Skip to policy
UNDETERREDBack to home

Undeterred Privacy Policy

Effective date: August 28, 2026

Last updated: November 1, 2026

This Privacy Policy applies to Undeterred, including its browser extensions, iOS and Android apps, desktop companion apps, account and partner portals, and related paid accountability services provided by Prodigal.org.

1. Scope and who controls the information

This Privacy Policy explains how Prodigal Org, a Texas nonprofit organization recognized as tax-exempt under Section 501(c)(3) of the Internal Revenue Code, doing business as Prodigal.org, handles personal information through the Service. Prodigal determines the purposes and means of this processing and is the controller or business responsible for the information, except where a service provider acts under its own legal responsibilities.

This Policy covers monitored users, free-extension users, paid account holders, invited and active accountability partners, website and portal visitors, and people who contact support.

Privacy contact: accountability@prodigal.org

2. The important points

  • The extension examines URLs and visible page text locally to provide blocking. It does not send page text, screenshots, images, or unflagged URLs to Prodigal’s accountability databases.
  • Free blocking does not require an account. Local settings remain in the browser unless you connect paid accountability.
  • Paid accountability transmits every flagged blocked-page event, not only pages you proceed past. This can include social-media and custom-list blocks.
  • Active partners can sign in to see reported flagged URLs or domains, available event and device-protection information, and weekly summary or conversation-prompt information. They may also see recent partner-relationship changes. Notification emails do not contain flagged URLs.
  • Raw accountability events are stored in an activity database under a random identifier. Account, relationship, protection-status, and derived weekly-summary records are held in the identity database. Controlled services associate these records to operate accountability; this is not anonymization.
  • We do not sell personal information, use it for targeted or cross-context behavioral advertising, or build advertising profiles.
  • Account existence and flagged activity can be sensitive. We minimize this information and limit its purpose to the accountability service requested.

3. Information handled by installed software

3.1 Browser extension processing

The extension handles the following information on your device:

  • URLs requested in the browser and visible page text needed to apply local blocking rules;
  • a temporary record of recent top-level navigation needed to identify the URL that caused a browser-level redirect;
  • social-media blocking preferences and your custom block list;
  • onboarding state, entitlement cache, connected-account details, browser installation identifiers, and the credential used to authenticate a paid installation;
  • temporary blocked-page and proceed state; and
  • whether Chrome or Edge allows the extension in Incognito.

Local page scanning does not send page text, matched words, screenshots, form entries, passwords, cookies, messages, or images to Prodigal. The browser may delete session data when the session ends, and you can remove other local data by resetting the extension or uninstalling it, subject to browser behavior.

3.2 Mobile and desktop processing

Capabilities differ by operating system, app version, browser, permissions, and selected settings:

  • Browser extensions, including Safari: examine URLs and available visible page text locally, apply blocking rules, and report flagged activity and available extension or private-browsing permission status when accountability is connected.
  • iPhone and iPad: use the Safari extension and, when authorized, Screen Time controls. The app handles authorization and selected restriction state locally and reports available protection status, permission changes, blocked-page or proceed signals, and the URL or domain available for a supported event. Screen Time does not provide us with a complete browsing history.
  • Android: uses local network filtering and, when enabled, Accessibility-based checks of supported browser or app content. Usage Access and installed-app checks can identify supported or unsupported browsers and observed launches. The app can report a blocked domain or available flagged address, detection type, browser or package name, and protection or permission changes. A network request can arise from background activity or embedded content and does not establish that a person deliberately visited or viewed a site.
  • Desktop companion: checks supported browser installations, extension and private-browsing protection, observed unsupported or portable-browser activity, background monitoring, startup settings, and permissions needed for those checks. Reports can include the browser name, protection-change type, time, device label, and installation identifier.

Permissions let the installed software perform the specific checks described here; they do not give Prodigal a complete record of everything a person does on a device. Local settings, credentials, permission state, and pending accountability reports may be retained on the device to operate the Service and retry delivery when connectivity returns.

4. Information collected by the hosted Service

4.1 Account and authentication information

We collect your email address, first name, account identifier, password-related authentication records handled by our authentication provider, email verification and password-reset status, session information, and dates and versions associated with account registration and legal acceptance. We also record that an account holder represented that they were an adult and a U.S. resident.

