Privacy in the web test
Who operates Sprout, what information the test handles and which details still need clarification.
Controller
Nordic Digital Trust & Safety, CVR 43132547, Tendrup Møllevej 51, 8543 Hornslet, Denmark, is the provider and controller for Sprout’s processing of information. Nordic DTS publishes its name and CVR on its own company pages. Email privacy@nordicdts.com about privacy and rights.
When you visit the website
Vercel delivers the website. Your connection can include your IP address, the address you open and technical information from the browser. This is separate from app content. The exact operational and security data recorded, its purposes and lawful bases are not confirmed yet.
When you write to us
The contact form opens an email draft in your browser; it does not send the form to Sprout. If you send the email, we receive your email address, message and the information you include so we can handle your enquiry. Use example data when reporting a problem. The email provider and lawful basis need to be confirmed in the final policy.
Family
The app’s browser storage keeps names, relationships, optional phone numbers, agreements, meeting places and notes. You can choose to add a location to a meeting after granting browser permission. This does not provide live tracking or automatic location sharing.
Safe Keyboard
Check message processes text locally while the app is open. Text is not saved on reload or sent to an external AI service. You choose whether to copy your reply. This feature does not read keystrokes or messages in other apps.
Safe Camera
Photos you choose or take with the camera are processed on the device. Images, detections and classifications are not uploaded. Analysis files come from the app’s own address and may be saved on the device for reuse. Camera and mask preferences are stored in the browser. You choose whether to save an edited image copy on the device.
Plans and progress
Parent Coach saves your conversation plans, words, notes and follow-up. Gaming & Screen Time saves timers, agreements, budgets and purchases you enter. Learning saves tasks, steps, reflections and mission progress. This information stays on the device in each app’s browser storage.
Safe Browser
The access-protected online test uses private Vercel Blob storage in region fra1 (Frankfurt) for rules, access requests, text fingerprints, salted code and key hashes, and session hashes. Setup may also contain the child’s name and age setting. Bookmarks are saved in the browser. Full fetched pages are not stored; page text is processed temporarily on the server. A local test server may still have its own rules file, which is not automatically moved to the online test.
When Safe Browser fetches a page
Permitted addresses are fetched through Safe Browser’s server. The website provider may receive the server’s IP address and the requested address. The reader does not send the website’s cookies, parent key or a referrer. It does not load page scripts or images either. A request without cookies does not make your browsing anonymous.
Who can see data, and how long is it kept?
Local records remain until you remove them or clear browser data. Downloaded copies must be deleted separately. In Safe Browser’s protected online test, a parent can choose Slet Browser-data (Delete Browser data) under Data og forældrekode (Data and parent code). This requires parent access, the current code and confirmation. The current server workspace’s content is replaced by a deletion marker: its name, age setting, rules, requests, approvals and access data are removed from the saved workspace content. The workspace’s hashed address and deletion timestamp remain without automatic cleanup to prevent old tabs from restoring it. Device bookmarks and downloaded copies are unaffected. This is logical deletion of app data; provider logs and backups need separate confirmation. Clearing cookies does not delete server data and may remove your access to the workspace. Use fictional test data only and email privacy@nordicdts.com about server data and rights.
Who receives information?
Most app content is processed on the device and is not automatically sent to Sprout, parents or external AI. Safe Browser’s online test instead sends rules and requests to its server and private Vercel Blob storage. There is no shared Sprout account or sign-in email. Sprout-chat in the protected Vercel test shares between two participants through its own private server store; other app data is not shared automatically. Vercel provides the website, access protection and test hosting. Processing roles, agreements, logs, the email provider and any transfers still need confirmation; fra1 describes the configured Blob region, not every provider data flow. Account sign-in is not open.
Emails and operational data
Retention periods or specific deletion criteria have not been set for received emails, bug reports, operational data or security data. This test information therefore gives no confirmed automatic deletion period for them. Do not send us private messages, sensitive child data or images.
Your rights
Email privacy@nordicdts.com about access, correction, erasure, restriction, objection or a copy of information where those rights apply. If processing relies on consent, you can withdraw it. You can complain to the Danish Data Protection Agency at datatilsynet.dk. Sprout does not automatically receive local records on your device and cannot erase them for you. Safe Browser’s server data is separate; a parent can delete the current workspace’s app data with Slet Browser-data (Delete Browser data). A deletion marker and timestamp remain; local bookmarks and downloaded copies must be deleted separately.
For children
You choose which text or photo to open. An adult with access to the app and browser profile can see saved records. Ask before saving private information about someone else. Ask an adult for help if you want to see or remove information. You do not need to send us private photos or messages to get help.
Legal status of the test
Updated 13 October 2026. This information is not legal approval or a completed assessment of every requirement. Lawful bases, processor agreements, retention for email and logs, and any transfers outside the EEA still need confirmation. Use fictional data only for testing.
My apps and AI Check
My apps saves your app shortcuts in this browser. Removing a shortcut does not delete app data. AI Check processes text, image files and text read from images (OCR) on the device without uploading the content. Analysis files may be downloaded from the app’s own origin. Results can be inconclusive and do not prove who created the content.
Safe Browser’s device cookie
Safe Browser’s online test uses __Host-sprout_browser_workspace to select this browser’s private workspace on the server. It does not grant parent access and is not a Sprout login. The cookie is HttpOnly, Secure and SameSite=Strict, applies to the whole app origin and is set with Max-Age=31536000 (one year). The period is renewed when the server sets the cookie again. Expiry or clearing does not delete server data. This cookie is separate from Vercel access protection and the website’s cookie notice.
Sprout-chat: server data
Sprout-chat is available in the protected Vercel test. The test for two participants has text only and uses a dedicated private Vercel Blob store in fra1 (Frankfurt) with hourly cleanup. Accounts and sign-in emails remain deferred. In the configured test, accepted message text, withholding markers and send results are stored on the server. The parent code is stored as a salted hash, and access and invitation secrets are stored as hashes. No names, email addresses or phone numbers are collected. Unsent drafts are not saved to disk. The room expires after 24 hours and holds the latest 48 messages; expiry is not physical deletion. Removing the contact clears the conversation, and code-protected deletion removes content and access through a deletion marker. Cleanup runs automatically and hourly and removes expired rooms and deletion markers. An incomplete job returns 503 and needs follow-up; logs and backups need separate confirmation.
Sprout-chat’s session cookie
Sprout-chat is available in the protected Vercel test. In the protected test, __Host-sprout_chat is used as an essential session cookie for up to 24 hours: HttpOnly, Secure, SameSite=Strict and Path=/. It is separate from Safe Browser, Vercel access and Sprout sign-in and is not used for analytics or marketing. Expiry does not delete the room’s server data; physical deletion is performed by the hourly cleanup job; an incomplete job returns 503 and needs follow-up.
App Blocker
Rules and test usage are saved in this browser. The parent code protects changes within App Blocker; it does not lock the phone. Testing does not measure real app usage or change other apps or browsers. The parent code is stored as a salted hash on the device and is not included in backups.
Profile Check
Saved checks, chosen profile links and your answers stay in the browser where you save them. Opening search links sends the query to the chosen platform or Google. An optional Bluesky lookup sends the username and IP address to Bluesky’s public service when you choose it. There is no automatic background search or identity verification.