CloudEx Inc. ("we", "us") provides the Android app "Parental Control Pro" (the "Service"). This Privacy Policy explains what information we collect, how we use it, and what choices you have. By using the Service you agree to the practices described here.
The Service is meant to be installed and set up by a parent or legal guardian on a device their child uses. In this policy, "you" means that parent or guardian, and "the device" means the device on which the app is installed.
1. Our position
The Service is a parental control app, and it does its work entirely on the device: the web filter judges each app's traffic there, and the app limits and schedules are applied, and the usage report is built, there as well. The traffic it judges and the use it measures are never sent to us. In particular, we never receive any of the following:
- The content of the traffic passing through the device
- Which app connected to which site or server
- The DNS queries the Service reads in order to filter
- Which apps are used on the device, when, and for how long
- Anything shown on the device's screen
- Browsing or behavioural history in any personally identifiable form
2. About the "VPN"
On Android, the VPN permission (VpnService) is the only way to allow or block traffic per app, and a key icon appears in the status bar while it is active. Unlike an ordinary VPN service, the Service never connects to an external VPN server. The tunnel is closed inside the device: no traffic passes through our servers or is relayed anywhere else. Your IP address does not change, allowed connections go directly to their real destination, and encrypted traffic is never decrypted.
The contents of packets are never stored. The only contents the Service reads are DNS lookups: it matches the names in them against the filter lists and uses them to label the connection log.
3. App limits, the block screen and uninstall protection
To apply app limits and schedules and to build the usage report, the Service needs to know which app is in front and for how long. It learns this through usage access (PACKAGE_USAGE_STATS), from which it reads only app package names and times. This is used on the device only.
The Service uses Android's accessibility service for the following purposes only:
- Showing the block screen over an app that is not allowed right now
- Asking for the parent PIN before the settings that would remove the protection — only while uninstall protection is on and no parent has unlocked with the PIN. When the Settings app or the package installer is opened, the Service reads the text of that screen solely to recognise a screen that would remove this app's protection (this app's own settings or uninstall page, for example), and then asks for the parent PIN.
Screen contents are read only to recognise those settings screens, and are never stored or sent anywhere. The accessibility service is not used to read the content of any app for any other purpose.
When you turn on uninstall protection, the app becomes an active device administrator. It requests no device-administrator policies, so it cannot lock the device, erase its data or change passwords. Being an active administrator is what stops the app from being removed without the parent PIN.
4. Information we collect
4.1 Collected automatically
- Crash reports — through Firebase Crashlytics, and only while the setting is left on. When the app crashes or records an error, it sends the stack trace, device model, OS version, app version and an installation identifier generated by the Firebase SDK. The app does not attach the connection log, the usage history, your rules or the parent PIN to it, nor the domain names or app package names they contain.
- App usage statistics — through Google Analytics for Firebase. Usage events (a first launch, for example, and a few events about when the app chose to show or hold back its request for a review on Google Play) together with device information and the device advertising ID (AAID). We use this only to understand overall usage and to measure our own advertising campaigns (install conversions). The Service shows no ads, and we share no data with ad networks for any other purpose. There is no switch for this in the app; the advertising ID can be reset or deleted in the device settings (see section 10).
- Purchase and licence information — the purchase token issued by Google Play, used to confirm your entitlement to Premium, which is a one-time in-app purchase. We never receive card numbers or other payment details.
4.2 Stored on the device only
- The connection log — for each connection, the app, the destination's domain name (when known), IP address and port, the protocol, whether it was allowed or blocked and why, the bytes transferred and the time. It is kept in a database on the device, entries older than 30 days are deleted automatically, and it is never sent to our servers. Logging can be switched off for an individual app, and you can erase the whole log from inside the app at any time. Exporting it as CSV is your own action, through Android's share sheet, to a place you choose; the app never uploads it.
- Traffic statistics — the daily counts of allowed and blocked connections, and the bytes each app used per day. Erasing the connection log clears them too.
- The usage history — for each day, how long each app was used and how many times it was opened. It is kept for 90 days and then deleted automatically, and you can clear it from the report screen.
- Settings and rules — time limits, schedules (including the names you give them), the filter settings, custom domains, per-app network rules and DNS settings.