For partner invitation and account-connection flows, we may process unique, time-limited invitation, confirmation, recovery, activation, and authorization tokens. A valid partner invitation link may establish access to the invited email address for the invitation flow without requiring a second email-confirmation step. We also process authentication-attempt, rate-limit, and anti-bot challenge information to protect accounts and the Service.

We do not receive your plaintext password from the authentication provider.

4.2 Subscription and payment information

Stripe collects payment-card and billing information. We receive and store limited subscription information such as Stripe customer and subscription identifiers, selected price, subscription status, renewal or period-end date, and scheduled cancellation status. We do not store full card numbers.

4.3 Browser installation and protection-status information

For connected browsers and apps, we collect an installation identifier, browser or platform family, user-visible device label, app or extension version, time zone, connection and last-seen timestamps, and available protection and presence records. These can include private-browsing access, Screen Time authorization, network-filtering and Accessibility status, Usage Access, notification permission, background monitoring, and other protection settings described in Section 3.2. We retain current status, observed changes, and interruption or restoration records to explain coverage.

A heartbeat contains status information and does not contain a browsing URL. The absence of a heartbeat is not proof that the extension was disabled or removed; the browser or device may simply be closed, offline, or unused.

4.4 Flagged activity

For a paid, connected installation, we collect the supported blocked-page, blocked-network-request, or content-detection event when the software reports it. This can occur because of explicit content rules, page-text signals, optional social-media blocking, or a custom block-list rule. We also collect a separate event when the user chooses to proceed.

Each event may include:

  • the reported flagged URL or domain, which may contain a path, permitted query parameters, submitted search terms, or other information placed in the URL by a website;
  • block or proceed event type;
  • event and receipt timestamps;
  • automated signal category;
  • a Boolean indicating whether on-screen text was available to the local classifier;
  • browser family and device label;
  • installation and random monitored identifiers; and
  • Incognito status, if applicable.

A reported URL may reveal its domain, path, permitted query parameters, or submitted search terms. Reporting applies redaction designed to remove credentials, fragments, tracking parameters, and recognizable access tokens or private path components. Redaction cannot guarantee removal of every sensitive detail. Some mobile events contain only a domain or no URL, depending on what the platform makes available.

We do not upload page-body text, screenshots, images, passwords, messages, or editable form contents as accountability reports. Where a supported Android version offers optional submitted-search-phrase reporting, the feature uses a separate device-level choice and sends the bounded submitted phrase with the flagged event only when enabled. This is distinct from general screen-text collection. URLs themselves may also contain submitted search terms. We do not intentionally collect or retain unflagged URLs in the hosted activity feed.

4.5 Accountability partner information

When a user invites a partner, we collect the invited email address, invitation and expiration records, delivery status, relationship status, and dates of invitation, acceptance, decline, removal, withdrawal, or consent. If the partner accepts, we associate the relationship with the partner’s separately authenticated account and record the partner-consent version and displayed policy version.

We create relationship-status and notification records used to tell the monitored user and affected partners when a partner accepts, declines, is removed, or withdraws. An active partner may see recent status changes involving another partner, including that partner’s email address and the type and time of the change. Ending one relationship removes access to that monitored person’s information but does not automatically delete the partner’s authentication account or unrelated relationships.

4.6 Communications and support

We collect information you choose to include in support requests, privacy requests, feedback, or other communications. Do not send flagged URLs, passwords, payment-card information, or other sensitive material through ordinary support email unless we specifically request it through a secure method.

4.7 Technical, security, and operational information

Our websites, APIs, and service providers may automatically process IP address, request time, user agent, referring page, authentication and session metadata, error information, and security logs. We use this information to deliver the Service, prevent abuse, troubleshoot failures, and protect accounts and systems. We do not use advertising trackers in the extension or partner portal.

Forms used for account registration, sign-in, password reset, account connection, and partner acceptance may use Cloudflare Turnstile. Cloudflare processes browser, client, and network-environment signals needed to distinguish people from automated traffic and produces a short-lived challenge token. We or our authentication provider receive and validate the token and challenge result. Turnstile is used for security, not advertising.

