App Safety Directory

What you can actually do: There is something to set. A parent can configure controls that reach the risk driving this score, verified against the vendor.

If something goes wrong, what record exists: A parent can see WHO their child has been in contact with, and when, through the vendor's own supervision tool. Not what was said. The operator holds message content on its own servers, so a court order or search warrant can reach what was actually said. Family Center shows a parent who their teen has communicated with in the last seven days and not what was said, which is the limitation already verified in the fifth run. On the operator side the guide is more nuanced than Snapchat's ephemeral reputation suggests: Snap's servers are designed to delete a Snap once all recipients have opened it, but Memories is cloud storage that persists until the user deletes it, and disclosure runs under the Stored Communications Act. One carve-out matters for this directory and is the reason the hidden axis is now sourced here: content a user puts in My Eyes Only "is not accessible to Snap and cannot be decrypted by Snap", so the vault inside the app is outside the reach of the operator's own legal process.

What you can actually do: Nothing for a parent to set, on the listing's own account. Apple's listing discloses no parental controls and no vendor check has been done. The levers that remain are the install decision itself, the conversation, and device-level limits outside the app (Screen Time, app removal).

If something goes wrong, what record exists: Nobody has checked whether this vendor gives a parent any view of contacts or messages. Treat it as not established, not as absent. The operator holds message content on its own servers, so a court order or search warrant can reach what was actually said. Cloud chats, which are the default, are stored on Telegram's servers, so the record exists. What is unusual is the operator's stated willingness to produce it: section 8.3 commits only to disclosing IP address and phone number, on a valid judicial order, for a suspect in a case violating Telegram's own terms. So a record existing and a record being retrievable are further apart here than anywhere else in the dataset. Secret Chats are the exception in the other direction, not stored on Telegram's servers at all. The parent side is not established and is deliberately left unverified rather than assumed absent.

What you can actually do: Nothing for a parent to set, on the listing's own account. Apple's listing discloses no parental controls and no vendor check has been done. The levers that remain are the install decision itself, the conversation, and device-level limits outside the app (Screen Time, app removal).

If something goes wrong, what record exists: Nobody has checked whether this vendor gives a parent any view of contacts or messages. Treat it as not established, not as absent. Nobody has checked what this operator retains or what legal process reaches. Not established, in either direction.

What you can actually do: Nothing for a parent to set, on the listing's own account. Apple's listing discloses no parental controls and no vendor check has been done. The levers that remain are the install decision itself, the conversation, and device-level limits outside the app (Screen Time, app removal).

If something goes wrong, what record exists: Nobody has checked whether this vendor gives a parent any view of contacts or messages. Treat it as not established, not as absent. Nobody has checked what this operator retains or what legal process reaches. Not established, in either direction.

What you can actually do: There is something to set. A parent can configure controls that reach the risk driving this score, verified against the vendor.

If something goes wrong, what record exists: A parent can see WHO their child has been in contact with, and when, through the vendor's own supervision tool. Not what was said. The operator holds message content on its own servers, so a court order or search warrant can reach what was actually said. Family Center shows a parent the teen's contact list and recent interactions without message content, verified in the fifth run and unchanged. On the operator side a search warrant reaches "the stored contents of any account", which Meta's own guidelines enumerate as messages, photos, videos, timeline posts and location. Read the retention sentence with it, because it is the part that surprises people: Meta does not hold data FOR law enforcement, and content the user has deleted is gone unless a preservation request arrived first. So the record exists while the account does, and a parent who waits is not preserving anything by waiting.

What you can actually do: Nothing for a parent to set, on the listing's own account. Apple's listing discloses no parental controls and no vendor check has been done. The levers that remain are the install decision itself, the conversation, and device-level limits outside the app (Screen Time, app removal).

If something goes wrong, what record exists: Nobody has checked whether this vendor gives a parent any view of contacts or messages. Treat it as not established, not as absent. The operator holds message content on its own servers, so a court order or search warrant can reach what was actually said. MeetMe holds private message content on its own servers, accesses it for moderation and legal process, and discloses on court order or subpoena, so the record exists and legal process reaches it. The parent half is deliberately left unverified rather than written as none: the privacy policy was read in full and describes no supervision feature, but absence from a privacy policy is the wrong document to prove absence of a product feature, and no MeetMe parent-facing page has been read. Recorded in TRAIL_SEARCHED so the next run knows a search already ran and what it did not settle.

What you can actually do: There is something to set. A parent can configure controls that reach the risk driving this score, verified against the vendor.

