Privacy Policy
Last updated: 28 July 2026
The short version
Safe World decides what to block on your device. There is no account to create, no analytics, and no server of ours that your browsing passes through. We do not collect, store, or transmit any record of the websites you visit — because nothing is ever sent to us in the first place.
The apps make exactly one kind of network request: downloading an updated blocklist file. That is described in full below, including what the host of that file can see.
Who this covers
This policy applies to the Safe World Android app, iOS app, Chrome extension, macOS app, and Windows app, and to this website. Safe World is an open-source project maintained by an individual developer; you can read the entire source code, including everything described here, at the source code.
What happens on your device
To block a website, Safe World has to see the name of the site being requested. On Android this means the app inspects DNS lookups; in the browser extensions it means matching requests against a rule list. This is unavoidable — it is how any content filter works.
What matters is what happens next. Each name is compared against a list that is already stored on your device, and the answer is used immediately and then discarded. Site names are never written to a log, never saved to a history, and never sent anywhere.
Data stored locally on your device
The following is kept in the app's private storage. It stays on your device, is not readable by other apps, and is not transmitted to us or to anyone else:
- Your settings — which categories are on, and any websites you added or allowed yourself.
- Your PIN and recovery code, stored only as salted PBKDF2-SHA256 hashes. The originals are never written down anywhere; we could not recover them even if asked.
- A count of how many requests were blocked today. This is a number only — it records how many, never which ones.
- The blocklists themselves, and the timestamp of the last update check.
On Android the bundled blocklists are stored as one-way cryptographic hashes rather than readable domain names, so the app's own files do not contain a browsable list of blocked sites.
The one network request we make
About once a day, the app downloads a small file containing any domains added to the blocklists since your version was built. The request is a plain HTTPS download of a static file:
https://<this-server>/lists/…
The request contains nothing about you. It carries no identifier, no settings, no list of sites you have visited, and no information about what has been blocked. It is the same file for every user, and it is downloaded in full — the request does not reveal which sites you are interested in, because it does not ask about any specific site.
That file used to be hosted on GitHub Pages. It is now served from a small server we run ourselves, so we have to be straight with you about what changed: we do operate that server now, where before we did not. Any web server necessarily receives your device's IP address in order to send a file back to it.
So we have turned off request logging for this path entirely. Your IP address is used by the operating system to route the response and is never written to a log file, never counted, and never retained. There is nothing for us to read afterwards, and nothing to hand over if we were asked. If you would rather not make the request at all, the app works entirely offline using the lists it shipped with; blocking continues to function, it simply will not learn about newly discovered sites.
What we never do
- We do not collect personal information. There is no sign-up, no email address, no phone number, and no profile.
- We do not use analytics, crash reporting, advertising SDKs, or tracking of any kind.
- We do not sell, rent, or share data with third parties — there is no data to sell.
- We do not route your traffic through any server we control.
- We do not track your location, read your contacts, files, messages, or photos.
Permissions, and why each one exists
The Android app requests these permissions and no others:
| Permission | Why it is needed |
|---|---|
| VPN service | Creates a local tunnel on the device itself so DNS lookups can be filtered for every app, not just one browser. It connects to no remote VPN server; no traffic leaves your device through it. Requests that are allowed go to whichever DNS resolver your device already used. |
| Internet, network state | Downloading blocklist updates, and noticing when the connection changes. |
| Foreground service | Android requires a persistent notification while filtering is active, so it is always visible that the app is running. |
| Notifications | Shows that status notification, and warns you if protection stops unexpectedly. |
| Device administrator (optional) | Only if you turn on "make removal harder". It requests zero policies: it cannot lock your screen, wipe your device, change your password, or monitor anything. Its only effect is that Android refuses to uninstall Safe World until you switch it off. You can disable it at any time with your PIN. |
Children
Safe World is designed to be set up by a parent or guardian on a device that may be used by a child. It collects no personal information from anyone, of any age. Because nothing is collected, there is nothing about a child to store, share, or delete.
Deleting your data
All of your data is on your device, so you control it completely. Clearing the app's storage (Android: Settings → Apps → Safe World → Storage → Clear data) or uninstalling the app erases everything: settings, lists, PIN, recovery code, and counters. Nothing is retained anywhere else, and there is no server-side account to close.
If uninstall protection is enabled, you will need your PIN to turn it off first — that is the point of the feature.
What this policy cannot promise
Being honest about the limits matters more than sounding reassuring:
- Safe World is a filter, not a guarantee. DNS-level blocking cannot see encrypted DNS (DoH/DoT), apps with hardcoded resolvers, or connections made directly to an IP address.
- The PIN and uninstall protection are friction, not a lock. Anyone with physical access to the device can clear the app's data from Android's own settings.
- Blocklists are compiled from public sources and are never perfect. Some harmful sites will be missed, and some harmless ones may be blocked by mistake.
Changes to this policy
If this policy changes, the date at the top of this page changes with it, and the previous version stays visible in the project's public commit history. A change that affected what data leaves your device would also ship with an app update, so it would be visible in the source code before it ever reached you.
Contact
Questions about this policy, or about anything the apps do, are welcome:
- Email — safeworldwebsiteblock@gmail.com
- Source code and issue tracker — the source code