Your family's data stays with your family.

01The one thing to understand first

Minerva is built so that your family's information stays with your family.

• The AI that reads each web page runs entirely on the device, using Apple's built-in on-device models. Page content is never uploaded anywhere.
• The parent console works through your own iCloud account (Apple's CloudKit). When a child device shares its activity with a parent's console, that data is stored in the parent's private iCloud, shared privately to the paired devices. We have no access to it. Not to the browsing, not to the searches, not to anything.
• We run no analytics, no advertising, and no third-party tracking. Minerva contains no marketing or tracking SDKs.

02What stays on the device and never leaves

• The content of web pages your child visits, and the AI's safety check of it.
• The activity log — pages, searches, videos, and Noctua's decisions. A summary of this can be mirrored to a parent's iCloud console or emailed if you turn those features on (see §3 and §4) — but the log itself lives on the device.
• The grown-up PIN, stored securely in the device Keychain — salted and hashed, never stored in plain text.
• Your email password for reports, if used, stored only in the Keychain.

03When you set up a parent console (optional)

If you choose to run a console, a child's device and a parent's device are paired, and the child device begins sharing a summary of activity with the parent — stored in the parent's private iCloud, using Apple CloudKit.

• The child's chosen name and icon, and basic device info — device name, model, last-seen time.
• Activity events: pages visited (including their web addresses), search terms, videos and their channels or categories, and the pages Noctua blocked or flagged — each with a time and a short reason or “concern” label.
• Screen-time information: minutes used, break status, daily limits.
• Alerts — for example, a flag that a difficult moment occurred.
• Settings and policy the grown-up sets for that child.

This is the whole point of the console: it lets a caring adult see what their child is doing online. It is stored in the parent's own Apple account and shared only with the specific paired devices. We cannot see it.

04Email reports (optional, off by default)

If a grown-up turns on email reports, Minerva builds a summary on the device and emails it directly through the mail account you provide — your own mail server, for example iCloud Mail. There is no relay or middle-man server: the email goes from your device to your mail provider to the recipients you choose.

What the email contains: the child's name, the date range, totals (pages, searches, videos, times Noctua stepped in, screen time), and — depending on the sections you enable — the actual search terms, most-visited sites and video categories, plus a short plain-language summary written by the on-device AI. Only this finished summary leaves the device; the underlying log does not.

You control the recipients and can turn reports off at any time. Your mail provider will handle the email under its own privacy policy.

05Connections Minerva makes as a browser

Being a web browser, Minerva contacts websites and a few helper services. Here is every outside connection it makes, and why:

Each of these services handles the data it receives under its own privacy policy. Minerva sends them only what's described above, and nothing about your identity. Alternative search engines are disabled so that search stays on a provider Minerva can keep safer.

06The on-device AI

Minerva's page checks and its written summaries are produced by Apple's on-device foundation models. This processing happens on the device; the page text and your activity are not sent to us, or to any AI cloud service, for these features.

07What we, the developer, collect

We do not receive your browsing, your searches, your child's data, or any analytics. We have no server that your data flows to. Because console data lives in your private iCloud, even we cannot read it.

08Children's privacy

Minerva is intended to be set up and controlled by a parent or guardian. It is designed around data minimisation for children:

• A child's information is processed on the device and, if a console is used, stored in the parent's own iCloud — under the family's control, not ours.
• We do not collect personal information from children, do not build profiles, do not serve ads, and do not share children's data with third parties for their own purposes.
• A parent can review, clear, or delete a child's data at any time — see §9.

If you believe a child has used Minerva in a way that caused data to reach us — it should not be possible — please contact us and we will help.

09Keeping, deleting, and controlling data

• Clear the log: a grown-up can clear a child's on-device activity log at any time, including remotely from the console.
• Reset Minerva: resetting the app clears its settings, PIN, and stored email password from that device.
• Remove a child or console: deleting a child from the console removes that child's shared data from your iCloud.
• Uninstalling the app removes its on-device data. Data already in your iCloud is managed by you through your Apple account; pairing codes expire on their own.
• We hold no copies to delete, because we never received any.

10Your rights

Depending on where you live — for example under UK or EU GDPR — you have rights to access, correct, or delete personal data, and to object to certain processing. Because your data is held on your device and in your own iCloud, you can exercise most of these directly. For anything you need from us, contact us at the address below, though in practice we hold no personal data about you.

11Changes to this policy

If we change how Minerva handles data, we'll update this page and the “last updated” date above, and — for material changes — note it in the app or its release notes.

12Contact

privacy@minervaweb.uk