Privacy Policy

1. Scope and Roles

This policy applies to Apex Browser, Apex Console, the Chrome extension, desktop or managed-device builds, and included tools such as Writer, Messages, Calculator, and Design (collectively, the Service).

An Administrator is the parent, guardian, school, or other organization that creates and controls student profiles. Administrators decide which students use the Service, which destinations are approved, which monitoring features are enabled, and who may review student-associated information. A Student uses credentials or a session issued under an Administrator's account.

2. Information We Process

Administrator and configuration data

• Account identifiers such as email address, authentication provider identifier, display name, and role.
• Student profile settings, administrator relationships, approved destinations, policy choices, groups, and notification preferences.

Student, activity, and workspace data

• Student display name, username, avatar or icon, and a protected PIN verifier. Apex is designed not to store a student's plain-text PIN.
• Device enrollment, session, presence, and revocation records needed to authenticate and manage access.
• Visited or requested URLs and domains, timestamps, session activity, approval decisions, and security-event metadata.
• Messages, Writer documents, Design projects, and related collaboration data that users choose to create.
• When an enabled Apex component captures and submits security evidence, a screenshot or limited copied-text preview associated with the event.
• Push-notification tokens and limited delivery or audit metadata. Notification content may identify the student, destination, or event.

Technical data

Our hosting, authentication, security, and delivery providers may process IP addresses, browser or device information, cookies or local storage required for sessions, and diagnostic logs. We do not use Apex data for targeted advertising and do not sell personal information.

3. How We Use Information

We process information to authenticate users; apply Administrator-selected access rules; operate requests, messaging, workspace, device, and monitoring features; send configured alerts; prevent abuse; investigate failures; protect the Service; provide support; and comply with law. Administrator approval of a specific destination is intended to override broader Apex guardrails for that approved destination, subject to technical and device-platform limitations.

4. Service Providers and Disclosure

We disclose information only as needed to operate or protect the Service, comply with law, or complete a business transaction with appropriate protections. Current provider categories include:

• Google Firebase / Google Cloud: authentication, database, storage, server functions, and push messaging.
• Vercel: web hosting, delivery, and operational logs.
• Resend: email delivery when email alerts are enabled.

Those providers process information under their own terms and applicable data-processing commitments. External sites an Administrator permits are separate services with their own privacy practices. Apex does not control what an approved external site collects.

5. Children and School Use

Apex is designed for Administrator-directed use, but student interaction with Apex can create personal information, including messages, work product, browsing activity, and security evidence. An Administrator must have the legal authority and provide any notices or obtain any consent required to create profiles, enable monitoring, and disclose student information to the Service.

For family use, the Administrator represents that they are the student's parent, legal guardian, or otherwise authorized adult. For school or institutional use, the organization is responsible for determining the legal basis for use, configuring access, providing required notices and rights, and entering any required agreement with True Anchor LLC before production deployment.

We do not claim that using Apex automatically makes an Administrator compliant with COPPA, FERPA, state student-privacy laws, or other requirements. Contact privacy@apexbrowser.app before deploying Apex for a school, district, detention facility, or other institution.

6. Administrator Controls

Authorized Administrators can review many student-associated records in Console, change access policies, revoke sessions or devices, and delete supported items. Some deletion and export operations may require a verified request to us. Console visibility and deletion controls vary by record type and product version.

To request access, correction, export, or deletion, email privacy@apexbrowser.app. We may verify identity and authority before acting. A school may need to handle a parent or eligible student's request under its own FERPA procedures.

7. Retention and Deletion

Unless a specific setting or written agreement states otherwise, we retain information while the applicable Administrator account remains active and as reasonably needed to provide, secure, troubleshoot, and document the Service. Apex does not currently promise automatic 30-, 60-, or 90-day deletion for every record type.

After a verified deletion request, we will delete or de-identify covered information within a reasonable period, subject to technical feasibility, backup cycles, security records, legal obligations, and records needed to establish or defend legal claims. Deleting an on-screen record may not immediately remove every backup or separately stored evidence object. Complete server-side student deletion is implemented in the current security release and remains subject to hands-on verification. Complete Administrator-account deletion remains a production-release requirement and cannot be safely enabled until account data is separated by organization.

8. Security and Product Limits

We use HTTPS, provider security controls, authenticated server operations, role and participant checks, device/session revocation, and validation and rate limits for sensitive writes. No method of storage or transmission is perfectly secure.

The web app controls activity inside Apex. The extension adds supported Chrome enforcement and monitoring. A desktop wrapper or properly managed operating system can add further restrictions. Apex cannot promise that all external browsers, guest profiles, applications, operating-system features, networks, screenshots, camera tools, AI services, or physical-device workarounds are blocked on every platform.

9. Privacy Requests and Changes

Depending on applicable law, an individual may have rights to request access, correction, deletion, or a copy of personal information, or to appeal certain decisions. We will evaluate verified requests under the law that applies to the requester and the Administrator relationship.

We may update this policy as the product changes. We will post the revised policy and update the date above. Where required, we will provide additional notice or obtain consent before materially different processing begins.

10. Contact Us