Skip to policy
UNDETERREDBack to home

Undeterred Consumer Health Data Privacy Policy

Effective date: August 28, 2026

Last updated: November 1, 2026

This Consumer Health Data Privacy Policy explains how Prodigal Org, a Texas nonprofit organization recognized as tax-exempt under Section 501(c)(3) of the Internal Revenue Code, doing business as Prodigal.org (“Prodigal,” “we,” “us,” or “our”), collects, uses, shares, and protects consumer health data through Undeterred browser extensions, mobile and desktop apps, websites, and accountability services, including identifiable app-use information when it supports a covered health inference.

This policy applies specifically to consumer health data. Our Terms and Conditions and Privacy Policy describe our broader information practices.

1. Consumer health data covered by this policy

For purposes of this policy, we treat information as consumer health data when it is linked or reasonably linkable to a person and identifies or may support an inference about that person’s physical or mental health status, sexual health or sexual well-being, or use of behavioral or accountability support related to sexual well-being.

An automated block is not a diagnosis, confession, or reliable conclusion about a person. Ordinary pages can be blocked by mistake. We nevertheless treat the categories below conservatively because a flagged URL or use of the Service may reveal or support a sensitive inference.

2. Categories of consumer health data we collect and how we use them

2.1 Flagged browsing activity

When a paid account connects a supported browser or app, we collect each blocked-page event reported by that installation, whether or not the user proceeds. We also collect a separate event when the user chooses to proceed. A blocked page may have been identified by an explicit-content rule, a local page-text signal, optional social-media blocking, or the user’s custom block list.

A particular block or proceed event may not reveal consumer health data. The protections in this policy apply when an event identifies or may support a covered health inference.

An event may include:

  • the reported flagged URL or domain, which may contain a path, permitted query parameters, submitted search terms, or other information placed in the URL by a website;
  • whether the event was a block or a proceed event;
  • the automated signal category;
  • the date and time of the event and receipt;
  • the connected browser and user-supplied device label;
  • an Incognito indicator, when available;
  • a Boolean indicating whether on-screen text was available to the local classifier, but not the text itself; and
  • installation and random monitored identifiers used to associate the event with the correct account and partners.

We use this information to provide the activity feed the user requested, determine whether paid proceed functionality is available, distinguish blocks from proceeds, send limited accountability notifications, investigate reliability or security problems, respond to verified requests, and comply with law.

A reported URL may reveal its domain, path, permitted query parameters, or submitted search terms. Reporting applies redaction designed to remove credentials, fragments, tracking parameters, and recognizable access tokens or private path components. Redaction cannot guarantee removal of every sensitive detail. Some mobile events contain only a domain or no URL, depending on what the platform makes available.

Supported Android versions may also offer optional reporting of a submitted search phrase with a flagged event after a separate device-level choice. General page text and editable form contents are not uploaded as accountability reports.

2.2 Browser and device protection and presence information

For each paid connected browser, we collect information such as the browser family, user-supplied device label, extension version, time zone, connection and last-seen times, recent presence days, no-signal periods, and whether the extension has Incognito access.

We use this information to show whether a connected browser appears to be reporting, alert users and partners to certain protection-status changes, help the user manage connected browsers, troubleshoot the Service, and protect accounts. A loss of signal does not prove that a person removed or disabled the extension; a browser or device may be closed, offline, or unused.

Capabilities differ by operating system, app version, browser, permissions, and selected settings:

  • Browser extensions, including Safari: examine URLs and available visible page text locally, apply blocking rules, and report flagged activity and available extension or private-browsing permission status when accountability is connected.
  • iPhone and iPad: use the Safari extension and, when authorized, Screen Time controls. The app handles authorization and selected restriction state locally and reports available protection status, permission changes, blocked-page or proceed signals, and the URL or domain available for a supported event. Screen Time does not provide us with a complete browsing history.
  • Android: uses local network filtering and, when enabled, Accessibility-based checks of supported browser or app content. Usage Access and installed-app checks can identify supported or unsupported browsers and observed launches. The app can report a blocked domain or available flagged address, detection type, browser or package name, and protection or permission changes. A network request can arise from background activity or embedded content and does not establish that a person deliberately visited or viewed a site.
  • Desktop companion: checks supported browser installations, extension and private-browsing protection, observed unsupported or portable-browser activity, background monitoring, startup settings, and permissions needed for those checks. Reports can include the browser name, protection-change type, time, device label, and installation identifier.