4.8 Essential browser storage

The account, activation, password-reset, and partner portals use browser storage or similar technologies provided by our authentication tools to keep you signed in, complete a requested flow, remember security state, and prevent abuse. The extensions use their browser’s extension storage for the local data described in Section 3. We do not use these technologies in the extension or partner portal for targeted advertising or cross-site advertising tracking.

4.9 Mobile app analytics and crash diagnostics

Our iOS and Android apps use Google Analytics for Firebase and Firebase Crashlytics to measure app usage, diagnose failures, and improve reliability. Collection starts when the app runs, including without an account.

Google receives app-instance and installation identifiers, app and operating system versions, device characteristics, basic app events such as opening the app, sessions and screen views, and crash and diagnostic information. We also send a fixed app-start event without additional fields. Analytics derives approximate location from the network IP address; it does not use GPS or request device location permission. Crash diagnostics can include stack traces, exception messages, relevant app state, and recent basic app events.

We do not add account names, email addresses, partner details, browsing URLs, search queries, page text, or protection reports to Firebase events or crash reports. Generated identifiers can distinguish installations, so this data is not anonymous merely because it omits your name. This collection is separate from accountability reports.

Advertising-ID collection and advertising personalization are disabled in our mobile apps. The iOS app also disables vendor-ID collection. These services are used for usage measurement and reliability, not targeted advertising.

4.10 AI-assisted weekly summaries

We use OpenAI's API to help classify public website domains associated with recorded accountability events. We send registrable domain names and temporary reference labels. We remove URL paths, query strings, fragments, credentials, and subdomains from this request. We do not include account names, email addresses, partner details, account or installation identifiers, device labels, event times, event counts, page text, screenshots, or search phrases in the AI request.

The model returns domain categories, such as apparently explicit, generally ordinary, or uncertain. Our own software combines those classifications with recorded activity and protection signals to prepare weekly summary records and conversation prompts for the authenticated partner experience. These derived records remain associated with the accountability relationship; removing direct identifiers from the AI request does not make the records we hold anonymous.

AI assessments can be incorrect, incomplete, or outdated. They do not establish what a person viewed, why a request occurred, a person's intent, or a medical or psychological condition. A domain classification does not classify every page on that domain. Partners should review available evidence and discuss it with the monitored person.

Our AI requests disable storage of the response as retrievable application state. This setting does not by itself eliminate provider security or abuse-monitoring retention. Provider handling is subject to the applicable service terms and data controls; see OpenAI API data controls. We do not represent that these requests have zero retention.

5. Consumer health data

Flagged URLs, associated activity, device-protection information, derived summaries, and identifiable use of the Service may reveal or support an inference about sexual health, sexual well-being, behavioral support, or other sensitive matters. An automated block is not a diagnosis, confession, or reliable conclusion about a person, and an ordinary page may be blocked by mistake.

We conservatively address these categories in a separate Consumer Health Data Privacy Policy, available through the distinctly labeled link on our homepage, account and activation pages, and extension settings. That standalone policy explains the categories and sources of consumer health data, how it is processed and shared, the applicable consent and withdrawal choices, retention, and how to exercise access, deletion, correction, and appeal rights.

6. How we use information

We use personal information to:

  • provide local blocking, account activation, browser connection, paid accountability, partner access, and requested proceed functionality;
  • determine subscription and partner eligibility for paid features;
  • send account verification, password reset, billing, invitation, partner-relationship, accountability, Incognito-status, presence, and security communications;
  • operate the authenticated partner portal, prepare the AI-assisted summaries and conversation prompts described in Section 4.10, and display the information described in this Policy;
  • process payments, cancellations, and subscription status;
  • provide support and respond to rights requests;
  • secure, debug, maintain, and improve reliability of the Service without using browsing activity for unrelated product development;
  • enforce the Terms, apply authentication and invitation rate limits, prevent abuse, and protect users and the Service; and
  • comply with law and valid legal process.

We do not use flagged URLs or account information for advertising, targeted advertising, data brokerage, credit, employment, housing, insurance, or other eligibility decisions.

7. How information is disclosed

7.1 Accountability partners you direct us to involve

After a partner independently accepts, we make the following available in the authenticated partner portal for the monitored person: first name; recent blocked and proceed events; reported flagged URL or domain; date and time; signal category; browser and device label; Incognito event indicator; connected-browser status; Incognito-access status; recent presence days; and recent no-signal periods. Partners may also see the supported mobile and desktop protection signals described in Section 3.2 and available weekly-summary or conversation-prompt information described in Section 4.10.

