FAMILY DATA BELONGS WITH THE FAMILY
Privacy policy
Effective October 15, 2026
Temperance is open-source software that parents run themselves to manage their children’s internet access. The project does not operate a Temperance cloud service or collect app telemetry. Your installation does process family data so it can apply your rules.
1. This public website
This policy covers the Temperance project website and the software in the official Temperance repository. This website is a static introduction to the product. It has no sign-in, forms, advertising, analytics scripts, tracking pixels, or embedded third-party content. It does not set application cookies or use browser storage. Fonts and brand assets are served with the website.
GitHub Pages hosts this website. GitHub states that it logs and stores visitors’ IP addresses for security purposes. GitHub’s processing is described in its Privacy Statement and Pages data collection documentation. Following a link to GitHub or another website subjects that visit to the destination’s policies.
2. Information your installation handles
The parent or administrator chooses where Temperance runs and controls access to its data. The standard installation stores its database on that server using SQLite; administrators can configure PostgreSQL instead. Depending on the features you use, that installation can store:
- Profiles and rules: profile names, avatars, schedules, internet time budgets, filtering rules, rewards, and account usernames and password hashes.
- Device and connection information: device names and identifiers, IP addresses, VPN public keys, authentication records, last-seen times, and reported connectivity or permission issues. Device apps generate VPN keys locally and store credentials on the device.
- Usage and filtering history: observed network minutes and domain decisions, including the domain, time, associated device and profile, whether access was blocked, and the reason or category. Network minutes are not a complete measure of screen-on time.
- Requests and events: requests for more time, messages submitted with those requests, approval decisions, and administrative notifications.
- Optional location: when an administrator requests a location and a supported device shares it with the required permission, the server stores the reported latitude, longitude, accuracy, and timestamp. This is a requested location feature, rather than a continuous location history.
- Service configuration: settings and credentials for optional services you enable, such as dynamic DNS, plus backups and exports you create.
Temperance uses this information to authenticate devices and administrators, route VPN traffic, enforce parental rules, display usage and device status, and handle family requests. The VPN gateway processes traffic that devices route through it. Domain history is not a copy of page contents or messages, but domains and network metadata can still reveal sensitive information.
3. Who can access data and external services
Administrators with access to your installation can view family data in the dashboard. The project maintainers do not automatically receive your installation’s database, browsing history, location, or diagnostics. Temperance does not include advertising, sell family data, or send app telemetry to the project.
Optional SMTP email sends generic event notices to the administrator’s configured recipient through their chosen mail provider. Notices omit client names, request text, domains, locations and credentials. Delivery attempts and results are retained locally. Optional category feeds are downloaded from operator-selected HTTPS sources without sending browsing history to those sources.
Encrypted recovery archives include the household database, gateway identities and Temperance configuration. Keep the recovery passphrase separately and protect any copies. Configuration exports are plaintext and contain sensitive household data. Support reports contain allowlisted version, health and aggregate information; they are shared only when you choose to download and provide them.
Self-hosting does not mean that all traffic stays inside your home. Your gateway contacts websites and services on behalf of connected devices. Allowed DNS queries are forwarded to the configured DNS resolver (by default, Cloudflare’s 1.1.1.1). Your internet provider, server or database host, DNS provider, and any optional tunnel, dynamic DNS, update, SMTP email, or category-feed providers may process information as part of providing their services. Their handling of that information is governed by their own policies.
Opening a device’s location link in the admin dashboard sends the coordinates in that link to OpenStreetMap. Backups, exports, issue reports, and any data you choose to share go to the recipients or services you select.
4. Security and retention
Temperance uses WireGuard for VPN tunnels, hashed account passwords, and scoped device credentials. The admin dashboard uses authentication and session cookies. Those cookies belong to your running installation, rather than this public website. Protect your admin credentials, devices, server, database, and backups; use HTTPS for browser access outside a trusted local connection. No software or hosting arrangement can guarantee complete security.
History and usage retention defaults to 30 days and can be configured from 1 to 90 days. Cleanup applies the configured window to domain history and daily usage; domain history is also capped at 20,000 entries. Notifications and time requests are each capped at the latest 500 entries. These limits do not automatically expire every other record, such as profiles, configuration, or the latest reported device location. Backups and exports are separate copies and keep their data until you delete them.
5. Your controls and children’s privacy
Temperance is intended to be installed and administered by parents or other authorized adults. It does not require children to create an account with the Temperance project. Accounts and profiles are created in the family’s own installation.
Explain to your children what is monitored and why, use only the information your family needs, and manage device permissions for optional features such as location. Administrators can change retention settings, delete domain history, revoke or remove devices, and remove profiles or accounts from the dashboard. To remove an entire installation’s retained data, also remove its database, device credentials, backups, and exports. Uninstalling an app alone does not erase server records or backup copies.
For access, correction, or deletion requests about a family installation, contact its administrator, who controls that data. The project maintainers cannot access or delete records from a server you operate. If someone else hosts or modifies Temperance for you, ask that operator about their additional data practices.
6. Questions and changes
For questions about this policy, use the contact options on the official GitHub repository. Public issues are visible to everyone: do not post children’s names, credentials, location, browsing history, or other private family information there.
We will update this page when the project’s described data practices change and revise the effective date above. Because Temperance is self-hosted and open source, the behavior of your installed version or a modified version may differ; review the source and configuration for the version you run.