How Cylux Works: A Technical Deep Dive for Privacy-Conscious Parents

Our Privacy Philosophy

Cylux is a parental monitoring tool. We believe parents have both the right and the responsibility to monitor their minor children's digital activity. We also believe children deserve to know they're being monitored — transparency protects trust.

What we don't believe: that monitoring should mean sending raw message content to our servers, harvesting data for advertising, or retaining sensitive data beyond what's needed.

What Cylux Monitors (and How)

App usage time: Tracked via Android's UsageStatsManager — this is a privileged API that requires explicit parent permission. We see which apps were active and for how long, not what was done inside them.

Web browsing history: Captured via AccessibilityService, which reads the URL bar of the active browser. This is the same mechanism used by accessibility tools for visually impaired users. We see URLs, not page content or form inputs.

YouTube activity: Same AccessibilityService reads video titles and search queries visible on-screen. We do not access YouTube's internal API or your child's Google account.

Notifications: Captured by NotificationListenerService — a standard Android API. We capture the app name and notification title/body text only. We cannot read message threads or access app databases.

Location: GPS coordinates polled at configurable intervals (default: every 5 minutes). Stored for 30 days, then automatically purged.

App installs: Detected via BroadcastReceiver for Android package events. We capture app name and package ID at time of install only.

What Cylux Cannot See

• End-to-end encrypted message content (WhatsApp, Signal, iMessage body text)
• Passwords, form inputs, or anything typed in a secure field
• Photos, videos, or files stored on the device
• Anything inside apps when those apps are not in the foreground

Data Transmission and Storage

All data is transmitted encrypted (TLS 1.3) to servers in your region. Parent accounts are isolated — no other parent can access your data. We do not sell, share, or aggregate user data for any purpose other than delivering the service. Our privacy policy is written in plain English, not legalese.