Privacy policy

What information does StudyLock collect?

StudyLock is a parent-managed Chrome blocker: a parent sets it up and manages it, and it enforces the rules on a child's own Chrome browser. It collects only what it needs to run that service.

From a parent

• An email address, used to sign in — either with a password, or by continuing with a Google account.
• For each child profile a parent creates: a name (up to 60 characters) and, optionally, an age band ("ages 5–9" or "ages 10–14") used to seed a starting rule set.
• The block/allow rules and focus schedule a parent sets for each child profile.

From a child's Chrome extension

• A daily aggregate count for each child profile: minutes of active use and the number of blocked-page attempts, stored as whole numbers against a date — never a list of sites.
• If a child taps "Ask" on a blocked page, the single site name requested, together with whether a parent later approved or denied it.
• A device identifier for the paired Chrome browser. StudyLock's server stores only a one-way hash of this identifier, not the identifier itself.
• A one-time, six-digit pairing code used to link a new device, which expires ten minutes after it is issued.

What does StudyLock never collect?

The extension does not collect a child's browsing history, the pages they visit, page titles, or search queries. The extension contains no code that reads page content, and declares no content scripts and no scripting permission, so it cannot inject code into a page a child visits. A permanent test fails the build if a page-reading call ever appears. The blocked-page screen itself sets no cookies, uses no web storage, and does not read the address of the page a child came from — it only reads the address of the site it is blocking, so it can show the child what triggered the block. The only site name that ever leaves the device is the one a child explicitly asks a parent to unblock.

Where does this information go?

Information moves in two directions, and only between a family's own devices and StudyLock's own server:

• Down — when a parent changes a child's rules or schedule, that change reaches the child's Chrome the next time it checks in, roughly every 30 to 300 seconds.
• Up — the child's Chrome sends only the daily aggregate counts described above, and — if the child taps "Ask" — the one site name requested. StudyLock's extension does not talk to any advertising network, analytics provider, or other third-party service; StudyLock's own server is the only destination.

StudyLock's own systems store this data to run the service — on Supabase (database) and Fly.io (hosting) as infrastructure providers — and StudyLock does not sell it or share it with advertisers or data brokers.

Service providers: Supabase, Fly.io.

Who can see a child's information?

Through the dashboard, only the parent or parents who share that child's profile can view it. If two parents share a profile using co-parent shared profiles, each can view the same information for that child. Access is scoped by family at the database level, so one family's information is never reachable from another family's sign-in session.

How long does StudyLock keep information?

• A child's profile, its rules, and its daily aggregate counts are kept for as long as the profile exists.
• A resolved site-access request — one a parent has approved or denied — is automatically deleted after 90 days.
• A pairing code is deleted, or simply expires, within ten minutes of being issued, whether or not it is used.

How can a parent delete this information?

A parent can permanently delete their account and its data at any time from the StudyLock dashboard, or by emailing privacy@studylock.org. Deleting an account removes every child profile in that family, along with its rules, aggregate counts, and site-access requests, and revokes sign-in for that account.

If a child's profile is shared between two parents through co-parent shared profiles, a parent who deletes their own account leaves the shared family — the profile and its data stay intact for the remaining parent. The profile itself is deleted only when the last parent sharing it deletes their account.

Is information collected directly from a child?

StudyLock is built for a parent or guardian to manage their own child's Chrome browser. A child does not sign up, does not create an account, and does not enter an email address or any other personal information into StudyLock directly — a parent creates the child's profile and chooses its name and age band.

How is this information kept secure?

• All communication between the extension and StudyLock's server uses HTTPS.
• A paired device's identifier is stored as a one-way hash, never in plain form.
• A family's data is scoped by row-level access rules in StudyLock's database, so it is reachable only through that family's own sign-in.

Does StudyLock use cookies or third-party tracking?

The StudyLock dashboard uses a single first-party cookie to keep a parent signed in. It does not use third-party advertising or analytics cookies, and does not show ads or integrate with any ad network. The Chrome extension itself uses no cookies at all.

What happens if this policy changes?

StudyLock will update the "last updated" date at the top of this page whenever this policy changes, and will describe any material change on this page.

How can someone contact StudyLock about this policy?

Questions about this policy, or a request to access, correct, or delete information, can be sent to privacy@studylock.org.