Privacy notice
This notice is about information held on a child, because an adult decided the child needed protecting. That is an uncomfortable arrangement, and the only way to be trusted with it is to write it out plainly rather than bury it in a schedule.
It covers all of PC Guardian: the agent installed on the Windows PC, your account, the phone app, and this website.
- Version
- 1.0
- Issued
- 16/08/2026
- Published by
- ClearCode Digital Ltd
Where this notice says we, it means ClearCode Digital Ltd. Where it says you, it means the parent, guardian or authorised carer who holds the account. Where it says your child, it means the person nearly all of this data is actually about.
1Who is responsible for this data
ClearCode Digital Ltd is the data controller for everything described here. That means we decide what is collected and why, and we are the organisation you complain about if we get it wrong.
PC Guardian is the product. ClearCode Digital Ltd is the company that publishes it, and is the name you will see on the installer, on your bank statement and on anything legal.
2Who this notice is about
There are three sets of people in this, and they are not treated the same.
Your child
Almost everything the product records is about a child, and the child is the data subject. The rights in section 9 are theirs, not yours, even though it is your account.
You, the account holder
Your name, your email address, your sign-in credentials, your subscription. Ordinary account data, held so that the service can exist at all.
Anybody else with a Windows account on that PC
When the installer enrols a PC it lists every Windows account on the machine, because an unmapped account is a way round the whole thing. So if a grandparent, a lodger or a second parent has an account on that computer, its username, its Windows security identifier and whether it has administrator rights are recorded, and it is marked as not belonging to a child. Nothing about what those accounts do is recorded, and none of them is filtered or timed.
You should tell the other adults in the house that this is the case. It is one line in a conversation and it avoids a much longer one later.
3Why we are allowed to hold it
3.1The child’s data: legitimate interests
We rely on legitimate interests. The interest is a real one — a parent, guardian or authorised carer keeping a child in their care safe online. That basis is a demanding one, because it only holds for as long as three things are true at once.
- There is a genuine purpose. Enforcing rules an adult with responsibility for the child has set on the computer that child uses.
- What we hold is necessary for it. You cannot enforce a rule about a website without the machine knowing which website was asked for, and you cannot tell a parent that something was blocked without recording that it was blocked. Everything in section 4 exists because a specific feature would not work without it.
- It is balanced against the child’s own rights. This is the part that does the work, and it is the reason the product is built the way it is. Nothing is captured about the content of a child’s life. Retention is short. The child is told, on the computer, in plain English, and can read the same list you can.
The bar is higher because the person concerned is a child. That is not a technicality; it is the whole reason section 5 of this notice is as long as section 4.
3.2Your data: contract, and the law
Your account exists because you asked for it, so we hold it to perform that agreement. Payment records are kept because tax law requires us to keep them, whatever either of us would prefer.
3.3Nothing in the special categories
We do not ask for, and have built nowhere to put, anything in Article 9 of the UK GDPR — health, religion, ethnicity, political opinion, sexual orientation, biometrics. There is no notes field on a child’s record.
Two free-text fields exist in the whole product: the reason your child may attach to a request, up to two hundred characters, and the note you can write back, up to three hundred. What goes into those is between the two of you. Everything else recorded about a child is a value from a fixed list, a domain name, a time or a number.
4What is recorded
The important thing first, because it is the thing most parents assume is the other way round. The part of the product that inspects addresses runs on the PC. Every lookup the machine makes passes through it, and the overwhelming majority go no further than the machine itself.
What is sent to us is a record of things that happened: an address that was blocked, an address that was allowed because you had granted a permission for it, an application that was stopped, time used, a rule you changed. There is no event type for “your child visited this site and it was fine”, so no such list is built, held or available — to us, to you, or to anyone who compels us.
