's phone.
- From iCloud directly: on your iPhone, Settings › [your name] › iCloud › Storage › Dragonlock › Delete Data.
- Deleting the app from a phone removes what's on that phone. It doesn't cancel your subscription: cancel in Settings › [your name] › Subscriptions (see the field guide).
Since we can't see your family's data, we can't delete it for you from our side; the app does it. If something won't delete, email support@dragonlock.app and we'll help.
Children's privacy
Dragonlock handles information about children because it helps parents run their child's day. It is not directed at children to sign up on their own, and it isn't in the App Store's Kids category. We follow the U.S. Children's Online Privacy Protection Act (COPPA), the GDPR's rules for children's data, the UK Age Appropriate Design Code, and Canada's privacy laws, as they apply.
- Consent comes from the parent. The parent sets up Dragonlock, approves Screen Time on the child's phone with their own Apple Account, and decides whether the AI helper is allowed. We ask for that consent in the app, in plain words, before any photo leaves the child's phone, and we record which version of this policy you agreed to.
- We collect only what the app needs. A first name or nickname is enough; we never ask for a child's last name, birthday, address, school, email or phone number. The child's camera can't be used to pick photos from their library, and a photo with a face in it is retaken.
- Our service providers for the AI helper are Anthropic (photo checks), TypeSafe (quest sentences) and Cloudflare (our checker, and a backup for photo checks), each used only to give the answer, as described above. We don't disclose children's information to anyone else, except where the law requires it.
- Parents' rights. You can see everything Dragonlock keeps about your child in the app on your phone; change it there; turn off the AI helper at any time without losing the app; and delete your child's information (see above). You can also ask us any question about your child's information at support@dragonlock.app.
Your rights
Wherever you live, you can ask us what we hold about you or your child, ask us to correct or delete it, and withdraw your consent to the AI helper. Most of this you can do yourself in the app, because the data lives on your phones and in your iCloud, not with us.
Canada
We handle personal information under the Personal Information Protection and Electronic Documents Act (PIPEDA) and, in Quebec, the Act respecting the protection of personal information in the private sector. You have the right to access and correct your information and to withdraw consent. If you're not satisfied with our answer, you can complain to the Office of the Privacy Commissioner of Canada or, in Quebec, the Commission d'accès à l'information.
European Economic Area, United Kingdom and Switzerland
We rely on these legal bases: running the app you asked for (contract) for your family's quests, day and settings; your consent for the AI helper, which you can withdraw at any time in Settings › Privacy without affecting checks already done; and our legitimate interest in keeping the photo checker from being abused; and your consent for anonymous app use, which you can withdraw in Settings › Privacy. You have the rights to access, correct, delete, restrict, object to and move your information, and to complain to your data protection authority. Photo checks are processed by Anthropic and Cloudflare, and quest sentences by TypeSafe, which may be outside your country (for example in the United States). Their data processing terms include the safeguards the law requires for international transfers, such as the European Commission's Standard Contractual Clauses.
United States
We don't sell or share personal information, and we don't use it for targeted advertising or profiling. Residents of states with privacy laws can use the rights above by emailing us; we won't treat you differently for using them.
Security
Data travels over encrypted connections. Messages between the two phones are signed with keys that never leave each phone, so another device can't pretend to be you and unlock your child's phone. Family data on each phone is kept in the app's own storage; the pairing keys and the family's sync files are left out of device backups. The photo checker keeps no copies. We review these protections whenever Dragonlock changes. No system is perfectly secure; if something happens that affects your information, we'll tell you as the law requires.
Who else is involved
- Apple: the App Store, payments and subscriptions, iCloud (CloudKit), push notifications, Screen Time, speech recognition. Apple's handling is covered by Apple's privacy policy.
- Anthropic: Claude, the AI that checks photos, only if the AI helper is allowed. See Anthropic's privacy policy.
- TypeSafe: Jev, the AI that sorts your sentences into quests, only if the AI helper is allowed. See TypeSafe's legal terms.
- Cloudflare: runs our checker and this website, and backs up photo checks with Workers AI, only if the AI helper is allowed (the website for everyone). See Cloudflare's privacy policy.
- PostHog (PostHog Inc., data hosted in Frankfurt, Germany): anonymous app use from the parent's phone, only if you chose to share it. See PostHog's privacy policy.
No one else. If we add a service that handles your information, we'll update this policy first and, if it changes what happens to your child's photos or information, ask for your consent again in the app.
Changes
We'll post any change here with a new version number and date. If a change matters to how your child's information is handled, the app will tell you and ask again before it applies.
Website and launch email list
The launch email list is not open yet. The form on this website is disabled and sends no email addresses. This static site uses no advertising or analytics scripts and sets no cookies of its own. The hosting provider may process connection information to serve and protect the site.
Before sign-ups open, we will name the email service here and explain its retention and processing terms. The planned form asks for a parent's email address and consent to receive Dragonlock launch news, never a child's details. Joining will require an email confirmation, and every launch email will include an unsubscribe link.
Contact
Sebastian Koning
Kelowna, British Columbia, Canada
support@dragonlock.app