Permissions let the installed software perform the specific checks described here; they do not give Prodigal a complete record of everything a person does on a device. Local settings, credentials, permission state, and pending accountability reports may be retained on the device to operate the Service and retry delivery when connectivity returns.

2.3 Accountability participation and relationship information

We collect the fact that a person enrolled in paid accountability, the email addresses of invited partners, invitation and relationship status, acceptance, decline, removal, and withdrawal dates, the versions of disclosures and consents accepted, and related notification records.

We use this information to administer the accountability relationship, determine whether an active partner exists, control access to the partner portal and proceed functionality, send relationship notices, preserve consent evidence, prevent invitation abuse, and respond to verified requests.

2.4 Sensitive inferences

A flagged URL, event pattern, or use of Undeterred may suggest information about sexual interests, sexual activity, sexual well-being, behavioral support, or related accountability support. We use automated signals only to provide the blocking and accountability functions requested by the user. We do not use them to diagnose a condition, determine sexual orientation, or make advertising, employment, credit, housing, insurance, or other eligibility decisions.

2.5 AI-assisted summaries and derived information

We use OpenAI's API to help classify public website domains associated with recorded accountability events. We send registrable domain names and temporary reference labels. We remove URL paths, query strings, fragments, credentials, and subdomains from this request. We do not include account names, email addresses, partner details, account or installation identifiers, device labels, event times, event counts, page text, screenshots, or search phrases in the AI request.

The model returns domain categories, such as apparently explicit, generally ordinary, or uncertain. Our own software combines those classifications with recorded activity and protection signals to prepare weekly summary records and conversation prompts for the authenticated partner experience. These derived records remain associated with the accountability relationship; removing direct identifiers from the AI request does not make the records we hold anonymous.

AI assessments can be incorrect, incomplete, or outdated. They do not establish what a person viewed, why a request occurred, a person's intent, or a medical or psychological condition. A domain classification does not classify every page on that domain. Partners should review available evidence and discuss it with the monitored person.

2.6 Identifiable mobile app use and diagnostics

Google Analytics for Firebase and Firebase Crashlytics process app-instance and installation identifiers, device and software characteristics, basic app events and screen views, approximate IP-derived location, and crash diagnostics. Collection starts when the mobile app runs, including without an account. We use these records for usage measurement and reliability. Identifiable use of an app concerned with sexual well-being can itself support a sensitive inference; this policy applies to those records when they constitute consumer health data.

We do not add names, email addresses, partner details, browsing URLs, search phrases, page text, or accountability reports to Firebase events or crash reports. Advertising-ID collection and advertising personalization are disabled, and iOS vendor-ID collection is disabled. The apps currently have no in-app analytics or crash-report opt-out. Contact us for applicable withdrawal, deletion, or access requests; an installation identifier may be needed to locate records. Disconnecting accountability does not stop this separate mobile telemetry.

3. Sources of consumer health data

We receive consumer health data from:

  • the monitored user and the account information, choices, consents, browser labels, custom block list, and partner invitations they provide;
  • the Undeterred extensions, mobile apps, and desktop companion connected or used by the person;
  • browser and installation status generated while providing the Service;
  • automated local blocking rules, AI domain classifications, and derived accountability summaries;
  • mobile usage and diagnostic signals processed through Google Analytics for Firebase and Crashlytics; and
  • actions taken by invited or active accountability partners, such as accepting, declining, or withdrawing from a relationship.

