Privacy

Hedge is for locking down your own phone. Here is plainly what it collects, who can see it and how long it is kept.

Always sent to the server

So the key holder can see the phone is working, the phone checks in about every 15 minutes and sends:

• whether it is locked or paused, when it last checked in, its battery level and its Hedge version;
• its model and Android version;
• the apps that have an icon on the home screen (to choose which stay visible);
• tamper events, such as Wi-Fi being switched on while it is locked;
• when a website list is on: the names of sites that were blocked, so one can be allowed with a tap.

Only if switched on

Monitoring is off unless the person holding the phone turns it on at setup. Each switch is separate:

• Screen time: minutes per app per day.
• Browsing: the names of sites looked up, with the time. Site names only (example.com), not pages, and phone-wide, not per browser.
• Location: one point every 15 minutes, sent at check-in. Not live tracking.
• Call log: number, contact name, time, direction and length.
• Messages, who and when: number, contact name, time and direction. SMS and MMS only; RCS chats, WhatsApp, Signal and similar apps cannot be read.
• Message text: the text as well, with a second tick box. Reading someone's messages also reads what other people wrote to them. That is the phone owner's call, and the setup tool says so beside the box.

Switching monitoring on later needs a tap of “Allow” on the phone itself, whoever manages it. Turning it off counts as loosening, so it waits out the delay or needs the partner's yes.

Who can see it

• The key holder: you (self-managed) or your trusted partner.
• The phone's owner always sees the same data the key holder sees, and the Hedge app on the phone always lists what is switched on and who can see it. Monitoring can never be hidden from the phone's owner.
• The people who run this server see only health: phone model, Android version, Hedge version and when it last checked in. Not settings and not monitoring data.

How it is kept

• Monitoring data is deleted after 30 days.
• Places, phone numbers, contact names and message text are stored encrypted.
• The website filter runs on the phone. Only name lookups pass through it; your browsing itself does not go through our server.
• Email is sent through Brevo (account invitations, requests to approve, notices). The home page shows one of three pictures at random and counts, per day, how many visits and downloads each picture got. Only daily totals are kept: a small cookie remembers which picture you saw, and nothing identifies you. We do not use ads or third-party trackers. Pages load no third-party fonts or scripts, except the location page, which loads the Leaflet map library and OpenStreetMap map tiles.

Known limits

• Android only. No iPhone.
• A factory reset from recovery mode always works. Hedge is strong friction, not a prison.
• The website list filters names, not connections: an app that connects straight to an address or brings its own encrypted lookups can get around it.
• If the server is down, the locks stay, and nothing can be loosened until it is back.
• Google Play Protect may warn about a management app installed outside the Play Store.

Removing Hedge

“Release this phone” in the control panel removes every restriction and lets you uninstall Hedge. It follows the same rule as any loosening change: it waits out the delay, or needs the partner's yes.