| What | What it actually is | Why it exists |
|---|---|---|
| Your account | Email address, first name, a hash of your password, a hash of your override PIN, whether two-factor is switched on, when you last signed in. | Signing in, and proving it is you at the point where somebody tries to uninstall the agent. |
| Your family | The family name you chose, the time zone, which tier you are on. | Screen time has to be counted against a local day, and the tier decides what is available. |
| Each child | First name, date of birth, the age band derived from it, and a short text seed that draws their avatar. | The date of birth sets the starting rules and refuses anybody aged eighteen or over. No photograph is ever uploaded — the avatar is drawn from the seed. |
| Each PC | Machine name, Windows edition and build, processor architecture, agent version, the Windows machine identifier, when it enrolled, when it last checked in, which enforcement level it is running, and the result of its last self-test. | Knowing which machine is which, telling you honestly what that edition of Windows can enforce, and telling you when a PC has gone quiet. |
| Windows accounts | For every account on an enrolled PC: username, Windows security identifier, whether it is an administrator, and which child it is mapped to, if any. | An account nobody has mapped is the simplest way round the whole product, so unmapped accounts are blocked from signing in. |
| The rules you set | Categories, your allow and deny lists, application rules, daily allowances, curfews, per-app budgets, and any temporary permission with its expiry time. | This is the policy. It is what the PC enforces, online or off. |
| Activity | What happened, what it happened to — usually a domain name or an application name — how serious it was, which child, which PC, and when. A small amount of structured detail, such as which rule matched. | Your feed, your alerts, and the weekly summary. |
| Screen time | When a session started and ended, how many minutes were active with idle time excluded after five minutes, and the local date it counts against. | Counting an allowance that is time spent rather than time elapsed. |
| Requests | What was asked for, the reason your child wrote if they wrote one, the decision, who made it, any note you wrote back, and how long the permission lasts. | The ask-a-grown-up workflow, and being able to see later what was agreed. |
| The audit log | Who changed which setting, the value before and after, and the IP address of the browser or app that made the change. | So that a disagreement about who allowed what has an answer, and so a carer can evidence what was in place and when. |
| Billing | Stripe customer and subscription identifiers, your tier, the status, the amount in pence, whether it is monthly or annual, and the dates the trial and the period end. | Taking the payment and knowing what you are entitled to. We never see or hold a card number. |
| This website | The web server keeps an ordinary access log: IP address, the page requested, the time, and the browser’s user-agent string. | Keeping the site up and investigating abuse of it. It is not linked to any account and it is not used to build a profile of anybody. |
5What is never recorded
PC Guardian is a protective tool and not a surveillance tool. The following are permanently out of scope, and this is a product value rather than a version-one limitation.
- Nothing your child types. No keystroke logging, anywhere, at any tier.
- Nothing on their screen. No screenshots, no periodic captures, no screen recording.
- Nothing they say or write. No email, chat, direct message or social media content is intercepted or read. We can block the address of a chat site. We cannot see a word said on one.
- No microphone, no camera. The agent never opens either.
- No location. No GPS, no Wi-Fi positioning, no location derived from an address. The only IP address held anywhere is the one in the audit log, recorded against an adult making a change in the console.
- No page content and no search terms. The address of a site is not the page, and what is typed into a search box is not sent to us.
- No files. Nothing on the PC is scanned, indexed, copied or uploaded. This is not antivirus and it does not read the disk.
- No covert operation. The tray icon is always visible and cannot be hidden. There is no stealth mode and there will not be one.
Some of that boundary is ethics and some of it is self-interest. Software that captures content covertly is stalkerware, the antivirus industry treats it accordingly, and being outside that classification matters to us. Mostly, though, it is the reason the lawful basis in section 3 holds at all. We could not justify capturing any of the above, so we did not build it.
6Who else sees any of it
Everything is held in the United Kingdom, on our own infrastructure. Three outside parties are involved at all, and it is worth being precise about what each of them gets.
| Who | What they get | Where |
|---|---|---|
| Stripe | Your name, your email address, the card details you type into their form, and the amount. They hold the card; we never see it. Nothing about a child. | United States |
| Expo | The push token that identifies the app installed on your phone, so a notification can reach it. The notification itself has to say which child asked for what, so the text of that one message passes through their delivery service on its way to you. | United States |
| Cloudflare, then Quad9 | An address being looked up, and the public IP address of your home broadband, over an encrypted connection. No name, no account identifier, nothing that ties a lookup to a child. | Global |
Why a lookup goes anywhere at all
When an address is allowed, something has to turn it into a number, and that has always been true of every device on the internet. We send allowed lookups to Cloudflare’s family resolver, failing over to Quad9, over an encrypted connection. The alternative is your broadband provider seeing exactly the same thing in plain text, which is what happens by default on a PC without this installed.
Nobody else
No advertising networks. No data brokers. No analytics companies. We do not sell data, we do not share it for anyone else’s purposes, and there is no arrangement under which anybody pays us for access to any of it.
If we are ever legally compelled to disclose something, we will comply, and we will tell you it happened unless we are prohibited from telling you.
