GardionPrivacy Policy
Effective date: 29 October 2026
Version: 1.6
Data controller and app developer: Aleksandr Viktorovich Popov (individual entrepreneur, INN 343700251016, OGRNIP 320344300015828).
Apps covered by this policy: "Gardion — Parental Control" (io.gardion.family), "Gardion Kids" (io.gardion.kids), the Gardion Windows agent and the web dashboard at gardion.ru.
Contact: app@gardion.io
1. Who we are and what this covers
Gardion is parental-control software for Windows and Android devices. It consists of:
- A parent web dashboard (
https://gardion.io) - An agent installed on the child's device (the Windows agent and/or the Android app
io.gardion.kids) - A parent mobile app (
io.gardion.family, used for notifications)
We act as the data controller under Russian Federal Law No. 152-FZ "On Personal Data". Please note that Gardion is operated from Russia and your data is stored on servers in Russia. We do not claim compliance with the GDPR or with any data-protection regime outside Russia. Read section 5 before you decide to use the service.
2. What we collect
2.1 From the parent (dashboard user)
| Category | Specific fields | Source | Purpose |
|---|---|---|---|
| Identification | Email, password hash (bcrypt) | Sign-up | Authentication |
| Payment information | We never store card numbers. Only the payment ID from the payment provider | Payment provider webhook | Payment records |
| Contact | Sign-up | Support, notifications | |
| Technical | IP address, User-Agent, session timestamps | HTTP requests | Security, abuse prevention |
2.2 From the child's device (Windows agent)
| Category | Specific fields | Purpose |
|---|---|---|
| Device identification | Hostname, machine_uid (a stable hash), platform | Linking the device to the parent account |
| App usage | List of running programs and time spent in each | Screen-time accounting, enforcing limits |
| Browser history | URLs and page titles in Chrome, Edge, Firefox, Yandex | Understanding usage context (optional, can be switched off by the parent) |
| Screenshots | Screen captures taken at the parent's request | Supervision (optional, only when the parent presses the button) |
| Device state | CPU, RAM, battery level, current user | Diagnostics, dashboard display |
| Logs | Technical agent events, bypass attempts | Security, debugging |
2.3 From the child's device (Android app)
| Category | Specific fields | Purpose |
|---|---|---|
| Device identification | Android ID, device name | Linking the device to the parent account |
| App usage | Package names and usage time (UsageStats API) | Screen-time accounting |
| Web filter and site report | The address of the page open in the browser, read through AccessibilityService. It is checked against the parent's block list, and the domains of visited sites go to the server, where the parent reads them in the report | Enforcing the web filter and reporting to the parent |
| Location | GPS coordinates, accuracy, speed, battery percentage | Location in the dashboard, geofences, SOS |
| Geofence events | Enter and exit events for zones set by the parent | Push notifications to the parent |
| SOS signal | Coordinates at the moment the SOS button is pressed | Emergency notification to the parent |
| List of installed apps | Package names and app names on the child's device | The parent chooses what to limit or block |
| Screenshot | A single frame of the screen at the parent's request, when the parent turns this on | The parent sees what the child is doing |
| Steps per day | The step count from the device pedometer, when the parent turns on the walking bonus | Awarding bonus minutes |
| Messages inside Gardion | Messages between the child and the parent in the app | Running the chat |
2.4 Error logs (Sentry)
If the software crashes, we may send:
- The error type and stack trace
- The application version
- The operating-system version
- We do not send message contents, coordinates, or user names
This is optional.
2.5 Gardion Kids diagnostic log
The child's app keeps a separate log of how the app itself is working. We use this log to find the cause when the app does not behave as intended. The log records when the app starts, crashes or freezes; every change to its permissions, together with the name of the app that was on screen at that moment; other apps being installed or removed; and the screen turning on and off. Window titles and button labels are recorded only for system apps and settings screens. Other apps, including messengers, appear in the log by package name only. The log does not store messages, opened pages, typed text or screenshots.
