Browser Monitor is a parental control: a browser extension a parent installs on their child's browser, and a service that checks new sites and searches against the rules the parent sets. It is in a private pilot. A family can use it only after a parent has made an account, read a notice of what is collected and consented to it.
From a child's browser, only after a parent has consented, and only from a browser that parent has paired:
| What | When | Kept |
|---|---|---|
| The site name, the page path with long identifiers removed, and the words of a search | When the child opens a site or makes a search that the family's lists do not settle | In the decision record. Search words are kept only if the parent chose that; otherwise nothing derived from them is kept. |
| The visible text of an open page, in pieces of at most 6,000 characters | While the page is open, as it changes | Not kept after the decision, apart from a 280-character excerpt stored with a block |
| A record of each block, each request to the parent, and each check that could not be made | As they happen | 90 days |
| A history of allowed searches and page visits, with the scores for each | Only if the parent chose to keep a history of allowed activity | 90 days (30 days, as samples, under a consent given before 22 October 2026) |
| The scores the checking model gave each site, search or page, with the time, and no address or text | Every check, as required processing, to tune the rules against the parent's answers and to notice patterns across days | 90 days |
| A cache of recent verdicts: a keyed hash of the site or search, searches included, with its verdict. The key is held apart from the database; the operator holds both | Every check of a site or search, as required processing, per child | Up to 7 days |
| Text of allowed searches and pages held for a second opinion | A sample, only under the history choice | Until the second opinion is given, at most 48 hours; a 280-character excerpt is kept with a disagreement, 90 days |
| The extension's own status: versions, rule counts, whether its checks pass, when it last made contact | Every 15 minutes while the browser is open | With the device registration |
Not collected: passwords, cookies, form contents, the query string of an address on an ordinary site, images, video, or anything typed into a page.
Never collected, for any family: the text of pages on webmail, messaging and direct-message views, banking and payment sites, health and counselling services, and school record systems. Other people's communications appear on those pages. A parent cannot turn this on.
From a parent: an email address, a name, a password (stored as a hash), their rules and lists, their answers to requests, and the record of their consent.
| Recipient | What | Why |
|---|---|---|
| TypeSafe (the Jev model) | The site, path and search words, or the page text | To answer the family's yes-or-no questions about it. |
| Anthropic | What the parent writes about the child's rules, and their weekly check-in answers. From the child's browsing, only where the parent chose to keep a history of allowed activity: the previous day's allowed searches, searches blocked repeatedly, a sample of allowed searches and page text, and the week's unclear searches and excerpts | To draft rules for the parent to approve, to propose block terms, to give a second opinion on what the rules may have missed, and to write the weekly check-in. |
| Amazon Web Services | Everything above, stored encrypted | The service and its email run on AWS. |
A concern alert tells a parent at once when a high-risk rule (self-harm, or content that promotes disordered eating) blocks something with a very high score. It is an automated check of text, not a diagnosis, and it is not an emergency service. Notifications to parents contain no search and no address. The information is used only to operate the parental control for that family. It is not sold, and it is not used for advertising.
| Record | Period |
|---|---|
| Page text sent for judgment | Not stored after the decision, apart from the excerpt kept in a block's record |
| Decision records for blocks and requests | 90 days |
| The consented history of allowed activity | 90 days |
| Scores, with no address or text | 90 days |
| The verdict cache | Up to 7 days |
| Text held for a second opinion | 48 hours at most |
| Second opinions | 90 days |
| The queue on the device | Until upload is confirmed, and at most 7 days |
| Infrastructure logs, which contain no addresses or searches | 30 days |
| Backups | 35 days, rolling |
| Policy versions, review proposals, check-in answers, consent and deletion audit records | Life of the account |
| A parent's corrections and each "don't ask again" | Life of the account; deleted with the child's data |
Access to what was recorded, export of all of it, deletion of a child's data, and withdrawal of consent, all from the dashboard and all immediate. Withdrawal stops checking by the service and cancels queued reviews; the family's lists and switches keep working in the browser. A deletion is gone from backups 35 days later. Deletion at the providers is governed by their agreements.
The extension's toolbar button says that filtering and monitoring are on, what they do, and that a parent set them up. Every block page says a parent set it up and offers a request to the parent. A block page for a self-harm or eating-disorder rule also shows support lines, and says in general terms that a parent can see when this happens.
Questions about this policy, or a request about a child's data: matt@irvin-group.com.