Privacy Policy

Types of information we collect online

We never sell your personal information. We do use some cookies and tools to measure the success of our Meta (Facebook) advertising, which are detailed below in full transparency.

Account Information

Name, mobile number, email address, and your password. Your password is encrypted using bcrypt upon registration, so we cannot read or view your original password.

Payment Information

The phone number used for the transaction, the TrxID (Transaction Reference), the amount paid, and your selected plan. We do not collect credit card or direct bank account numbers. You send funds directly to our designated bKash or Nagad numbers, and we verify the payment using your provided TrxID. The ChayaNetwork app on Google Play does not take payments.

DNS and Usage Data

For each profile, we record the domain names (website addresses) its devices look up, whether each one was allowed or blocked, and when. Only the account owner can see this, in the dashboard's Activity page. We use it to filter your internet and to show your dashboard statistics.

If you turn on screen time in the Android app, it also sends us how long each app was used on that phone and when each app was opened and closed (App history), and we keep the daily app limits you set, so you can see and change them in the app and on the website. See Android App.

Devices

Each phone, iPhone or iPad you set up is recorded as a device of your account, with its own DNS address. For each device we keep:

• its name: for an Android phone, the maker and model Android reports (for example "Samsung SM-A125F"); for an iPhone or iPad, "iPhone or iPad";
• the profile it follows, and when it was added;
• for an Android phone, a one-way code made on the phone from the app's Android ID (a SHA-256 hash), so that when you sign in on the same phone again it gets its own device and profile back instead of a new one. The code cannot be turned back into the Android ID, and the Android ID itself never leaves the phone;
• when it last looked up a website, which we read from the DNS logs above to show whether it is protected right now.

We use this to show your devices in the app and on the website, to let you remove one, to keep each profile to one device, and to keep to the number of devices your plan allows. We do not collect the phone's serial number, IMEI, advertising ID or phone number. Signing out of the app keeps the device, so the phone can sign in to the same profile again. A device, with its code and its DNS address, is deleted when you remove it, or delete its profile or your account.

Visitor Analytics

When you visit our website, our servers securely process:

• Randomized visitor and session IDs (stored strictly on your browser).
• Visited pages, referrers, and advertising UTM tags.
• Your IP address to determine the country and region, as well as your ISP.
• Browser, operating system, device type, screen resolution, language, and timezone.

How we use your information

• To create, manage, and maintain your account securely.
• To operate our DNS filtering service and customize your profiles.
• To verify your payments and activate your subscriptions.
• To send mandatory service notifications.
• To provide customer support via WhatsApp or email.
• To analyze advertising campaign effectiveness and improve marketing strategies.

Cookies and Browser Storage

Our website utilizes cookies and local storage tokens, including:

• Session Cookies — Critical for keeping you logged in. The site requires these to function correctly.
• _fbp — A browser identifier formatted for Meta, kept for 90 days. Issued by ChayaNetwork natively.
• _fbc — Click identifier if you visit our site from a Facebook or Instagram ad. Kept for 90 days.
• Visitor & Session IDs — Randomized tokens placed in your browser's localStorage and sessionStorage to distinguish distinct page views efficiently.

Information we share with Meta

We utilize the Conversions API provided by Meta via Cloudflare Zaraz to evaluate our ad performance. This mechanism acts securely server-to-server; no Meta scripts are executed directly on your browser.

Information sent to Meta may include:

• Specific actions such as page views or completing a registration.
• The _fbp and _fbc identifiers mentioned above.
• SHA-256 Hashes of your email, mobile number, name, or customer ID. Your actual data is irreversibly encrypted and never dispatched to Meta directly.

DNS Logs Policy

• Logs indicate domains requested and whether they were allowed or blocked.
• We do not have access to, analyze, or keep the internal content of web pages or applications you access. DNS only handles address matching.
• Historical DNS logs are automatically purged after a maximum of 30 days.
• These logs are strictly private and not shared with third-party networks.

Android App

The ChayaNetwork Android app uses Android's VPN feature to filter the phone's internet for your family:

• The domain names the phone looks up are sent, encrypted (DNS over HTTPS), to ChayaNetwork's filtering server, which refuses the ones you blocked. These are the DNS logs described above. Only these lookups go through the VPN; all other traffic goes directly to the internet.
• Apps you block are refused by the filtering server and, if you turn on the optional app blocker below, also stopped on the phone itself. The full list of apps installed on the phone is never sent to us.
• The app does not read page content, messages or data inside other apps, does not decrypt any traffic, and does not route your other traffic through our servers.
• A notification is shown while protection is on. The app shows a notice explaining this before Android asks for VPN permission.
• The app also sends your account details when you register or log in, the profile and blocklist settings you choose, and the phone's maker and model, so it can be listed under Devices. It contains no advertising or analytics tools and does not collect your location, contacts, photos or files.