7How long it is kept
| What | How long | Then |
|---|---|---|
| Activity events | 90 days | Deleted outright. |
| The audit log | 24 months | Deleted outright. This is the record a kinship or foster carer may need. |
| Screen-time sessions | 400 days | Deleted outright. Longer than activity so that this time last year is comparable. |
| Enrolment links | 24 hours, then 7 days | The link stops working after a day and the record of it is deleted a week later. |
| Your account, children, devices and rules | While the account is open | Deleted when you close the account. |
| Billing records | 6 years | Kept because tax law requires it, and for no other purpose. |
| Website server logs | 30 days | Rotated and deleted. Not linked to an account, not used for analytics, not combined with anything else. |
Deletion is a hard delete, run every night, not a flag on a row that stays in the database. Backups are cycled, so a deleted record leaves those too rather than sitting in a snapshot indefinitely.
8How it is protected
The full description is on the security page, including how to report a vulnerability. In summary:
- Passwords and override PINs are stored as argon2id hashes. Neither is recoverable, by us or by anyone who takes a copy of the database.
- The policy sent to a PC is cryptographically signed, and an agent discards a policy that does not verify.
- The copy of the policy held on the PC for offline use is encrypted.
- Traffic between the agent and the service is TLS 1.3, pinned to our issuing certificate authority.
- No secret, key or token is ever written to the activity log or the audit log.
9Your rights, and your child’s
Under UK GDPR the following apply. Nearly all of them belong to the child.
- Access — a copy of what is held, and an explanation of what it means.
- Rectification — anything wrong corrected. A date of birth typed in incorrectly, for instance, changes which rules a child gets.
- Erasure — deletion, subject to the retention we are legally required to keep.
- Restriction — a pause on our using something while a dispute about it is resolved.
- Objection — the important one here, because we rely on legitimate interests. See the rail.
- Portability — this applies to data held under a contract with you, which means your account and billing details rather than a child’s activity.
There is no right to withdraw consent, because we never asked for consent and do not rely on it. Section 3 explains what we rely on instead.
9.1If the child wants to exercise their own rights
They can, and they should be able to do it without going through you. A child who understands what they are asking for can make a request themselves, and we will not refuse one on the grounds of age.
We will also not pretend the account holder does not exist. Where a child asks us to delete records a carer is relying on, or where handling the request would mean telling one of them something about the other, we decide it on what is in the child’s best interests, and we explain the decision in writing to whoever asked. Those situations are rare and they are not resolved by a script.
9.2Closing the account
Ask us and we close it. The family, the children, the devices, the rules and all the activity go with it. The only thing that survives is the billing record, which tax law requires us to keep for six years and which we use for nothing else.
10Automated decisions, and profiling
This product makes automated decisions all day long. It decides, in a few milliseconds, whether an address resolves and whether a program starts. It would be absurd to claim otherwise, so here is how those decisions work.
- Each one is made against rules a specific adult in your family set, or against the age-band defaults they accepted. It is not an inference about your child.
- Nothing is learned from behaviour. There is no model, no score and no profile. The same address gets the same answer whoever asked for it.
- Every decision can be challenged from the machine itself. The block page carries a button for your child to ask, and you can reverse any block in one tap.
Blocking a website is not a decision with legal or similarly significant effects, so Article 22 of the UK GDPR is not engaged. We built the challenge route anyway, because a child who has no way to argue with a rule has been handed something worse than a rule.
11Complaining
Tell us first if you are willing to. Write to support@pcguardian.co.uk and a person will deal with it.
If you are unhappy with how we have handled it, or you would rather not come to us at all, you can complain to the Information Commissioner’s Office. It is the UK regulator, it is independent of us, complaining to it is free, and you do not need our permission or a solicitor. Your child can complain to the ICO themselves.
12Changes to this notice
When this notice changes we change the version and the date on it. If a change materially affects what is collected, how long it is kept, or who sees it, we email every account holder before it takes effect rather than quietly republishing the page.
This notice binds. The summary on the front page of this site is a summary, and where the two differ, this document is the one that is right. If you find a difference, tell us, because one of them is wrong and we would like to know which.
For the avoidance of doubt about which systems this notice covers: the console at app.pcguardian.co.uk, the service it talks to at api.pcguardian.co.uk, the installer host at dl.pcguardian.co.uk, and this site at pcguardian.co.uk. Anything claiming to be PC Guardian from anywhere else is not ours.