We do not obtain consumer health data from data brokers, advertising networks, health care providers, pharmacies, insurers, employers, or public records. We do not collect precise geolocation information or use health-related geofences.

4. How consumer health data is processed

The extension examines URLs and visible page text locally to decide whether to block a page. It does not send page text, matched words, screenshots, images, form contents, messages, passwords, or other page contents to Prodigal. Unflagged browsing URLs are not intentionally sent to Prodigal’s accountability databases.

When a paid connected installation reports an event, the reported address or domain and limited event information described above are encrypted in transit and processed by the hosted Service. Raw accountability events use a random monitored identifier in an activity database. Account, relationship, current protection status, and derived weekly-summary records are held in the identity database. A controlled mapping permits association for authorized partner access, notifications, rights requests, deletion, security, and service operation. These safeguards do not make the hosted information legally deidentified.

5. Consumer health data we share

We may share the following categories:

  • flagged URLs and associated block or proceed information;
  • browser, device-label, Incognito, protection, and presence information;
  • paid-accountability participation and partner-relationship status;
  • derived summary and conversation-prompt information;
  • identifiable mobile app-use and diagnostic information when it supports a covered health inference; and
  • identifiers necessary to provide, secure, support, or delete the Service.

We share these categories only as described below.

5.1 Accountability partners selected by the user

After an invited partner independently accepts, the partner may sign in to see the monitored user’s first name, recent block and proceed events, reported flagged URLs or domains, dates and times, signal categories, browser and device labels, Incognito event indicators, connected-browser status, Incognito-access status, recent presence days, and recent no-signal periods. An active partner may also see recent relationship updates involving another partner, including the other partner’s email address.

Partners may also see available mobile and desktop protection signals, weekly-summary information, and conversation prompts described in Section 2. Partners do not receive the separate Firebase analytics or crash records.

Partners see only events occurring after their acceptance and while their relationship remains active. Removing a partner or a partner’s withdrawal ends future portal access to that monitored person’s information. A partner is an independent person, not a Prodigal employee or processor, and may retain information by taking a screenshot, forwarding an email, or otherwise making a copy. Prodigal cannot retrieve copies held outside its systems.

Notification emails do not include flagged URLs or activity-feed details. They may identify the monitored person by first name, describe an event or status category, and identify an affected partner by email address.

5.2 Service providers

We disclose consumer health data or associated sensitive account information to service providers only as needed to operate the Service. Current providers that may process such information include:

  • Supabase, for account authentication and hosted identity and activity database infrastructure;
  • Vercel, for web hosting, API execution, and operational logs;
  • Resend, for account, invitation, relationship, and accountability email delivery;
  • OpenAI, for the limited domain-classification requests described in Section 2.5;
  • Google Firebase and Google Analytics, for the mobile app-use and diagnostic processing described in Section 2.6; and
  • Stripe, for checkout, subscription management, and payment processing. Stripe does not receive the flagged activity feed or full flagged URLs.

Android DNS resolution. While Android website filtering is active, allowed DNS lookups from apps and browsers routed through the on-device filter are sent to Cloudflare’s 1.1.1.1 public resolver over HTTPS. This includes ordinary, unblocked destinations, not only flagged activity. Cloudflare receives the queried domain names and connection metadata, including the source IP address; DNS queries do not contain full page URLs or page contents. Prodigal does not store these ordinary DNS queries in the accountability feed. Cloudflare’s published resolver policy states that limited resolver logs and truncated IP addresses are deleted within 25 hours, with exceptions for sampled data and aggregated data that may be retained longer. That provider retention is separate from Prodigal’s seven-day accountability retention. See Cloudflare’s public resolver privacy policy.

Other security and platform providers, including Cloudflare and the Apple, Google, and Microsoft app, operating-system, and browser platforms, may process technical information needed to secure, distribute, or run the Service. We do not intentionally provide them with the hosted flagged-activity feed for advertising or profiling.