Partners see only events occurring after their acceptance and while their relationship remains active. A notification email may identify the monitored person by first name and describe a category of event or status, but does not include a flagged URL or activity-feed detail.

For up to 7 days, an active partner may also see relationship updates showing that another invited partner accepted, declined, was removed, or withdrew. The update may include the other partner’s email address and the date and time. We may send corresponding relationship-status emails to the monitored user, the affected partner, and any remaining active partner. These emails may identify the monitored person by first name and the affected partner by email address, but do not include flagged URLs or activity details.

When a relationship ends, that partner’s access to the monitored person’s events, status, and relationship updates ends immediately. The partner may still be able to sign in to their account to access another active relationship or an empty account state.

7.2 Service providers

We disclose information to service providers only as needed to operate the Service. Current core providers include:

  • Supabase, for account authentication and hosted PostgreSQL database infrastructure;
  • Vercel, for web hosting, API execution, and operational logs;
  • Google Firebase and Google Analytics, for mobile app usage measurement, installation identifiers, approximate location, and crash diagnostics as described in Section 4.9. See Privacy and Security in Firebase and Google Analytics data practices;
  • OpenAI, for API-based domain classification used in weekly summaries, with the limited inputs described in Section 4.10;
  • Stripe, for checkout, payment processing, subscriptions, and the billing portal;
  • Resend, for account, invitation, and accountability email delivery;
  • Cloudflare, for Turnstile anti-bot challenges and Android DNS resolution as described below;
  • Healthchecks.io, for scheduler availability monitoring using operational run signals that are not designed to include account or flagged-activity information; and
  • Apple, Google, and Microsoft app, operating-system, browser, and extension platforms, which distribute or run supported software and process information under their own terms.

Android DNS resolution. While Android website filtering is active, allowed DNS lookups from apps and browsers routed through the on-device filter are sent to Cloudflare’s 1.1.1.1 public resolver over HTTPS. This includes ordinary, unblocked destinations, not only flagged activity. Cloudflare receives the queried domain names and connection metadata, including the source IP address; DNS queries do not contain full page URLs or page contents. Prodigal does not store these ordinary DNS queries in the accountability feed. Cloudflare’s published resolver policy states that limited resolver logs and truncated IP addresses are deleted within 25 hours, with exceptions for sampled data and aggregated data that may be retained longer. That provider retention is separate from Prodigal’s seven-day accountability retention. See Cloudflare’s public resolver privacy policy.

Provider roles and vendors may change. We require providers handling personal information for us to process it for contracted purposes and protect it as required by applicable law.

7.3 Legal, safety, and organizational disclosures

We may disclose information when we reasonably believe it is necessary to comply with law or valid legal process; protect the rights, safety, and security of users, Prodigal, or others; investigate fraud or abuse; or establish, exercise, or defend legal claims.

If Prodigal undergoes a merger, reorganization, financing, or transfer of the Service, information may be disclosed as part of that transaction subject to appropriate confidentiality and applicable consent requirements. We will not treat such a transaction as permission to use information for an incompatible purpose.

8. No sale, advertising, or unrelated profiling

We do not sell personal information or consumer health data. We do not share personal information for cross-context behavioral advertising, use it for targeted advertising, or allow advertising networks or data brokers to receive flagged activity.

Because we do not engage in those activities, we do not currently offer a “Do Not Sell or Share” mechanism. We will honor legally recognized opt-out signals for any processing to which such signals apply. A universal opt-out signal does not disable a user-requested accountability disclosure to an active partner.

