Privacy policy
Last updated: 19 October 2026
Parental Browser is a family project made of two parts: the Parental Browser Gate extension for Firefox (desktop and Android), installed on a child's browser, and the parent app, used by a parent in a browser at parent-controlled-browser.web.app/app or on Android. This page explains exactly what each part collects, why, who can see it, and how long it is kept.
The short version
- The extension is meant to be installed by a parent on a child's browser. Once it is connected to a parent's account, the parent can see which sites the child used, for how long, and which sites were blocked.
- It sends time per site per day, blocked sites (with one example address), and the child's requests. It does not send a history of the pages visited on allowed sites.
- It never reads what is on a page, what the child types, passwords, or takes screenshots.
- No ads, no analytics, no trackers. Nothing is sold or shared for marketing.
- Data is stored in Google Firebase in the United States, in the family's own account.
Who this is for
The extension does nothing useful on its own: until it is connected ("paired") to a parent's account, every page opens the pairing screen and no browsing data leaves the browser. Pairing takes a QR code or four words that a parent enters in the parent app. Only install it on a browser used by a child you are responsible for, and tell your child that the browser is managed and that you can see the sites they use. A child does not create an account and is never asked for personal information.
What the extension sends
All of the following goes only to the family's account on our backend (see
Where it is stored). Sites are recorded as the registrable domain, for example
wikipedia.org for en.m.wikipedia.org.
| What | When | Why |
|---|---|---|
| A device account: a random identifier created with Firebase Authentication (anonymous sign-in), and a one-time pairing code | When the pairing screen asks for a code (or, rarely, when the clock check below cannot read the date) | So the parent can connect this browser, and so the backend knows which family it belongs to |
| Time used per site: whole seconds per site per day | Every few minutes while sites are in use, sooner when time is almost up | Daily time budgets, shared across the child's devices, and the parent's "Today" view |
| Blocked sites that have no rule yet: the site, one example address that was tried (up to 2,048 characters, which can include the page path and query), the address of the page that led there, how many times it was tried, when it was first and last tried, and whether the child asked for access | When a site that is not set up is blocked (at most once a minute per site) | So the parent can decide whether to allow the site, give it a daily time, or keep it blocked |
| Requests: the site and the kind of request ("new site" or "more time"), and when it was made | When the child presses "Request access" or "Ask for more time" | So the parent can answer from the parent app |
The extension also receives the family's rules for this child (allowed, timed and blocked sites, schedules, routines and time-display settings), extra time the parent granted, the parent's answers, today's time used on the child's other devices, the device's own record (its name, the family's name, and whether it was disconnected), and a shared list of sign-in services (such as "Sign in with Google") that may open from allowed sites.
To check that the computer's clock is right (time budgets depend on it), the extension makes a request to
firestore.googleapis.com and reads only the date in the response. That request carries no data
about the child or the browsing. If the date cannot be read that way, the extension asks Firebase
Authentication for the time instead, which creates the device account described above if there is none yet.
What stays in the browser
To work, the extension keeps some information in its own storage inside Firefox. It is not sent anywhere, and it is removed when the extension is removed:
- The addresses of the pages open in each tab (cleared when Firefox restarts), to apply the rules
- The full address of recently blocked pages, so the block page can show it and reopen it once allowed
- A copy of the rules, grants and today's time, so it keeps working offline
- Time not yet sent, until the backend confirms it
- Whether audio or video is playing in a tab (yes or no only), so watching a video counts as activity
- For sites where the time display was made smaller, that choice and its position on the screen
What the extension never collects
- A history of the pages visited on allowed sites: only the total time per site is sent
- The content of pages, what the child types, form data, passwords or cookies
- Screenshots, camera, microphone or location
The extension runs two small scripts on web pages. One only notices whether audio or video is playing. The other draws the "time left" display on timed sites and, on Android, says whether the page is on screen (yes or no) so that time is only counted while it is. Neither reads the page's content, and neither sends addresses. On a Mac set up with our setup script, private browsing is turned off. Elsewhere, Firefox runs the extension in private windows only if that is allowed in Firefox's settings. When it is, every page in a private tab is blocked, and nothing from private tabs is collected, stored or sent. When it is not, the extension does not run there. No code is downloaded from the internet: everything the extension runs ships inside the package reviewed by Mozilla.
When the extension is installed, Firefox shows that it collects browsing activity. That is the information described above, and it goes only to the family's parents.
What the parent app collects
- Your account: your email address and password, handled by Firebase Authentication (we never see your password). Firebase sends the email to verify your address and, if you ask, to reset your password.
- What you set up: your family's name, each child's name (a nickname is fine), timezone and language, the names of connected devices, and every rule, schedule, routine and time grant you create.
- Who changed what: changes and answers record which parent account made them and when.
- Camera: only to scan the pairing QR code on your phone. Images are not stored or sent.
- On your device: the app keeps you signed in by storing the sign-in session in the browser or on the phone.
To stop people from guessing pairing codes, failed pairing attempts are counted per parent account and per network address. The network address is stored only as a shortened one-way hash, and these counters expire after 15 to 60 minutes.
Who can see it
- Parents of the family see everything the extension sends for their children: time per site, blocked sites with their example addresses, and requests.
- A paired browser can read only its own child's rules, grants, answers and today's time, and its own device record. It cannot read the family's other data.
- The developer, who runs the service, has administrator access to the database and uses it only to operate, secure and fix the service, or when you ask for help.
- Google, as the hosting provider (Firebase), processes the data on our behalf. See Privacy and Security in Firebase.
We do not sell data, show ads, or share data with anyone else, except where the law requires it.
Where it is stored and for how long
Everything is stored in Google Firebase (Cloud Firestore, Authentication and Cloud Functions) in the United States. Connections are encrypted (HTTPS). Database security rules let each parent read only their own family's data, and each paired browser only its own child's data. Like any web service, Google's servers receive the network (IP) address of the browser or phone making a request, and Google keeps standard request logs.
- Pairing codes expire after 5 minutes (24 hours once used to connect a browser) and are then deleted automatically.
- Time per site, blocked-site records, requests and answers are kept in your family's account, so you can look back at them, until you ask us to delete them.
- Your account and family data are kept until you ask us to delete them.
Your choices
- Disconnect a browser: in the parent app, open Devices and disconnect it. It loses access at once and forgets its pairing.
- Remove the extension: this deletes everything it kept in the browser. Data already sent stays in your family's account until you ask us to delete it.
- Delete your data: ask us to delete your account, your family, or a child's data, and we will do it within 30 days. You can also ask for a copy of your family's data.
Children
The service is used by parents to set browsing rules for their own children. A child never creates an account. The only information about a child is what a parent enters (a name and a timezone) and the browsing information described above, which is visible only to that child's parents.
Changes to this policy
If what the extension or the app collects changes, this page is updated first and the date at the top changes. A change in what the extension collects also comes with a new version of the extension.
Contact
You can also reach the developer through the support details on the Parental Browser Gate page on addons.mozilla.org.