- The parent PIN and the recovery question — the PIN is stored only as a salted one-way hash (PBKDF2). The recovery question is stored as you entered it, and its answer only as a salted one-way hash.
- The list of installed apps — used on the device to list apps, apply per-app rules and notice newly installed apps. A snapshot of package names is kept so that new apps can be recognised. It is never transmitted.
- The filter lists themselves — the downloaded domain lists.
All of it is kept on the device and is erased when you uninstall the app or clear its data. If Android's own device backup (Google backup) is switched on, Android may include the app's data in that backup under Google's terms; the app neither starts that backup nor reads it.
A settings backup file is created only when you ask for one, and is handed to Android's share sheet so that you can keep it where you choose; the app never sends it anywhere. It does not contain the parent PIN, the recovery question or answer, the connection log or the usage history.
4.3 Information we specifically do not collect
- The sites visited on the device, the destinations it connects to, or the contents of the connection log
- The usage history, or anything shown on the screen
- The list of apps installed on the device
- Your rules, your schedules, the parent PIN, or the recovery question and answer
- Location data such as GPS coordinates
- Phone number, contacts, photos, microphone or camera
- Account details — the Service needs no account at all
4.4 Permissions the app requests, and why
- VPN service (
BIND_VPN_SERVICE) — required by the OS in order to judge each app's traffic. As stated in section 2, no external VPN server is involved. - Usage access (
PACKAGE_USAGE_STATS) — to know which app is in front and for how long, so that app limits and schedules can be applied and the usage report built. Only app package names and times are read, and they are used on the device only. See section 3. - Accessibility service — to show the block screen and, while uninstall protection is on, to recognise the settings screens that would remove the protection. See section 3.
- Display over other apps (
SYSTEM_ALERT_WINDOW) — a fallback way to show the block screen when the accessibility service is off. It covers the app underneath and captures nothing from it. - Device administrator — for uninstall protection only. No device-administrator policies are requested. See section 3.
- Query all packages (
QUERY_ALL_PACKAGES) — needed to list every app so that app limits and network rules can be set, including apps with no launcher icon. The list is used on the device only and is never transmitted. - Notifications (
POST_NOTIFICATIONS) — for the ongoing status notifications of the web filter and the app limits, and for optional alerts about new connections, blocked connections, newly installed apps and data limits. Some alerts show app names and domain names in the device's notification shade. - Boot completed (
RECEIVE_BOOT_COMPLETED) — to bring the protection back automatically after the device restarts or the app is updated. - Network state (
ACCESS_NETWORK_STATE) — to tell whether the device is on Wi-Fi or on mobile data. The per-network rules depend on it. It is also used to rebuild the tunnel when the network changes. - Request package deletion (
REQUEST_DELETE_PACKAGES) — used only to open the uninstall screen for this app itself, as a recovery step on devices that block the VPN permission. It is never used to remove any other app. - Foreground service (
FOREGROUND_SERVICE) — to keep the web filter and the app limits running.
The app does not request access to location, contacts, the camera, the microphone, storage or the phone.
5. Connections the app makes
Besides Google Play and the Firebase services in section 4.1, the app connects to the services described below. Nothing else is sent to any server of ours.
5.1 Filter-list updates
Filter lists are downloaded directly from their public third-party publishers (AdGuard, abuse.ch URLhaus, Hagezi, StevenBlack and ngosang). We operate no mirror. These requests fetch a list and nothing more — no identifying information and no browsing data is sent — but, as with opening any website, the publisher you connect to receives your IP address. Only the lists you have enabled are downloaded. Some of the lists are served from GitHub, which receives your IP address in the same way.
A list is downloaded when you turn it on or ask for an update. The optional automatic update (a Premium feature, off by default) downloads the enabled lists again once a day over Wi-Fi or another unmetered network.
5.2 DNS
In the default mode, the device's DNS lookups go to the resolver of the network it is connected to, exactly as they would without the app. A name on a blocked list is answered on the device and never leaves it.
If you turn on encrypted DNS (DNS over HTTPS or DNS over TLS; a Premium feature, off by default), lookups are sent instead to the provider you choose — Cloudflare, Google or Quad9 — and are subject to that provider's privacy policy. If the encrypted connection fails, the lookup is sent to the same provider without encryption, and failing that to the network's resolver.