The device keeps the log for 7 days. If the app crashes or loses a permission, entries from the 15 minutes before that are sent to our server. When a parent writes to support, the device sends entries from the last 24 hours, and when we investigate a problem on a specific device, it sends no more than 7 days of entries. Once a day the device sends a summary of how many entries of each type it has, without the entries themselves. Our server keeps the log for 30 days and then deletes it. Only our team reads it, and it is not shared with third parties.
3. What we do not collect and do not do
- We do not record keystrokes (no keylogger)
- We do not read the contents of messengers (Telegram, VK, WhatsApp and others)
- We do not activate the microphone
- We turn on the camera only for the duration of a motion-recognition warm-up break, and only if the parent has enabled that break level. The frames are processed on the device itself, are never sent to our servers and are not stored anywhere. Outside the warm-up the camera is not used
- We do not pass data to third parties for marketing
- We do not show advertising
- We do not put counters or analytics cookies in the parent dashboard or in the apps on devices: there is only the session cookie for login. Visitor counters run on the website pages — see 8.1
- We do not permit the agent to be used to monitor adults, spouses, or anyone other than the user's own minor children
- We do not run hidden on the child's device: the icon is always visible
4. Special rules for children's data
The software is designed to supervise devices of children up to and including the age of 14, and may extend to ages 15 to 17 with consent.
4.1 Parent consent
When the agent is first installed, the parent explicitly confirms, by ticking a box:
- That they are the parent or legal guardian of the child
- That they have read this Policy
- That they consent to processing the minor's personal data under Article 9 of 152-FZ
- The age of the child
The consent is written to an audit log with a timestamp, the parent's IP address and the version of the Policy.
4.2 Consent of children aged 10 and over
If the child's age is given as 10 or above, the parent separately confirms that the child has been told that parental-control software is being installed on their device.
4.3 Withdrawing consent
Consent can be withdrawn at any time by deleting the account (Settings, then Delete account, in the dashboard). After deletion:
- All of the child's data is erased within 30 days
- Paid access ends
- Refunds follow section 5 of the Terms and the Refund policy page
5. Where and how we store data
- Server: Russia, Timeweb Cloud
- Database: SQLite on an isolated server, accessible only to the administrator over an SSH key
- Encryption in transit: HTTPS / TLS 1.3
- Encryption at rest: Passwords use bcrypt with 12 rounds. Agent API keys are stored as SHA-256 hashes, and the key itself is never kept after it is issued.
- Backups: daily, retained for 14 days
- Gardion Kids diagnostic log: 7 days on the device, 30 days on our server
- Retention of active data: for as long as the account exists, plus 30 days after deletion
- Browser history: kept for 3 days, or 30 days on the Premium plan, then deleted automatically. Advertising and tracking URLs are not stored.
Because the servers are located in Russia, using Gardion means your data and your child's data are processed in Russia under Russian law. If that is unacceptable to you, please do not use the service.
6. Data sharing
6.1 Who receives data
| Recipient | What we share | Basis |
|---|---|---|
| The payment provider | Payment amount, email | Contract with the payment provider |
| Sentry GmbH (Germany) | Error logs without personal data | User consent (optional). Sentry is based in Germany, so this is a cross-border transfer. |
| Yandex LLC (Russia) | A visit to a website page: the page address, the referring source, the browser, the country | Consent of the website visitor. Website pages only — never the dashboard or the devices |
| Google LLC (United States), Google Analytics | The same, for pages of gardion.io | Consent of the website visitor. Cross-border transfer |
| Mnogo Prilozheniy LLC (Russia), RuStore push notifications | Only for apps installed from RuStore: the delivery address of notifications on the parent's or child's phone and the event type, as in the Firebase Cloud Messaging row. Message text, the child's name, place, app and site names are not sent | Contract with the user: without it a notification cannot reach the phone |
| Google LLC (United States), Firebase Cloud Messaging | The delivery address of notifications on the parent's phone and the event type, such as "New chat message", "Time request" or "SOS". Message text, the child's name, place, app and site names are not sent; the app fetches the details from our server | Contract with the user: without it a notification cannot reach the phone. Cross-border transfer |
| Resend Inc. (United States) | The parent's email and the text of a service email: sign-in, password reset, a support reply | Contract with the user. Cross-border transfer |
| Yandex.Cloud LLC (Russia), YandexGPT | App names seen on devices, so we can label what a program is and which group it belongs to. The list is shared across all families, with no account, device or launch time. Also service messages about failures and support requests, which the model turns into a summary for us: the account number, phone model, failure description or request text, with no email address | Contract with Yandex.Cloud LLC for cloud services; transfer within Russia. App names are not personal data: an app name does not identify a person |
| Norwegian Meteorological Institute (MET Norway) | The phone's last location rounded to a cell of about 11 km, with no name, account or device ID. Our server sends the request; the phone never contacts the institute. The reply is a forecast (rain, cloudy or clear) that changes the picture on the child's screen | Not personal data: a cell identifies neither a person nor an address. Weather data: MET Norway, CC BY 4.0 licence |
| Russian state authorities | On a properly issued request | 152-FZ, Russian Code of Criminal Procedure |
6.2 Who does not receive data
Family data — the parent, the child and their devices — goes to no one outside the list in 6.1. The visitor counters listed there see website pages only: no name, no device, nothing gathered on a device. Advertising networks receive nothing.