Service providers must process information for the contracted service and protect it as required by applicable law and their agreements with us.

5.3 Legal and organizational recipients

We may disclose consumer health data when reasonably necessary to comply with law or valid legal process; protect the rights, safety, and security of users, Prodigal, or others; investigate fraud or abuse; or establish, exercise, or defend legal claims.

If Prodigal undergoes a merger, reorganization, financing, bankruptcy, or transfer of the Service, information may be disclosed as part of that transaction subject to applicable confidentiality, consent, and consumer health data requirements.

Prodigal has no affiliates with which it shares consumer health data as of the effective date of this policy.

6. No sale, advertising, or third-party tracking

We do not sell consumer health data. We do not use or disclose it for targeted advertising, cross-context behavioral advertising, data brokerage, or unrelated profiling.

We do not permit an advertising network or other third party to collect consumer health data over time across unrelated websites or online services when a person uses our websites, extension, or partner portal. The extension’s local examination of browser pages is performed to provide the user-requested filtering and accountability functions described in this policy.

7. Consent and withdrawal

Accountability setup presents two independently selectable permissions, separate from general Terms acceptance: collection and processing of accountability information, including disclosed AI domain classification, and sharing accountability information with invited partners who accept. Both permissions are required to activate paid accountability. We record each permission and its disclosure version separately. Optional Android submitted-search-phrase reporting, where available, has an additional device-level choice. Mobile analytics and crash collection operate as described in Section 2.6. Reading this policy or accepting general Terms does not itself provide any separate consent required by law.

Accountability collection and partner sharing are essential parts of the same paid service. To stop accountability immediately, use “Delete account” in your account settings. This ends billing, revokes connected devices and partner access, and deletes your account, stored accountability activity, and reports. You may also contact accountability@prodigal.org to withdraw consent or exercise applicable privacy rights. There is no separate setting to stop all partner sharing while keeping the accountability subscription. If you schedule subscription cancellation for the end of a paid period through the secure billing portal, service and processing continue until that date.

Removing a partner immediately ends that partner’s access and deletes that relationship’s stored summary. We also delete the report history that partner could access, except for history another active partner still needs. This applies when a partner steps down or deletes their account. Shared records remain subject to the ordinary retention limits. Cleanup is queued for automatic retry if it cannot finish immediately. Current device status and ongoing protection interruptions may remain while needed to operate the service. Already-delivered emails and copies independently held by partners cannot be recalled; applicable deletion rights and recipient obligations still apply.

Paid accountability and proceed functionality cannot operate without the collection and sharing needed to provide them. Withdrawal therefore ends the accountability subscription. Free local blocking features remain available.

After subscription cancellation without account deletion, your sign-in, billing records, and limited consent or cancellation evidence may remain for account administration and applicable legal obligations. Deletion from backups and third-party systems is subject to applicable retention requirements; already-delivered emails and copies independently held by partners cannot be recalled. Canceling accountability does not disable separate mobile crash diagnostics or usage analytics described in this policy. You may separately exercise applicable access, deletion, correction, and appeal rights.

8. Consumer rights and requests

Subject to applicable law, you may have the right to:

  • confirm whether we collect, use, share, or sell consumer health data about you;
  • access the consumer health data we maintain about you;
  • receive a list of third parties and affiliates with whom we shared or sold your consumer health data and available contact information for them;
  • review and request correction of inaccurate consumer health data;
  • withdraw consent and ask us to stop future collection or sharing;
  • request deletion of consumer health data;
  • appeal our refusal to act on a request; and
  • exercise these rights without unlawful discrimination.

You may submit a request or appeal by emailing accountability@prodigal.org. You may also use the authenticated account-deletion control for permanent account deletion. Describe the right you want to exercise and provide the email address associated with the Service. We may take commercially reasonable steps to authenticate your identity and authority. We will not require you to create a new account solely to make a request, although we may ask you to use an existing authenticated account.

