Effective Date: September 26, 2026
Webspace IN Private Limited ("we," "us," or "our") built Guardrail as a schedule- and time-limit tool for a child's Mac. Because Guardrail involves one family member (a parent) configuring restrictions that apply to another (a child), we've written this policy to be unusually specific about exactly what is and is not recorded, and about the fact that the child using the device always has their own in-app view of the same information a parent sees.
Guardrail's child mode includes a dedicated "What Guardrail knows about you" screen, reachable at any time without needing a parent's PIN. It shows the exact same category names and today's minute counts a parent sees in their own summary -- there is no separate, more detailed view available only to the parent. We built it this way deliberately: monitoring a child's device can become surveillance if the child can't see what's being recorded about them, so Guardrail never lets that view exist only on the parent's side.
By default, everything above is stored locally in Guardrail's own sandboxed application data folder on the child's Mac -- never on a Guardrail-operated server, because none exists.
If a parent subscribes to the optional Multiple Children, Remote Sync & Tamper Alerts add-on, a snapshot of policy configuration (child profiles, devices, schedules, category limits, time-extension requests) is written into this app's own iCloud Drive container on the Mac it's enabled on. From that point on, Apple's own iCloud service -- already signed into that family's Apple ID -- replicates that file to their other Macs, the same way iCloud Drive syncs any other file kept in it. This snapshot is plain JSON, not encrypted, since schedule times and app names are not especially sensitive. The parent's PIN and each device's own tamper-detection heartbeat are never included in what's synced. Turning the subscription off simply stops Guardrail from reading or writing that file; everything already on each device stays fully intact and local.
Applying a schedule (hiding or quitting an app that isn't currently allowed) uses macOS's own Apple Events automation, which prompts for permission the first time Guardrail controls another named app. Guardrail only ever acts on apps that a parent has explicitly configured in a schedule -- it does not enumerate, inspect, or record data from any other app beyond checking whether it's currently running or in the foreground.
A parent's PIN is never stored in plain text. It's hashed on-device using PBKDF2 together with a random secret held in this Mac's own Keychain, and that hash never leaves the device -- it is not included in sync, and we cannot see or recover it. A locally generated recovery code, shown once at setup, lets a parent reset a forgotten PIN; only a hash of that code is stored as well.
Guardrail's app restrictions work by asking macOS to hide or quit a named app -- a visible, reversible nudge, not an unbreakable lock. A child with administrator access on the Mac can always reverse this. The app-quit and clock-change detection features are disclosure only: they tell a parent something happened after the fact, and do not prevent it. None of this changes what data is or isn't collected -- it's mentioned here because we believe a privacy policy for this kind of app should be read alongside an honest account of its real capabilities, not just its data practices.
The one-time base unlock and the optional sync/multi-child subscription are both handled entirely by Apple through the App Store's standard in-app purchase system (StoreKit). Guardrail asks Apple whether a purchase or subscription is active and receives a yes/no answer; we do not receive or store payment information, which is handled exclusively by Apple under Apple's own privacy policy.
Guardrail is intended to be configured by a parent or guardian and used on a device belonging to their own child. The data described above -- category-level app usage, schedule configuration, time-extension requests, and enforcement events -- is the only information Guardrail ever collects about a child's use of the device, it is visible to that child in-app at all times, and it stays local to the family's own device(s) unless the family itself enables iCloud sync as described above. We do not use this data for any purpose other than operating the schedules and limits the parent has configured, and we do not share it with anyone.
If Guardrail's data practices ever change, we will update this policy and revise the effective date above.
Questions about this policy can be sent to: com.webspacein@gmail.com