KidWall Privacy Policy

Effective date: October 7, 2026 Developer: Anthony Craig ("we", "us") — ant.sd.shield@gmail.com

KidWall is a parental-control app for iPhone and iPad. A parent installs it on their child's device to block apps and websites, set time limits and a bedtime, and — if the parent chooses — check on the device from the parent's own phone. This policy explains what information KidWall handles, where it goes, and the choices you have. We wrote it to be read, not skimmed: it is short because the app collects very little.

The short version

• KidWall has no accounts, no advertising, no analytics, no tracking, and no third-party SDKs. We never sell or share data.
• Most of what KidWall does happens entirely on the child's device, using Apple's Screen Time framework. We cannot see which apps or websites you chose to restrict.
• If you pair a child device with a parent phone, a small amount of status information (and, only if you turn them on, the device's location or alerts when it arrives at or leaves places you set) is stored in Apple's iCloud (CloudKit) so your phone can display it — encrypted end-to-end with a key derived from your pairing code, so it is unreadable to us and to Apple.
• We do not collect message contents, browsing history, keystrokes, photos, contacts, passwords, or per-app usage history.

Who KidWall is for

KidWall is designed to be set up and controlled by a parent or legal guardian. It is installed on a child's device that belongs to the parent's Family Sharing group and must be authorized with the parent's Apple Account password. Any information about a child that KidWall handles is collected at the direction of that parent, and is visible only to the parents or guardians who have the family's pairing code and to any alert service (ntfy or webhook) the parent chooses to set up. Children cannot create accounts or provide information to us directly.

What stays on the device

The following is stored on the device in KidWall's private app storage and is never sent to us. If you pair the device with a parent phone, the child's name and the rule settings (but never the app and category selections) are also synced through iCloud, encrypted, as described in the next section.

• Your rules: the apps, app categories and websites you selected from Apple's list to block or limit (these are stored as opaque Apple tokens — KidWall itself cannot read which apps they are, and they never leave the device), daily time budget, bedtime hours, web-filter settings including any website addresses you type in, device-hardening settings and alert preferences.
• The child's name or nickname you enter.
• Your parent PIN, stored only as a one-way hash, never as the PIN itself. After several wrong tries, KidWall makes the next try wait.
• A local activity log of recent events (for example "bedtime started", "parent paused apps", the name of an app or website whose block screen was shown, or arriving at a place), which you can clear at any time.
• "Today's usage" totals shown in the parent area are rendered by Apple's Screen Time report system inside a sandbox; KidWall cannot read, store or transmit them.

What is shared with your parent phone (optional pairing)

If you pair the child's device with the parent version of KidWall, the following is stored in Apple's iCloud using CloudKit so the parent's phone can read it:

• Device status: the child's name/nickname you entered, a random device identifier generated by KidWall (not your Apple ID or hardware serial), the app version, whether it's an iPhone or iPad and has cellular service, whether the daily limit has been reached, whether bedtime is active, whether the parent has paused the device, whether Screen Time authorization is in place, the current rule settings (including website addresses typed into the web filter, any ntfy or webhook address, and your places, but not the apps and categories picked from Apple's list), and any pending "ask for more time" request including the name of the app or website the child asked about. It also includes whether KidWall has the location permission it needs and, if place alerts are on, which of your places the device is at and since when, and whether something like Low Power Mode or Background App Refresh is stopping place alerts.
• Events: alerts such as "daily limit reached", "bedtime started", "blocked attempt", "asked for more time" or "arrived at School", with a time stamp and a short message that may include the name of the app, website or place involved.
• Commands and rules the parent sends to the child device (pause, resume, extra minutes, "Locate now", rule changes), including any places the parent sets up: each place's name, its spot on the map and its size.
• Location — see the next section. Both location features are off by default; the device's location and its arrivals and departures are never stored unless a parent turns them on.

End-to-end encryption. Before any of this leaves a phone, KidWall encrypts it (AES-256-GCM) with a key derived from your family's secret pairing code, and files it under a one-way hash of that code rather than the code itself. The pairing code is created on the parent's phone and is never sent to us, and KidWall's iCloud database holds only that one-way hash of it. As a result, the database holds unreadable data and random-looking tags: we cannot read your family's names, status, rules, alerts, places or location there, and neither can Apple. Like other app data, what KidWall keeps on each device (including the pairing code, and on the child's device its rules, places and last location) is part of that device's own backup, such as iCloud Backup, which Apple's backup terms cover.