5.3 SafeSearch and YouTube Restricted Mode
When SafeSearch is on, the app answers lookups for Google, Bing and DuckDuckGo on the device with the addresses of each provider's own safe mode, and YouTube Restricted Mode does the same for YouTube (for example forcesafesearch.google.com, strict.bing.com, safe.duckduckgo.com and restrict.youtube.com). To do that, it looks up those safe-mode addresses through the DNS provider selected in the app (Cloudflare by default). Only those fixed safe-mode names are sent, never what is searched for.
5.4 The list of our other apps
To show CloudEx's other apps, the app downloads a list of them from our server, which is hosted on Cloudflare Pages. No identifier or personal data is sent; like any web server, it receives your IP address. The SIM or network country code is read on the device only, to choose which apps to show, and is not sent. If you tap one of those apps, its Google Play link includes campaign parameters that tell Google Play the visit came from this app.
5.5 Contacting support
If you contact us from the app, your mail app opens with the app name, the app version and the Android version already filled in. What you send is up to you.
6. How we use information
- Operating and maintaining the Service
- Confirming your entitlement to Premium
- Understanding overall usage and improving the app (analytics)
- Measuring our own advertising campaigns (install conversions)
- Diagnosing and fixing crashes (only for users who leave crash reporting on)
- Replying to support enquiries
- Complying with applicable law
7. Third-party services
The Service uses the following third-party services. Each has its own privacy policy.
- Firebase Crashlytics (Google LLC) — crash and error diagnostics
- Google Analytics for Firebase (Google LLC) — usage statistics and campaign measurement
- Google Play Billing (Google LLC) — purchases and entitlement checks. Payment is completed on Google Play's side.
- Google Play In-App Review and In-App Updates (Google LLC) — Google Play's own screens for rating the app and for updating it
- Filter-list publishers — contacted only when a list is downloaded, as described in section 5.1.
- DNS providers (Cloudflare, Google, Quad9) — used only for encrypted DNS, if you turn it on (section 5.2), and for the SafeSearch lookups (section 5.3).
- Cloudflare Pages — hosts the list of our other apps (section 5.4).
8. Retention
- Crash reports: deleted after 90 days.
- Analytics data: deleted by Google Analytics after at most 14 months.
- The connection log on the device: deleted automatically after 30 days, or all at once when you choose.
- The usage history on the device: deleted automatically after 90 days, or when you clear it.
- Settings and statistics on the device: erased when you uninstall the app or clear its data (the traffic statistics are also cleared when you erase the connection log).
9. International transfers
We are based in Japan. The infrastructure used for crash diagnostics and analytics may be located in various countries. When you use the Service, the minimal information described above may be processed outside your country of residence under standard contractual protections.
10. Your rights
Depending on where you live (the EEA, the UK, California or Japan, among others) you may have the right to access, correct or delete the limited information we hold. You can:
- Turn "Send crash reports" off in the app's settings
- Reset or delete the advertising ID in the settings of the device on which the app is installed (Settings → Google → Ads)
- Erase the whole connection log from inside the app
- Clear the usage history from the report screen
- Uninstall the app or clear its data to remove everything stored on the device (while uninstall protection is on, uninstalling needs the parent PIN)
- Contact us at the address below with a request about the information we hold
11. Children's privacy
The Service is intended to be set up and managed by a parent or legal guardian on a device their child uses. It is not directed at children as its users, and we do not ask children for personal information or knowingly collect it from them.
The information the app creates about the child's use of the device — usage times, the connection log, rules and schedules — stays on that device (apart from Android's own backup, described in section 4.2) and is not sent to us. The crash reports and usage statistics described in section 4.1 come from the device on which the app is installed, which may be a device a child uses; they contain none of the content of that use. A parent or guardian may contact us at any time to ask us to delete anything we hold.
12. Changes to this policy
We may update this Privacy Policy from time to time. The current version is always published at this URL together with its effective date.
13. Contact
For privacy questions, data requests or concerns, e-mail us at .
CloudEx Inc. (Japan)
Effective Date: September 23, 2026