9. Retention

We use the following retention periods or criteria:

  • Raw accountability events: browser block and proceed events, mobile protection events, and desktop bypass or protection events are scheduled for deletion from the activity database 7 days after receipt. Delayed reports may describe activity up to 30 days earlier; their original activity time is preserved. Live Proceed overrides use server receipt time. Available source records in the partner portal are limited to their retention window.
  • Weekly summaries and supporting references: current summary text, evidence references, and generation metadata are associated with a partner relationship and expire no later than 7 days after the reporting period ends. They are scheduled for deletion at expiry and removed when the relationship ends or its acceptance changes. Derived records may outlast individual raw events from the reporting week; deletion of a source event is not the same as immediate deletion of its derived summary. Provider-side retention is separate, as described in Section 4.10.
  • Protection observations: capability reports and private-browsing change records are scheduled for deletion after 7 days; resolved protection-interruption records after 7 days from restoration. Current status and unresolved interruptions may remain while needed to explain coverage.
  • Daily browser-presence entries: retained for up to 14 days.
  • Browser no-signal episodes: an ongoing no-signal episode is retained while needed to identify the interruption. Resolved episodes, and episodes for a disconnected browser, are scheduled for deletion after 30 days.
  • Installation and protection records: retained while the installation or account is active and afterward as reasonably necessary for security, auditing, dispute resolution, and legal compliance.
  • Partner invitations and consent: invitation tokens expire after 14 days. Expired, declined, or withdrawn-before-acceptance invitation and delivery records are scheduled for deletion after 90 days. An accepted relationship and its versioned consent evidence are retained while active and for up to 2 years after the relationship ends, unless the account is deleted sooner.
  • Notification operations: notification delivery is retried for up to 7 days. Metadata for sent, canceled, or permanently failed accountability, partner-relationship, account-lifecycle, and other notification jobs is scheduled for deletion after 90 days. Prodigal cannot delete a message from a recipient’s email account after delivery.
  • Account and subscription records: retained while the account exists and afterward as needed for payment, tax, accounting, fraud prevention, dispute, and legal obligations.
  • Audit and security records: identity and security audit records are scheduled for deletion after 2 years. Short-lived rate-limit records are retained for up to 24 hours, and scheduler run records for up to 90 days. Support correspondence is retained for as long as reasonably necessary for the request, security purpose, or legal obligation.
  • Mobile analytics and crash diagnostics: retained under the configured Google Analytics and Firebase service retention settings for usage measurement, troubleshooting, and reliability. These records are separate from the seven-day accountability event feed and are not automatically deleted when you disconnect an accountability account.
  • Local installed-software data: settings, credentials, and pending reports are retained as needed for the installed software and removed through supported reset, disconnection, or operating-system removal processes. Removing an app or extension does not delete server-held records.

Managed database backups are retained for up to 7 days before rotation. Deleted information may remain in those isolated backups during that period but is not available through the ordinary product. If a backup is restored, Prodigal will reapply applicable deletion and retention controls before returning the service to ordinary use. Information already delivered to a partner’s email account, downloaded, forwarded, or captured by the partner is not controlled by deletion from Prodigal’s systems.

We may preserve specific records beyond an ordinary period when required by law, a valid preservation demand, or reasonably necessary to establish, exercise, or defend legal claims. We will not retain sensitive information longer than reasonably necessary for a disclosed purpose.

10. Your choices and privacy rights

10.1 Product choices

You can:

  • use free blocking without creating an account;
  • turn optional social-media blocking on or off;
  • add or remove entries from the local custom block list;
  • enable or decline Incognito access in the browser’s extension settings;
  • invite, remove, or replace an accountability partner, subject to product limits;
  • as an accountability partner, decline an invitation or withdraw from an active relationship;
  • disconnect a browser or app installation through your account;
  • cancel renewal through the billing portal;
  • permanently delete your account through the authenticated account page; and
  • request another personal-information deletion or rights review by emailing accountability@prodigal.org.

Canceling accountability ends collection and sharing and deletes stored accountability records when cancellation takes effect. Scheduling cancellation at the end of a paid period keeps accountability active until that date; choose the immediate-cancellation action in your account to stop sooner. Disconnecting an installation or uninstalling does not itself cancel billing or delete server records. Full account deletion is a separate action that also deletes your sign-in.

The mobile apps currently do not provide an in-app analytics or crash-report opt-out. Contact accountability@prodigal.org for deletion assistance or other privacy requests relating to mobile analytics and crash records; identifying a particular installation may be necessary. The rights and contact provisions in this Policy also apply to this information.

There is currently no separate account switch for AI-assisted summaries. To stop future accountability processing, including summaries, request that paid accountability be disabled or request account deletion. Removing an individual partner ends that partner’s access. Disconnecting installations stops new reports from those installations but does not by itself delete existing records or stop processing of already-collected information.