7. Your rights
Under 152-FZ you have the right to:
- Obtain a copy of your data (request it at app@gardion.io)
- Correct inaccurate data
- Delete your data (Delete account in the dashboard, or a request to app@gardion.io)
- Restrict processing
- Complain to Roskomnadzor (address in Russia: Kitaygorodsky proezd 7, building 2, Moscow, 109074)
We respond to requests within 30 days.
8. Cookies
Our own cookie is a single technical one:
session— HttpOnly, Secure, SameSite=Lax, valid for 30 days- Used only to keep you signed in to the dashboard
- Not shared with third parties
- Not used for analytics or advertising
The visitor counters on the website pages set cookies of their own — section 8.1 covers them.
8.1 Website analytics
Visitor counters run on the website itself — the home page, the blog, the pricing pages. On gardion.io these are Yandex Metrica and Google Analytics; on gardion.ru, Yandex Metrica only. They show how many people arrive, which search brought them, which pages they read and which buttons they press. On gardion.ru Metrica also records a click map and a replay of movement across the page, with form input excluded.
The counters start only after the visitor presses "Allow analytics" in the cookie window. "Decline" keeps them off. You can change your choice through the "Cookie settings" link at the bottom of any page; the site works the same either way.
The counters run on the website only. They are not in the parent dashboard, not in the app on the child's phone and not in the program on the computer. Nothing collected on a device reaches them: they see a website page and a visitor's browser, and nothing else.
The counters set their own cookies, and the visit data goes to Yandex LLC (Russia) and, on gardion.io, to Google LLC (United States).
We also count visits ourselves without cookies. The browser gets a random label in the site's local storage. It never leaves our domain and says nothing about the person holding the device.
9. Changes to this policy
We will notify you by email 14 days before any change takes effect.
What changed in version 1.6 (effective 29 October 2026). The child's app keeps a log of how it works and sends part of it to our server when something fails (section 2.5). Retention periods are in section 5.
What changed in version 1.5 (9 October 2026). App names and service failure messages are now processed by YandexGPT in Russia; OpenRouter in the United States no longer receives any data. For apps installed from RuStore, notifications are delivered by the RuStore push service. Both are listed in section 6.1.
What changed in version 1.4 (5 October 2026). Backups are kept for 14 days (section 5). Refunds on account deletion in section 4.3 now follow the Terms.
What changed in version 1.2 (22 September 2026). On the Premium plan, browser history is now kept for 30 days; on other plans it is still kept for 3 days (section 5).
What changed in version 1.1 (11 September 2026). Visitor counters now run on the website pages — see section 8.1, and two recipients were added to the table in 6.1. Nothing changed in how family data is processed: the parent dashboard and the apps on devices carry no counters.
10. Contact
- Email: app@gardion.io
- Postal address available on request at app@gardion.io
This document is a public offer. You accept it by registering an account or by installing the agent on a child's device.