App blocker, time limits and Shorts blocker (optional)

If you turn it on, the app uses Android's Accessibility service to enforce the controls you set on the phone:

• When an app you blocked, or an app whose daily time limit is used up, comes to the screen, it goes back to the home screen.
• When the YouTube Shorts or Instagram Reels player opens, it notices it and goes back.
• It only watches the apps you chose (each blocked or time-limited app, plus YouTube and Instagram). For those it uses the name of the app on screen and, in YouTube and Instagram only, the identifiers of the short-video player.
• It does not read text, messages, passwords or anything typed, does not record the screen, and sends nothing from the screen off the phone.

The app explains this before sending you to Android Settings, and you switch it on and off yourself there. Which apps you blocked, and whether Shorts and Reels are blocked, are kept with the profile on our servers, so the setting stays after a reinstall and can be changed from another phone.

Screen time and app limits (optional)

If you turn on Android's Usage access for the app, it reads Android's own record of how long each app was on screen (the same record Android's Digital Wellbeing uses). The app uses it to show screen time for today, yesterday or the last 7 days, and to count your daily time limits.

• About every 15 minutes the app sends that profile's screen time to ChayaNetwork: the name of each app that was used and for how long, per day. Only the account owner can see this, in the app and on the website.
• With it, the app sends App history: each time an app was opened, which app it was (its name and Android package name) and when it was opened and closed. Very short visits of a few seconds are left out. Only the account owner can see this, in the app and on the website.
• For apps our servers have not seen before, the app also sends each app's icon as a small picture, so App history can show it. Icons are the apps' own public images, not anything from your phone's content, and are shared by all accounts.
• At the same times, whether or not Usage access is on, the app tells ChayaNetwork whether Usage access and Accessibility are switched on and which version of the app is installed, so the app and the website can tell you when a permission is off or the phone needs an update.
• The daily limits you set, in the app or on the website (the same every day, or a different time for each day of the week), are kept with the profile so the phone can enforce them.
• Screen time and App history are deleted after 30 days, and everything is deleted with your account or the profile. You can switch Usage access off at any time in Android Settings, which stops the reports.

Crash reports

When the app stops unexpectedly, it sends a crash report to Google's Firebase Crashlytics, so we can find the fault and fix it. A report describes the failure, not the person: where in our code it happened, the phone's make, model and Android version, how much memory and storage were free, and a few of our own warning lines from the moments before it.

• Crash reports carry no name, phone number, email address, profile name, website name or app name. They do say whether the phone was signed in, whether protection was on, and which permissions had been granted — as yes or no answers, with nothing that identifies you or your child.
• We do not use Firebase Analytics, advertising, or any other Firebase product in the app. Crash reports are the only thing the app sends to Google.
• Google holds crash reports on our behalf for a limited period (about 90 days) and then deletes them.

Information Sharing

We do not sell or rent your personal information. Under essential operations, some information might transverse the following platforms:

• Meta Platforms — Solely for analyzing ads as described in section 4.
• Google (Firebase Crashlytics) — Receives crash reports from the Android app, as described under Android App above. No personal information is included.
• Cloudflare — Provides our infrastructure. Regular IP data and browser statistics route through their edge nodes.
• Communication Services — OTPs and mandatory notifications pass through encrypted channels of our designated SMS/Email gateways.
• Legal Obligations — When compelled by enforceable laws within the jurisdiction of Bangladesh.

Data Security

• All communication to and from our services is encrypted via SSL/TLS.
• Passwords remain hashed securely via bcrypt.
• DNS Traffic is fortified with DoT/DoH encryption protecting it from interception.
• The operational infrastructure is shielded by Cloudflare Enterprise.

Children's Privacy

Accounts are exclusive to individuals aged 18 and older. Children do not have standalone accounts. Dependent profiles are exclusively managed by the parent's administration portal. The parent chooses each profile's name; a child's real name is never required.

Your Rights

At any given point, you have the right to request:

• An export containing the copy of your personal data on record.
• Rectification of imprecise information.
• Complete deletion of your account and connected usage data.
• Exclusion from marketing communications.

You can delete your account yourself in the app (Menu → Account → Delete account), or request it on our account deletion page. For any other request, contact us using the details below.

Any adjustments to this policy will be communicated via email or through the dashboard. Significant updates will be highlighted at least 7 days prior to coming into effect.

Contact Us

• WhatsApp: 01957-993911
• Email: support@chayanetwork.com