Privacy Policy

Filter Guard helps block requests to advertising and tracking domains on personal iPhones and iPads running iOS 26 or later. It uses Apple's URL-filtering system. You do not need a Filter Guard account or device management enrollment.

Apple's operating system checks participating URL requests against a compact filter on your device. Possible matches use private information retrieval to check the filtering service without sending the requested URL in readable form. The distributed service is designed to use Apple's relay to separate your network address from the filtering service. This describes the intended distributed consumer service; developer-installed test builds may connect directly.

The consumer app does not receive a browsing history or a list of your blocked requests from this filtering system. It does not show per-app traffic history. Filter Guard's current consumer interface contains no advertising or third-party analytics SDK. We do not use filtering queries for advertising profiles.

These protections apply to filtering lookups. Purchase setup, device verification, and a support request are separate communications and are described below. They are not anonymous merely because filtering uses private lookups.

When you choose Test blocking, an embedded browser opens test.filterguard.app and requests a harmless test resource at blocked.filterguard.app. These ordinary website connections go directly to our Cloudflare-hosted test service; they do not use the anonymous PIR lookup transport. The hosting provider processes connection data, including network addresses and security metadata, to deliver and protect the website.

The diagnostic does not send purchase credentials, installation identifiers, browsing history, or the displayed result to our service. It does not use cookies or usage analytics. The result remains in the page, and the embedded browser uses temporary website storage. A result describes only these test requests and does not identify which filter prevented a request from loading.

Apple processes subscriptions and payment information. Filter Guard does not receive your payment-card number. To confirm access, the app sends Apple-signed purchase and app-transaction evidence to our enrollment service. We verify it with Apple and use subscription identifiers, product identifiers, subscription status, and expiration or renewal information to authorize the service.

We use Apple's App Attest to help verify genuine installations and prevent abuse. Our service receives cryptographic proofs and a device-verification value. It stores an installation identifier, an App Attest key identifier and public key, a hash of the device-verification value, replay-prevention information, and the relationship between an installation and its subscription. These records can be linked to your subscription even though we do not ask for a name or email to sign up.

A service credential is stored in the device's Keychain and in the system's filter configuration. The service stores a hash and an encrypted recoverable copy of the credential. Local recovery state may temporarily include signed transaction material while setup is incomplete. Removing the app does not itself cancel an Apple subscription or erase all server-side records.

Apple supplies payment, device-attestation and system-filtering services. Cloudflare hosts Filter Guard's enrollment, gateway, and filtering infrastructure. Cloudflare Email Routing forwards support email to our Fastmail mailbox. Fastmail stores and processes that correspondence so we can respond to support and privacy requests. Providers process data needed to deliver and protect those services, such as network addresses, request timing, and security or reliability metadata. The private-query design does not make all operational metadata invisible to every provider.

Our application code avoids logging raw purchase evidence, service credentials and readable filtering URLs. We use these providers to operate the service, not to build advertising profiles. Their handling of operational data is also subject to their applicable privacy and service terms.

These support and policy pages do not use advertising, analytics scripts or cookies set by our website code. Cloudflare processes connection and security data to serve and protect the pages. Clicking an email link opens your email app; you decide whether to send a message.

If you contact support, we receive the message and information you include. Please send only the app version, iOS version, the problem, and whether turning protection off changes it. Do not send passwords, payment details, service credentials, purchase receipts, or private full URLs. If a public domain is needed to investigate a problem, we will ask for it.

We keep installation and subscription-access records while needed to provide an active service. We delete inactive installation and subscription-access records within 90 days after the associated service access ends. We delete resolved support emails within 12 months after the support request is closed.

We may retain the minimum records necessary for fraud prevention, security, an unresolved dispute, or a legal obligation beyond these periods. We limit access to those records and review whether continued retention is necessary. Apple maintains its own purchase records under its policies. Canceling a subscription does not immediately erase records held by Apple.

The filtering service also stores cryptographic material used to answer private queries and prevent token reuse. These records do not contain a readable list of requested websites. Operational and backup copies may persist separately from active records under our providers’ retention processes.

You can turn filtering off at any time in Filter Guard. Manage or cancel your subscription through your Apple Account. Uninstalling the app does not cancel billing. Contact hello@filterguard.app to request access to or deletion of information we control. We will verify requests in a way appropriate to the records involved. Please start with a description of your request. We will ask only for information needed to locate the relevant records and verify your authority to make the request. Never send your Apple Account password, payment-card details or service credentials. We will explain any records we must retain and why. Deleting access records may require you to restore or set up protection again.

We will update the effective date when this policy changes. Material changes will be explained through the app or the published policy as appropriate. Questions can be sent to hello@filterguard.app.