If something goes wrong, what record exists: A parent can see WHO their child has been in contact with, and when, through the vendor's own supervision tool. Not what was said. Message content is end-to-end encrypted and the operator does not hold it. Account records do exist and legal process can reach those. The one app in this dataset where BOTH halves are limited by the same fact, which is why it is worth reading as a pair rather than as two rows. Default end-to-end encryption on friends-and-family chats means Meta "will no longer be able to provide unencrypted message content as part of any response to any legal process", and it follows that no supervision feature can show a parent what an operator cannot decrypt. Messenger's own FAQ says so to the teen directly: a parent cannot "See the content of actual messages you send or receive". What a parent DOES get is narrower than the Meta-wide description suggests and is worth quoting exactly, "who you've chatted with in the last 7 days", so a conversation that ended eight days ago is not in it. That list now includes AI chats alongside people. Message and call logs and IP data still reach legal process. Meta's own wording is "is rolling out", present tense, so a chat outside the rollout still yields content; metadata_only is the default state rather than a guarantee about every chat.

What you can actually do: Nothing for a parent to set, on the listing's own account. Apple's listing discloses no parental controls and no vendor check has been done. The levers that remain are the install decision itself, the conversation, and device-level limits outside the app (Screen Time, app removal).

If something goes wrong, what record exists: Nobody has checked whether this vendor gives a parent any view of contacts or messages. Treat it as not established, not as absent. Nobody has checked what this operator retains or what legal process reaches. Not established, in either direction.

What you can actually do: Nothing for a parent to set. Checked against the vendor's own documentation and there are no parental controls at all. The levers that remain are the install decision itself, the conversation, and device-level limits outside the app (Screen Time, app removal).

If something goes wrong, what record exists: There is no vendor feature that shows a parent who their child has been talking to, or when. The operator holds message content on its own servers, so a court order or search warrant can reach what was actually said. The vendor publishes a page in its navigation labelled parents, and the controls check read it: it carries a safety blurb and instructions for blocking a sender after the fact. A page addressed to parents is not a view for parents, and this is the app in the dataset where the distinction is easiest to miss. The operator half is where an anonymous-messaging app is most misread, so read the two documents together. The privacy policy collects "your posts, photos and other submissions" and undertakes to share "any or all categories of personal information to respond to a court order or subpoena", naming the US government specifically. The FTC's 2025 complaint then enumerates what was actually held on children: phone numbers, birthdates, photos, and usernames for Snapchat, Instagram and TikTok. What the product would not tell a paying child is a separate question from what the operator could tell a court, and the same complaint separates them: a user who bought the reveal got "generic information like location or phone type" for a real sender. That was a product decision, not an absence of records. No retention duration is stated anywhere in the policy.

What you can actually do: Nothing for a parent to set. Checked against the vendor's own documentation and there are no parental controls at all. The levers that remain are the install decision itself, the conversation, and device-level limits outside the app (Screen Time, app removal).

If something goes wrong, what record exists: There is no vendor feature that shows a parent who their child has been talking to, or when. The operator holds message content on its own servers, so a court order or search warrant can reach what was actually said. Read the two halves against each other, because this app is where they are furthest apart. A parent gets nothing: the Terms were already read in full for the controls axis and describe no supervision flow, and TextNow's own help centre returns no results at all for "parental controls". An investigator gets a great deal: the privacy policy has TextNow collecting message content itself, the law-enforcement pages disclose on a valid order, and TextNow voluntarily preserves records for 90 days on a preservation request. The 4+ age rating means no Screen Time restriction withholds this app, so the practical shape for a parent is that there is a full record of what happened and the only route to it runs through law enforcement.

What you can actually do: Nothing for a parent to set in this age band. The vendor's controls are aimed at a younger band than the one this directory covers. The levers that remain are the install decision itself, the conversation, and device-level limits outside the app (Screen Time, app removal).

If something goes wrong, what record exists: Nobody has checked whether this vendor gives a parent any view of contacts or messages. Treat it as not established, not as absent. Nobody has checked what this operator retains or what legal process reaches. Not established, in either direction.

What you can actually do: Controls exist and they do not reach this app's main risk. Setting them is worth doing and it will not address what this score is about. The levers that remain are the install decision itself, the conversation, and device-level limits outside the app (Screen Time, app removal).