A few small things are stored unencrypted so the devices can find and order their messages: the random device identifier, the type of a command (for example "pause" or "locate"), the number of extra minutes granted (or that a request was turned down), whether a command has been handled, a counter of rule saves, and time stamps. Alerts from KidWall 1.1 and later carry a generic "alert" label; kid devices on older versions of KidWall also leave the kind of each alert readable (for example "blocked attempt"). As in any iCloud app, iCloud also records an app-specific identifier for the iCloud account that created each record, which doesn't reveal the Apple Account. None of these include names, places, locations, rules or what an alert says. KidWall's iCloud database is shared by every copy of the app, which is why everything personal in it is encrypted.

Anyone who has the pairing code can pair with your family's devices, read this information and change the child device's settings, including turning on location sharing and place alerts, adding places, asking for its location, pausing it and giving extra time. Treat it like a password: share it only with the child's other parent or guardian and only by typing it into KidWall. You can unpair at any time from the child device, and the parent phone can start over with a new code (Privacy & your data → Delete all family data). A new code doesn't reach kid devices by itself: until each one is unpaired and paired again with the new code, it keeps sending under the old one, and anyone with the old code can still read that and change its settings.

Data stored in CloudKit is additionally encrypted in transit and at rest by Apple and is held in Apple's data centers, in a CloudKit database operated under our developer account. We do not access, sell or share it, and we have no business use for it; the only reason it exists is to move status between your own devices. Apple's handling of iCloud data is described in Apple's privacy policy (https://www.apple.com/legal/privacy/).

Location

KidWall has two location features for the child's device. Each is off until a parent turns it on for that device, and neither works unless the device is paired and location permission has been granted to KidWall in iOS on the child's device. Until then, no location information is collected. Unpairing turns location sharing off.

• Share device location shows the child device's location on the parent's phone. When it is on, KidWall records the device's most recent latitude/longitude, accuracy and time stamp when iOS reports a significant change of location and when the parent taps "Locate now". Only the most recent location is kept; each update replaces the last.
• Place alerts tell the parent when the child device arrives at or leaves places the parent marks on a map (for example Home or School). The child's device watches those places itself, using iOS region monitoring. When it arrives or leaves, it sends the parent an alert such as "arrived at School" with the time, and reports which of the places it is at now. With only place alerts on, the device's coordinates are not sent, just arrivals, departures and the current place.

The child's KidWall home screen shows when their location is shared and which places their parent gets alerts about. Location sharing works best with "Always" permission, so iOS can report the device's location while KidWall isn't open. Place alerts need "Always" and Precise Location, because iOS only reports arrivals and departures to apps allowed to use location in the background, and a place can be as small as 100 meters (about 330 feet) around its pin. Alerts can be late or missed (for example in Low Power Mode, with Background App Refresh off, or without a network), so don't rely on them in an emergency.

On a parent's phone, KidWall uses that phone's location only when you tap "Use my location" while setting up a place, with "While Using" permission. It reads one location to drop the pin and keeps nothing else. The only thing saved is the place you create, which is encrypted like everything else and shared with the child devices you choose and the other parent phones on your family code.

Maps in KidWall come from Apple Maps. When you search for an address while setting up a place, the search text and the area of the map you're looking at are sent to Apple to find matches, and the maps showing your places and the device's location are loaded from Apple. "Open in Apple Maps" hands the device's location, labelled with the child's name, to Apple's Maps app. Apple's privacy policy applies to these.

Location information is shared only with the paired parent phone(s), and with an ntfy or webhook service only if you choose to send place alerts there (see below). It is never used for advertising or profiling. The time stamp on each alert isn't encrypted (see above); for a place alert it's about when the device crossed into or out of the place, so the database shows when alerts happened, but not what they say, which place they're about or whether the device arrived or left.

You can stop location sharing or place alerts at any time: turn them off for the device in Edit rules on the parent's phone or in the parent area on the child's device, delete a place, or unpair. Turning place alerts off stops new ones, though an alert already waiting to be sent (for example while the device was offline) may still arrive. Revoking KidWall's location permission in Settings → Privacy & Security → Location Services on the child's device stops new locations, but the parent's phone keeps showing the last one until location sharing is turned off. Both features keep running on the child's device if KidWall Premium ends, until they are turned off there or the device is unpaired; without Premium, the parent's phone shows only the subscription screen.

Optional alert services you configure

KidWall can also send alerts to a notification service you choose (an "ntfy" topic or a webhook URL such as a Discord or Home Assistant webhook). This is entirely optional and off unless you enter a URL. If you enable it, the event text described above (for example "Sam hit the daily limit") and the child's name are sent directly from the child device to the address you entered, without KidWall's encryption. Arrive and leave alerts are sent there only if you also turn on "Send place alerts to ntfy / webhook too". Use an https:// address so the alerts are encrypted on the way. These addresses are part of the device's rules, so on a paired device they are synced (encrypted) with the parent phone. That service's own privacy policy applies to what happens after delivery. We do not operate any such service and never receive these messages.