10.2 Legal rights

Depending on applicable law and subject to exceptions, you may have the right to:

  • confirm whether we process your personal information;
  • access and obtain a copy of it;
  • correct inaccurate information;
  • delete information;
  • withdraw consent for future sensitive-data or consumer-health-data processing;
  • obtain information about third parties that received covered information;
  • obtain portable data;
  • appeal a refusal of a privacy request; and
  • be free from unlawful discrimination for exercising a privacy right.

The monitored-user interface intentionally does not display the partner activity feed. That interface design does not eliminate a legal right to access personal information about you. A verified rights response may therefore include information that is not displayed in the product.

Submit a request or appeal to accountability@prodigal.org. Describe the right you want to exercise and the email address associated with the account. We may take reasonable steps to verify identity and authority, but we will not require you to create a new account solely to make a request. An authorized agent may submit a request where applicable law permits it, subject to verification.

We will respond within the period required by applicable law. If we deny a request, we will explain the basis and any available appeal method. You may also contact your state attorney general or other competent privacy regulator.

10.3 Withdrawal of paid accountability authorization

Accountability collection and partner sharing are essential parts of the same paid service. To stop accountability immediately, use “Delete account” in your account settings. This ends billing, revokes connected devices and partner access, and deletes your account, stored accountability activity, and reports. You may also contact accountability@prodigal.org to withdraw consent or exercise applicable privacy rights. There is no separate setting to stop all partner sharing while keeping the accountability subscription. If you schedule subscription cancellation for the end of a paid period through the secure billing portal, service and processing continue until that date.

Removing a partner immediately ends that partner’s access and deletes that relationship’s stored summary. We also delete the report history that partner could access, except for history another active partner still needs. This applies when a partner steps down or deletes their account. Shared records remain subject to the ordinary retention limits. Cleanup is queued for automatic retry if it cannot finish immediately. Current device status and ongoing protection interruptions may remain while needed to operate the service. Already-delivered emails and copies independently held by partners cannot be recalled; applicable deletion rights and recipient obligations still apply.

11. Security and human access

We use administrative, technical, and organizational safeguards designed for the sensitivity of the information, including separate identity and activity databases, random monitored identifiers, hashed installation credentials, transport encryption, service-role access controls, event idempotency, and restricted authenticated partner access. We also use anti-bot challenges, fixed-window rate limits for sensitive actions, password-attempt protections, short-lived and single-use tokens where appropriate, and retryable notification queues designed to reduce missed operational notices.

Prodigal personnel do not routinely review flagged URLs. Authorized personnel may access limited information when necessary to provide support with your specific consent, investigate security or abuse, maintain the Service, respond to a privacy request, or comply with law. Access should be limited to people with a need to know and logged where appropriate.

No security measure is perfect. If a security incident triggers a legal notice obligation, we will notify affected people and regulators as required by applicable law.

12. Children

Accounts and paid accountability are not intended for anyone under 18. We do not knowingly permit a person under 18 to create an account or use paid accountability. We also prohibit adults from using the Service to monitor a child.

If we learn that a person under 18 provided personal information through an account or paid feature, we will disable the account and delete the information as required by law. Contact accountability@prodigal.org to report a concern.

13. United States service and data processing

Accounts and paid accountability are offered only to U.S. residents. The Service is not directed to residents of the European Economic Area, United Kingdom, Switzerland, or other countries.

Our service providers may process information in the United States and other locations where they operate. By using the Service, you understand that information may be processed outside your state of residence, subject to this Policy and applicable law.

14. Chrome Web Store Limited Use disclosure

The use of information received from Google APIs will adhere to the Chrome Web Store User Data Policy, including the Limited Use requirements.

We use browser data only to provide or improve the Service’s single disclosed purpose and related security and reliability functions. We do not use browser data for advertising, data brokerage, creditworthiness, lending, or unrelated purposes.

15. Changes to this Policy

We may update this Policy to reflect product, provider, or legal changes. We will post the updated version and revise the date above. We will provide additional notice of material changes where appropriate. Posting an updated policy does not itself provide consent for new processing. If a change requires new consent, we will obtain that consent before applying the new processing to you.

16. Contact

Prodigal.org
Privacy and rights requests: accountability@prodigal.org
Mailing address: 5900 Balcones Drive, STE 12393, Austin, TX 78731