If something goes wrong, what record exists: There is no vendor feature that shows a parent who their child has been talking to, or when. The operator holds message content on its own servers, so a court order or search warrant can reach what was actually said. The parent half follows directly from finding 20 and needs no new reading: X's parental controls are real, parent-set and gated behind submitted proof of guardianship, and every one of them is about video. Nothing in them touches direct messages, which is the vector X scores 3 on, and nothing in them shows a parent a contact, a message or a list. That is what `scope_limited` records on the controls axis and it is why the parent view is none rather than partial. The operator half is a full public guide: content takes "a valid search warrant or equivalent", the US controller is "X Corp. based in Austin, Texas", and preservation is "a temporary snapshot of the relevant account records for 90 days". Two of its disclosures belong in front of a parent. "X doesn't require real name use, email verification, or identity authentication", so the account behind a message may not resolve to a person; and retention is stated with no durations plus an explicit warning that "some information (e.g., IP logs) may only be stored for a very brief period of time", with deleted posts "generally not available". Of the seven, X and Reddit are the two whose notice policy names child sexual exploitation as a reason to stay quiet. Finding 78.

What you can actually do: Nothing for a parent to set. Checked against the vendor's own documentation and there are no parental controls at all. The levers that remain are the install decision itself, the conversation, and device-level limits outside the app (Screen Time, app removal).

If something goes wrong, what record exists: There is no vendor feature that shows a parent who their child has been talking to, or when. The operator holds message content on its own servers, so a court order or search warrant can reach what was actually said. Kik holds message content for 60 days and then deletes it permanently from its servers, which is the number a parent and an investigator both need and neither would guess. Two things follow that a summary of this app gets wrong in opposite directions. It is not true that Kik has nothing to give: a search warrant return has a content folder, and the operator's own FAQ explains that it is empty only when no preservation request preceded the warrant or the account is banned or inactive past 60 days. It is also not true that the record is durable: 60 days is shorter than most families take to notice. What the user sees is a third thing again, since on a new device previous chats appear as a list while "the content of the conversations will be deleted". The parent half is nothing, verified against Kik's own help centre for the controls axis.

What you can actually do: Nothing for a parent to set, on the listing's own account. Apple's listing discloses no parental controls and no vendor check has been done. The levers that remain are the install decision itself, the conversation, and device-level limits outside the app (Screen Time, app removal).

If something goes wrong, what record exists: Nobody has checked whether this vendor gives a parent any view of contacts or messages. Treat it as not established, not as absent. Nobody has checked what this operator retains or what legal process reaches. Not established, in either direction.

What you can actually do: Nothing for a parent to set in this age band. The vendor's controls are aimed at a younger band than the one this directory covers. The levers that remain are the install decision itself, the conversation, and device-level limits outside the app (Screen Time, app removal).

If something goes wrong, what record exists: There is no vendor feature that shows a parent who their child has been talking to, or when. The operator holds message content on its own servers, so a court order or search warrant can reach what was actually said. The two halves point in opposite directions and that is the entry. NGL is anonymous to the RECIPIENT, which is what the product sells and what a teen believes; it is not anonymous to the OPERATOR, which collects the content, runs it through AI moderation and discloses to law enforcement on judicial order. So there is a record and a parent cannot see any of it: no supervision feature exists, and the vendor's position is that nobody under 18 should be there at all, which is the private-side echo of the FTC order that already sits on this app's controls state. For a family, the practical reading is that the sender of an abusive anonymous message is not beyond identification, but reaching that identification runs through legal process and never through the parent.

What you can actually do: Nothing for a parent to set. The protections are on by default, and a parent cannot set them, verify them, or restore them if they change. The levers that remain are the install decision itself, the conversation, and device-level limits outside the app (Screen Time, app removal).

If something goes wrong, what record exists: There is no vendor feature that shows a parent who their child has been talking to, or when. The operator holds message content on its own servers, so a court order or search warrant can reach what was actually said. Nothing on the parent side and the teen-safety document is unambiguous about why: the protections are global defaults the account applies to itself, locked for 13-to-15s, with the parental-approval flow still labelled coming soon. There is no linked account, so there is no list, no report and nothing to log in to. The operator half is the most precisely enumerated in the field and it cuts both ways, which is why Reddit's entry should not be read as reassurance in either direction. Non-public messages between users are a named category and take the top of the process ladder, "Reddit will only disclose the Contents of Communications pursuant to a valid search warrant". But Reddit also discloses, against its own interest, that it "generally collects minimal information from users and may have little or no non-public information available for many accounts", with no name, email or phone required to register. And it publishes the shortest clock in this dataset: "Reddit automatically deletes any IP addresses collected after 100 days, except for the IP address used to create an account". Content survives; the log that ties an anonymous account to a person is the part with a deadline on it, which makes a preservation request early worth more here than almost anywhere else in the file. Preserved records run 90 days by default.