Notifications

If you use the parent version of KidWall, Apple Push Notification service delivers alerts to your phone. The push itself carries only generic text ("New alert from a kid's device") and a reference; KidWall on your phone then fetches the encrypted alert from iCloud and decrypts it to show the details. Paired kid devices also get pushes when the parent changes a rule or sends a command (a silent one for "Locate now"). Apple receives the device's push token and this generic content, not your family's information.

What we don't do

• No account creation, email address, or sign-in.
• No advertising, ad identifiers, or ad networks.
• No analytics, crash-reporting or usage-measurement SDKs.
• No selling, renting or sharing of personal information, ever.
• No collection of message contents, browsing history, search history, keystrokes, photos, contacts, call logs or per-app usage history.
• No use of data for any purpose other than the parental-control features you set up.

Children's privacy (COPPA and similar laws)

KidWall is a tool operated by parents, not a service directed at children. The only information about a child that leaves the child's device is the status, event and (optional) location and place-alert information described above, and it is collected solely at the parent's direction and delivered only to the parent's phones and to any alert service the parent sets up. We do not knowingly collect personal information from children directly, we do not contact children, and we do not use any child's information for marketing, profiling or advertising. A parent can review this information in the parent app while KidWall Premium is active, stop collection at any time by unpairing on the child's device (no subscription needed) or by turning off location sharing and place alerts, and delete it as described below (unpairing on the child's device also deletes what it stored, without a subscription).

Your choices and data deletion

• Change or remove restrictions: in the child device's parent area (PIN protected).
• Stop sharing status: on the child device, Parent settings → Remote control from my phone → Unpair. The device stops sending status, events and location to iCloud immediately, turns location sharing off and forgets its places. It works with or without KidWall Premium. Alerts to an ntfy or webhook address set on the device keep going until you remove that address under Alerts to my phone.
• Stop sharing location or place alerts: turn them off in Edit rules on the parent's phone or in the parent area on the child's device, delete a place, or unpair.
• Delete everything on the device: delete the app; all local data goes with it.
• Delete data stored in iCloud: unpairing a child device deletes everything that device stored. On the parent phone, each device has "Remove this device & delete its data", and Privacy & your data → "Delete all family data" removes every record for the family and starts a new pairing code. These run immediately, from the app, with no request to us needed; the two on the parent phone need KidWall Premium, while unpairing on the child's device works without a subscription. A kid device that is still paired keeps sending, so it shows up again, or, after Delete all family data, keeps sending under the old code, which only the phone that ran it stops using: another parent phone that joined with that code keeps seeing it, so switch that phone to the new code too. Unpair kid devices first to stop them for good. Because the data is encrypted with your code, anything left behind by a failed deletion is unreadable to anyone without your code.

Data retention

Device status and shared-location records are overwritten each time the device reports; only the latest values are kept, until the device is unpaired or removed. Alert (event) records, including arrive and leave alerts, are kept for 30 days so the parent can review recent activity; KidWall on the parent's phone deletes older ones automatically (it checks about once a day when it's used). Commands the parent sent are kept, marked as handled, until the device is unpaired or removed. If no parent phone uses KidWall any more, unpair the kid devices to delete what they stored. You can delete everything sooner as described above. Nothing is retained for our own purposes.

Security

KidWall's own network traffic (to iCloud) uses HTTPS/TLS; alerts to an ntfy or webhook address use whatever address you enter (see above). Family data is encrypted end-to-end on the phone with AES-256-GCM (see above) and again by Apple in transit and at rest. The parent PIN is stored only as a one-way SHA-256 hash, and repeated wrong tries make the next one wait. Restrictions on the child device are protected by Apple's Screen Time framework, so the child cannot delete KidWall or remove its Screen Time permission without the parent's Apple Account password, and KidWall's own settings are behind the parent PIN.

California and other privacy rights

We do not sell or share personal information as defined by the California Consumer Privacy Act, and we do not use it for targeted advertising. Residents of California, the EU/UK and other jurisdictions with privacy laws may exercise their rights to access, correct or delete information by contacting us at ant.sd.shield@gmail.com. Because KidWall holds so little, in most cases the fastest way to exercise these rights is the unpair and delete steps above.

Changes to this policy

If we change how KidWall handles information, we will update this page and the effective date above, and, for material changes, describe them in the App Store release notes.

Contact

Anthony Craig ant.sd.shield@gmail.com https://antlantis.github.io/kidwall-site/privacy.html