What Noor Shield collects — and what it never sees

The core app, running on your PC

Short version: nothing leaves your PC.

Noor Shield's filtering, bedtime schedule, screen-time count, prayer times, blocked apps, parent password, and activity log all run and store their data locally on the PC it's installed on. None of it is sent to us, to any server we operate, or to any third party — except for the things described below: noting when this PC's free trial started (once per install), activating your product key (once), checking for updates, "Email reports" (only when you send one), and the optional remote dashboard (only if you set it up).

• Activity log: a record of domains the filter has blocked, and of blocked games or apps it closed, stored only on that PC, readable only with the parent password. It is not a browsing history — sites you visit that aren't blocked are never logged.
• Screen time: how many minutes have been used today, counted on the PC from whether someone is signed in and the screen is unlocked — not from what they do. It starts again at midnight.
• Prayer times: worked out on the PC from the city you pick. Your location is never looked up or sent anywhere.
• Parent password & recovery key: stored locally on the PC. We never see, receive, or store either one.
• Blocked-site list: the bundled list plus any sites you add yourself, stored and applied locally.

Email reports

Short version: your report goes from your PC straight to your inbox — never through us.

If you choose to set up email reports, you enter your own email provider's SMTP details directly into the app. Clicking "Send report now" sends that copy of the activity log directly from your PC to the address you configured, using your own email provider's servers. Noor Shield and Diin Islaam never receive, store, or see any of it. Nothing is sent automatically or on a schedule — only when you click that button.

The email password you enter is stored encrypted on your PC using Windows' own secure credential storage — the same protection Windows uses for saved Wi-Fi passwords.

Free trial and activating a product key

So the 29-day free trial can't be restarted by reinstalling, the app records on this PC, and once with Google Firebase, the date the trial started. Firebase gets only that date and an anonymous ID worked out from the computer's own ID (Windows' machine ID, or a Mac's hardware ID), which can't be turned back into that ID.

When you click Activate, the app checks your key with our backend provider, Google Firebase, so that one key can't be used on more than one PC. Your key itself is never sent. The app sends a one-way code worked out from it (which can't be turned back into the key), and an anonymous ID worked out from the computer's own ID (which can't be turned back into that ID either). Firebase stores that pair so the same PC can activate again after a reinstall, and a different PC can't. Nothing else is sent, and nothing at all after activation.

Checking for updates

From version 0.21, the app checks every few hours whether a newer version exists, and downloads it from GitHub, where our installers are published. Like any download, GitHub sees the PC's internet address. The app sends nothing about you, your family, or how the PC is used.

The Android and iPhone apps

Short version: the same promises as on the PC. Filtering happens on the phone, and no browsing history is kept or sent to us.

• Android: Noor Shield uses Android's VPN feature, but only for website-name lookups (DNS), not for your internet traffic, which goes straight to the internet as usual. Blocked names are answered on the phone. Other names are looked up with a public DNS service (Cloudflare 1.1.1.1, the network's own DNS, or Google 8.8.8.8), as any phone does. Noor Shield doesn't keep a list of them or send them to us.
• iPhone and iPad: Noor Shield uses Apple's Screen Time and a content filter. Apple's filter sees the name of each site as it's opened and decides on the device whether to allow it. Apple keeps this filter from sending anything off the device.
• On the phone only: your parent password (stored as a one-way code), your settings, the sites and apps you've blocked, and a count of how many sites were blocked today. The count is just a number, not a list.
• Blocked apps: on Android, if you block apps, Noor Shield checks which app is open (Android calls this "usage access") so it can close a blocked one. It doesn't keep a record of which apps are used or send it anywhere. On iPhone, you pick apps in Apple's own Screen Time list, and Apple never tells Noor Shield which apps they are.
• Block lists: the app downloads updated lists of harmful sites from GitHub. Like any download, GitHub sees the phone's internet address.
• Free trial and product key: the same as on the PC (see above). The anonymous ID is worked out from Android's ID for this app on Android, or from a random number kept on the iPhone, and can't be turned back into either.
• Remote dashboard: the same as for a PC (see below). The phone's model, such as "Pixel 8 (Android)", is used as its name until you rename it.

The phone apps carry no ads and no analytics or tracking. They don't read messages, photos, contacts, location, or what's typed.

The optional remote dashboard & family account

Short version: creating a family account and pairing a PC stores a small amount of data with our backend provider, Google Firebase, so the remote-control feature can work. This is entirely optional — nothing here happens unless you set it up.

Linking a PC to "Remote control" and signing in at the remote dashboard uses Google Firebase (Firebase Authentication and the Firebase Realtime Database), a third-party backend, to store the following so the feature actually works:

• Your account email address and password (the password is stored hashed by Firebase Authentication — we never see it in plain text).
• An anonymous sign-in for each paired PC, with no name or email attached, so the PC can prove it is the one you linked.
• The name you give a paired device and when it last checked in.
• Commands you send from the dashboard (enforce bedtime, set a weekly schedule, lock or unlock the screen) until the PC has carried them out — the PC deletes each one once it's done.
• Domains you add to a specific device's blocked-site list, from the dashboard or from that PC, and sites you allow after a request.
• A short status for each device, so the dashboard can show it: whether protection is on, whether the internet is paused and why, screen time used and left today, and the next prayer pause. If you set the prayer-time pause from the dashboard, the city you choose (and its map coordinates) is sent to the PC through it.
• Requests sent from the PC when a child taps "Ask a parent" on a blocked page: the site asked about, or a request for more time. You can allow or decline each one, which removes it.
• The last 20 alerts a device reports, each just a kind and a time: protection turned off, Noor Shield being removed, its DNS settings changed, the lock screen closed, or the free trial ending.
• If you share devices with a second parent: the invite code (deleted from use after 30 minutes or once used), your email address shown to the parent who accepts it, and which parents can control each device.
• If you tick "Email me when a device needs attention": that choice, and a note of which alerts you've already been emailed about. The emails go to your account's own address from Noor Shield's own email account, so that email provider handles them as it does any email.

The dashboard does not receive or store the PC's activity log, its full browsing history, or anything typed into the Noor Shield app itself beyond what's listed above. Only you can see your own account's devices and data — each family account is isolated from every other.

Children's privacy

Noor Shield is installed and configured by a parent or guardian, not by a child. A child using the protected PC does not create an account, is not asked for personal information, and is not the one who signs in to the remote dashboard. What Noor Shield records about how the PC is used is limited to the domains its filter has blocked, the blocked apps it closed, and how many minutes of screen time were used today — not a browsing history, and not anything else the child does on the device. A request the child sends with "Ask a parent" contains only the site asked about, or the time asked for.

Data retention & deletion

• Activity log: stays on the PC until you clear it yourself with "Clear log" in the Activity Log tab, or until you uninstall Noor Shield.
• Family account & device data: kept for as long as your account exists. To delete your account and everything tied to it (paired devices, commands, added domains, requests, alerts), contact us at the address below and we'll remove it.

Changes to this policy

If this policy changes in a way that matters — a new feature that stores different data, or a new third party involved — we'll update the date at the top of this page and describe the change here.

Contact

Questions about this policy, or a request to delete your family account's data, can be sent to fesbackups@gmail.com.