What you can actually do: Nothing for a parent to set. Checked against the vendor's own documentation and there are no parental controls at all. The levers that remain are the install decision itself, the conversation, and device-level limits outside the app (Screen Time, app removal).

If something goes wrong, what record exists: There is no vendor feature that shows a parent who their child has been talking to, or when. The operator holds message content on its own servers, so a court order or search warrant can reach what was actually said. The most explicit retention statement in the dataset, and it points the opposite way from what the category's reputation suggests. Pinger publishes a table with durations, and message content, which it defines as the text messages you send and receive plus voicemails, is held "Indefinitely for active account and 6 months for inactive accounts". Call detail records run two years and registration information indefinitely. The policy names the reason: as a communications company it retains for longer "in part to honor the needs of law enforcement". A burner number is not a burner record.

What you can actually do: Nothing for a parent to set, on the listing's own account. Apple's listing discloses no parental controls and no vendor check has been done. The levers that remain are the install decision itself, the conversation, and device-level limits outside the app (Screen Time, app removal).

If something goes wrong, what record exists: Nobody has checked whether this vendor gives a parent any view of contacts or messages. Treat it as not established, not as absent. Nobody has checked what this operator retains or what legal process reaches. Not established, in either direction.

What you can actually do: Nothing for a parent to set. Checked against the vendor's own documentation and there are no parental controls at all. The levers that remain are the install decision itself, the conversation, and device-level limits outside the app (Screen Time, app removal).

If something goes wrong, what record exists: There is no vendor feature that shows a parent who their child has been talking to, or when. The operator holds message content on its own servers, so a court order or search warrant can reach what was actually said. This does not carry the whole answer: Yubo holds uploads, comments and messages, and states in the same guide that it does not store recordings of live videos, and live discovery is the surface this app is flagged for; if something happens on a live stream, a screenshot or screen recording taken by the family at the time is the only copy that will ever exist. Yubo runs the strongest age gate in the dataset and gives a parent no view at all, which is the pair worth reading rather than either half alone. The safety documentation read for the controls axis puts it directly: there is nothing for a parent to link to, set or review. The operator side is the best-documented in the dataset and it does not answer the same way for every surface. Uploads, comments and messages are held and reachable with a subpoena, search warrant or court order; live video is not held at all, and Yubo says so in terms: "We do not store recordings of live videos." On an app whose signature feature is going live, that is the half of the record most likely to matter and the half that does not exist. Two further conditions decide whether a US case reaches even the part that does: content is excluded from a response by default "unless explicitly requested and legally justified", so an investigator who does not name it does not receive it, and a non-French agency ordinarily arrives by MLAT or letter rogatory. Yubo's guide names crimes involving minors among the situations where it will cooperate directly instead, which is the shortest route in this file and the one a parent's case is most likely to qualify for. Accounts are "generally deleted after two years of inactivity", so the clock is long by the standards of this dataset.

What you can actually do: Nothing for a parent to set. Checked against the vendor's own documentation and there are no parental controls at all. The levers that remain are the install decision itself, the conversation, and device-level limits outside the app (Screen Time, app removal).

If something goes wrong, what record exists: There is no vendor feature that shows a parent who their child has been talking to, or when. The operator holds message content on its own servers, so a court order or search warrant can reach what was actually said. Mandatory age estimation, ID fallback, face-matching and age-banded communities, all vendor-documented and none of it parent-facing. The controls check read the safety documentation in full and found no supervision surface, so there is no contact list or history a parent can be shown. The operator holds direct-message content and lists it by name among the data a valid law-enforcement request can reach, gated behind "a domestic court or judicial order, warrant, or equivalent" rather than a subpoena. Wizz and Yubo are the same country, the same age-assurance vendor and nearly the same product, and their guides differ in one way worth carrying: Wizz names no exception to the MLAT and European Investigation Order route, not even for crimes involving minors, so a US request has no documented fast path. The published retention table compounds it. It gives a duration for account data, purchases and analytics and no duration at all for message content, which is the one category the same operator offers to produce.

What you can actually do: Apple's listing says this app has parental controls and no vendor check has confirmed it. Look for them, and treat the tier as provisional. The levers that remain are the install decision itself, the conversation, and device-level limits outside the app (Screen Time, app removal).

If something goes wrong, what record exists: Nobody has checked whether this vendor gives a parent any view of contacts or messages. Treat it as not established, not as absent. Nobody has checked what this operator retains or what legal process reaches. Not established, in either direction.

