This website

If you join the list, we keep your email so we can tell you when Arrow Guardian is available and send you our own updates.

• Email — so we can notify you and send Arrow Guardian updates.
• Optional beta request — if you check that box, we also keep the short reason you write.
• Your agreement — that you have read this page.

We do not store your IP address or browser user agent with a signup. We use your email to tell you when Arrow Guardian is available and to send you our own product news. We do not sell your address, and we do not give it to other companies so they can market their products to you. You can ask us to delete your address at any time.

This site uses Cloudflare Web Analytics so we can see how the page is used (pages viewed, roughly where a visit came from, and the usual device and browser details). Cloudflare does not set an advertising cookie for that. That measurement is not tied to your waitlist row. We do not run ads on this site, and we do not sell this data.

The Arrow Guardian app

Your shield settings, schedules, Youth Profiles, and any accountability-partner email live in local files on that PC. Uninstalling the app removes that local copy. The core review — deciding whether a shield should fire — is done by our vision-model provider, after the on-device pass below. That review is not kept.

Before a review leaves the PC, we mask sensitive text on the machine. What gets checked is held in memory for less than a second, then discarded. Nothing from that review is written to disk on your computer or ours. We do not save what you see, and we do not train on it.

Local logs keep a short on-device history for troubleshooting. That history does not go to our servers.

What the auth server stores

It checks that your subscription is current and manages access to the vision models used for filtering. It is not a diary of your computer.

License and device

• A hashed form of your license key, plus the last four characters so we can show them in the app. We do not keep the full key.
• Billing identifiers from our payment processor: customer, order, subscription, and invoice IDs, status, and amounts.
• Which PC is activated: an install id, a hashed device token, app version, last-seen time, and the model name the app is allowed to use.

Your billing email and name live with the payment processor. The auth server looks them up when needed. It does not keep a copy of that email in its own database.

Usage statistics and API usage

Each visual-review call reports only the numbers we need to run the service:

• Which vision model was used
• Token counts (how large the request and reply were)
• An estimated cost, rolled into a daily total per license
• How many calls succeeded, and how many we could not attribute

Those records are counts and costs. They do not include the image, the prompt, scores, window titles, addresses, or anything you were doing.

Errors

The app also sends a coarse health kind, such as “ok,” a network error, a quota problem, or a lapsed subscription, along with the app version. We count those by hour so we can see if the fleet is failing, and we keep the latest kind per device. That is an error category, not a stack trace of your session and not a picture of your screen.

What the auth server does not process or store

• Images, or any other copy of what was on screen
• User activity: sites, window titles, OCR text, prompts, scores, or what got closed
• API keys or the full license key

Who else is involved

A few companies help us run the product. They only get what they need for that job.

• Cloudflare hosts the website, auth server, and mail relay, keeps bots off the signup form with Turnstile, and measures page use with Web Analytics.
• A US-based vision-model provider receives the masked, in-memory review so it can decide if a shield should fire. That provider does not retain the input or output and does not train on it. Details are below.
• Lemon Squeezy handles checkout, subscriptions, and our customer email list.
• Brevo delivers transactional mail we already decided to send, such as an unlock code to the partner address you entered on the PC.

We use your IP address for a short window to rate-limit abuse. We do not attach it to your license record or waitlist row.

If you turn on partner unlock, we send a code (or a “you were removed” notice) to the email stored on that PC. Those messages do not include what was on screen.

We do not sell your personal information.

Visual review

To decide whether a shield should fire, Arrow Guardian sends the masked, in-memory review to our vision-model provider.

The provider does not store what we submit on disk. They only hold it in memory during the review. Once the review is complete, it is deleted from memory. The same applies to outputs: once sent back to us, they are deleted. They do not use what we submit to train models, and they do not share it with a third party.

They generally do not log the content of a request. They log metadata useful for debugging: request ID, cost, and sampling parameters. They reserve the right to log a small portion of requests when necessary for debugging or security.

What they receive is that one review, after sensitive text has already been masked on your PC. They do not get a history of your activity from us, and we do not store the image or the score.

Security

The product is designed so the most sensitive material never becomes a record we have to protect later.

• What gets checked never touches disk, on your machine or ours.
• Best-effort masking on the PC, before a review leaves: numbers and codes, emails, money amounts, IP addresses, passwords and API-shaped tokens, private keys, source code, file paths, and internal or localhost addresses.
• The license key is not stored in full. This PC is remembered in a form that cannot be read back as the original. Credentials on the machine stay locked to your Windows account.
• Review credentials are short-lived. The app refreshes them in the background.
• Auth, email, and signup endpoints are rate-limited. Traffic is HTTPS.
• Admin tools for licenses and fleet health are restricted. They can see error kinds and usage totals, not your activity.
• Arrow Guardian administrators cannot access user activity or images. Data for filtering decisions goes from local memory directly to the vision-model provider, is processed, returned, and deleted. It is never accessible.

If you have any security concerns or suggestions, write us at security@arrowguardian.com.

How long we keep it

Visual review is not kept. Waitlist emails stay until you ask us to remove them or we close the list. License, billing, daily usage totals, and error counts stay while we need them to run the subscription and keep the service reliable. You can ask what we still have.

Children

Youth Profiles live on the Windows PC and attach to a child’s local account. We do not collect a child’s email for that feature. The notify form is for adults. If you are under 13 (or under 16 in the EEA/UK), do not submit it. If a parent thinks we have a child’s address, email us and we will delete it.

We use Arrow Guardian for our own families, and we take that seriously. It is built to filter every page and every site on the computer. It can still make mistakes. It may miss content, let something through, or close the wrong thing.

Parents, not Arrow Guardian, are responsible for their children’s activity. This software does not replace parental judgment or supervision. It is not a guarantee that a child will not see or do something they should not. If you use it with children, you do so at your own judgment and risk.

Prohibited use

Arrow Guardian is built to filter every kind of on-screen content: pages, apps, images, video, and text. Your shield settings decide what gets closed. That is ordinary filtering.

Sexual content involving children is never allowed. While Arrow Guardian is running, you may not view, save, or share child sexual abuse material, or any sexual content of anyone 17 or under, whether real, generated, or drawn. That is a crime. It is not a shield you can turn off.

If we become aware of that material in connection with this service, we will take the steps the law requires. In the United States that can include a report to the National Center for Missing & Exploited Children and to law enforcement. We do not store screen images, so we would typically learn of this only if someone writes us, or through a legal process. Report concerns to security@arrowguardian.com.

Your choices

• Email hello@arrowguardian.com to see, correct, or delete waitlist or account data we hold.
• Manage payment details through the billing portal in the app (that opens our payment processor).
• Uninstall Arrow Guardian to remove local settings on that PC.

If we change this page in a material way, we will update the date at the top.

Limits

Arrow Guardian is a tool you choose to run. It does not replace your judgment, a lawyer, or the rules of your workplace, school, or home.

It is intended for people in the United States. We plan to expand over time. We cannot guarantee performance or legal compliance outside the United States.

You are responsible for checking that using it is allowed where you install it, including employer or school policy, shared-computer rules, and any duty to tell other people who use that PC. Make sure it fits your personal or workplace requirements before you rely on it.

It will not catch everything. You use Arrow Guardian at your own judgment and risk. This page describes privacy and security. It is not a warranty and not legal advice.

Contact

Questions about privacy or security: hello@arrowguardian.com.