We will respond without undue delay and within the period required by applicable law, generally within 45 days. Where permitted and reasonably necessary, we may extend the response period once and will explain the extension. If we deny a request, we will explain the decision and how to appeal. If an appeal is denied, we will provide information about contacting the appropriate state attorney general where required.

If we grant a valid deletion request, we will delete the covered information from our active systems and notify applicable processors, contractors, affiliates, and other third parties as required by law. We will include applicable recipients, including accountability partners, in legally required deletion notifications. A partner must honor a deletion request when applicable law requires it; our inability to retrieve an independent copy does not waive that obligation.

9. Retention and deletion

We use the following ordinary retention schedule for information that may include or be associated with consumer health data:

  • raw browser block and proceed events, mobile protection events, and desktop bypass or protection events are scheduled for deletion 7 days after receipt; delayed reports may describe activity up to 30 days earlier, with the original activity time preserved. Live Proceed overrides use server receipt time;
  • weekly summary text, supporting references, and generation metadata expire no later than 7 days after the reporting period ends and are scheduled for deletion at expiry; the relationship’s summary is removed when the relationship ends or its acceptance changes. Derived records may outlast individual raw events from that week;
  • capability observations and private-browsing change records are scheduled for deletion after 7 days; resolved protection-interruption records after 7 days from restoration. Current status and unresolved interruptions may remain while needed to explain coverage;
  • daily browser-presence entries are retained for up to 14 days;
  • resolved browser no-signal episodes are scheduled for deletion after 30 days;
  • expired, declined, or withdrawn-before-acceptance invitation and delivery records are scheduled for deletion after 90 days;
  • notification-job metadata is scheduled for deletion after 90 days;
  • an accepted relationship and versioned consent evidence are retained while active and for up to 2 years after the relationship ends, unless the account is deleted sooner;
  • identity and security audit records are scheduled for deletion after 2 years; and
  • local extension information remains in browser storage until removed by the extension, browser, reset action, or uninstall process.

Installation, account, subscription, support, and security records are retained while needed to provide the Service and afterward as reasonably necessary for payment, tax, accounting, fraud prevention, security, dispute resolution, and legal obligations. We do not retain sensitive information longer than reasonably necessary for a disclosed purpose.

Mobile analytics and crash records follow the configured Google Analytics and Firebase retention settings, separate from the seven-day accountability feed. Disconnecting accountability does not automatically delete these records. OpenAI requests disable retrievable response storage, but provider security and abuse-monitoring retention may still apply; we do not promise zero retention. See Firebase privacy information and OpenAI API data controls.

Managed database backups are retained for up to 7 days before rotation. If a backup is restored, we will reapply applicable deletion and retention controls before returning the restored system to ordinary use.

10. Security and limited human access

We use administrative, technical, and organizational safeguards designed for the sensitivity of the information, including transport encryption, separate identity and activity databases, random monitored identifiers, hashed browser credentials, service-role access controls, restricted partner access, short-lived security tokens, anti-bot challenges, rate limits, and event idempotency.

Prodigal personnel do not routinely review flagged URLs. Authorized personnel may access limited information when necessary to provide support with your specific consent, investigate security or abuse, maintain the Service, respond to a verified request, or comply with law. No security measure is perfect.

11. Changes to this policy

We may update this policy to reflect product, provider, or legal changes. We will post the updated version and revise the date above. We will provide additional notice of material changes where appropriate. Posting this policy does not retroactively authorize processing or replace any required consent. Before collecting, using, or sharing an additional category of consumer health data, or using it for an additional purpose not disclosed here, we will provide the disclosure and obtain affirmative consent when required by law.

12. Contact

Prodigal Org

Consumer health data requests and appeals: accountability@prodigal.org

Mailing address: 5900 Balcones Drive, STE 12393, Austin, TX 78731