What you can actually do: Nothing for a parent to set. Checked against the vendor's own documentation and there are no parental controls at all. The levers that remain are the install decision itself, the conversation, and device-level limits outside the app (Screen Time, app removal).

If something goes wrong, what record exists: There is no vendor feature that shows a parent who their child has been talking to, or when. The operator holds message content on its own servers, so a court order or search warrant can reach what was actually said. The privacy policy counts "in-app messages and image, video, or other files" and voice calls as personal information it holds, and it discloses customer specific information in response to subpoenas and court orders, reserving the right to "access, read, preserve, and disclose" information to comply with a court order. Retention is stated as a set of criteria with no duration attached, which is the same silence as Text Me. The parent half was settled by the Terms of Use already read in full for the controls axis: a 16+ eligibility floor, no supervision flow and no age-verification mechanism.

What you can actually do: Nothing for a parent to set in this age band. The vendor's controls are aimed at a younger band than the one this directory covers. The levers that remain are the install decision itself, the conversation, and device-level limits outside the app (Screen Time, app removal).

If something goes wrong, what record exists: Nobody has checked whether this vendor gives a parent any view of contacts or messages. Treat it as not established, not as absent. Nobody has checked what this operator retains or what legal process reaches. Not established, in either direction.

What you can actually do: Nothing for a parent to set. Checked against the vendor's own documentation and there are no parental controls at all. The levers that remain are the install decision itself, the conversation, and device-level limits outside the app (Screen Time, app removal).

If something goes wrong, what record exists: There is no vendor feature that shows a parent who their child has been talking to, or when. The operator holds message content on its own servers, so a court order or search warrant can reach what was actually said. The privacy policy puts "messages sent and received using TextMe services" inside the Usage Data it collects, and the law-enforcement notice accepts subpoenas, warrants and court orders, so the record exists and legal process reaches it. Two qualifications belong on the same line rather than in a footnote. TextMe states no retention duration anywhere, so unlike Text Free nobody outside the company knows how long the record lasts. And retrieval is priced: subscriber information costs a requesting agency $75 for up to three numbers, with notarised documents $200 more. The record existing and the record being obtained are different questions, and this is the app where a fee sits between them.

What you can actually do: Nothing for a parent to set. Checked against the vendor's own documentation and there are no parental controls at all. The levers that remain are the install decision itself, the conversation, and device-level limits outside the app (Screen Time, app removal).

If something goes wrong, what record exists: There is no vendor feature that shows a parent who their child has been talking to, or when. The operator holds message content on its own servers, so a court order or search warrant can reach what was actually said. The vendor's Safety Center and privacy policy were both read in full for the controls axis and neither contains a parent-facing feature of any kind: no supervision, no linked account, no setting a parent can reach. On an anonymous compliment app, nothing a parent can see means nothing about who is sending. The operator half rests on a thinner document than any other entry in this field and the thinness is itself the thing to report. Peek names AWS as its cloud provider and Twilio for user communications, so the pool of who picked whom sits on the operator's servers rather than on the phones, and a US company holding US-hosted records is reachable by ordinary legal process whatever its policy says. What is missing is the vendor's own account of it: the privacy policy contains no legal-process clause at all, no mention of law enforcement, court orders or subpoenas, and the sharing section runs to vendors and business transfers and stops. Retention is capped at the life of the account and stated no more precisely than that. This is the weakest-evidenced determination in the field and finding 71 is where that is argued rather than hidden inside a state that reads identical to Yubo's.

What you can actually do: Nothing for a parent to set. Checked against the vendor's own documentation and there are no parental controls at all. The levers that remain are the install decision itself, the conversation, and device-level limits outside the app (Screen Time, app removal).

If something goes wrong, what record exists: There is no vendor feature that shows a parent who their child has been talking to, or when. The operator holds message content on its own servers, so a court order or search warrant can reach what was actually said. Terms of Service and privacy policy, both read in full for the controls axis, describe no parental control and no supervision flow. Read this beside the open item on identifying-data collection: the app takes a child's phone number, name, age, school, grade, photos and address book, and shows a parent none of it. The operator half needs no inference, because the collection list names the anonymity machinery itself: "Poll, vote, invite, reveal, subscription, purchase, and app activity information". The reveal is a paid feature, so the identity behind an anonymous vote is a thing the operator holds and prices, and the same sentence that establishes the product establishes the record. Legal disclosure is one unelaborated clause and no retention duration is given.