Most family control and activity packets are encrypted in the app before relay, using AES-GCM. The server forwards these packets but generally cannot read their contents.
The short version
Useful information, for specific jobs.
Cublink is a family device-management app. Some information stays on the phones or is encrypted before relay. Family/device identifiers, connection metadata, and app-icon lookup details remain readable to route messages and display the app list. We identify those differences below.
01 / What information is used and why
Information by purpose
| Information | Why it is used | Who can read it |
|---|---|---|
| Sign-in account details Email address and account/provider identifiers, and profile details supplied by Google when used. | Authenticate the person signing in and maintain the account. | Firebase Authentication processes sign-in details. For family records, the relay stores the verified Firebase user ID linked to a family ID for record lookup and deletion handling; it does not store the sign-in email or Google profile details. |
| Family and device registration Family/device IDs, device display name, pairing and authentication credential hashes, registration timestamps, and a verified Firebase user ID-to-family association. | Pair parent and child phones, authorize a device, associate relay records with a signed-in account, and route messages to the right family device. | The Cublink relay stores family/device IDs and the verified account-to-family association in readable form; credential secrets are stored as hashes. |
| Connection metadata Source IP while a network request is handled; child phone's local IP address and port; device role and last-seen time. | Route family messages, establish local connections, show online status, and troubleshoot delivery. Cublink does not perform IP geolocation or display a server connection map. | The relay uses request source IP while handling network traffic but does not write it to the Cublink app database. It stores the child device's local address, port, and last-seen time. Hosting and network providers may process connection metadata under their own policies. |
| Family controls and activity Schedules, app rules, settings, commands, app-use summaries, and related control events. | Apply the parent's settings and show the parent the child's device activity. | The app encrypts most of these packets with AES-GCM before relaying them. The relay forwards ciphertext and cannot interpret most of that content. For push delivery the relay can see the allowlisted event category and event ID in the routing frame. |
| Installed-app catalog details Installed package names are sent for icon lookup. Missing entries may include the app's display name and icon image. | Show names and icons in the parent's app list. | This lookup is separate from encrypted family packets. The icon service receives package names and stores shared catalog entries (package name, app name, icon) not linked to a family record. |
| Location and safe-place events Location information when a parent views the map, and geofence-related events used by the feature. | Show the child's location on the parent's map and support configured safe-place alerts. | Coordinates, safe-place names, and event details remain in encrypted family packets. For remote push delivery, the relay can see the event category and event ID. Firebase Cloud Messaging receives generic alert text and the encrypted event packet, not the readable event category, place name, or coordinates. |
| Subscription status Purchase entitlement or subscription status when billing is enabled for an account. | Determine whether the account can use paid features and support family sharing. | Google Play handles purchase/payment details for Play purchases; Cublink receives the entitlement status needed to unlock service access. Cublink does not receive the card number from Google Play. |
| Push messaging Firebase registration token, family topic, generic alert text, encrypted event packet, message ID, and delivery metadata. | Send parent alerts for child lockdown, timeout completion, battery at or below 10%, and when a child leaves a safe place. | The relay sees the allowlisted event category and event ID, then sends generic notification text and the encrypted family event through Firebase Cloud Messaging. FCM processes the topic and delivery metadata and can carry the encrypted packet. It does not receive the readable event category, child's name, safe-place name, or coordinates. The parent app stores up to 100 decrypted notice details locally on that parent device. |
| Website visit information IP address and ordinary request/browser metadata. | Deliver and protect the company website. | Cloudflare Tunnel routes requests to the webserver, so Cloudflare processes connection and request metadata. The webserver also creates access and error logs, retained for up to 14 days. The pages request fonts from Google Fonts, so Google receives request metadata when a browser fetches font files. These website details are separate from the Cublink app data described above. |
02 / Encryption and visibility
What encryption protects
Family/device identifiers, the verified Firebase user ID linked to a family, device names, credential hashes, connection timing, IP/network information, and app-icon lookup package names are not hidden by that packet encryption.
Remote connections use TLS. Local Wi-Fi transport currently uses WebSocket without TLS; packet content remains app-encrypted, but connection metadata and transport itself do not get TLS protection on the local network.
The apps keep account/session information, paired-device data, settings, and encryption material in app storage on the phones. Device operating-system security and the phone's backup settings also affect protection.
Cublink is not a zero-knowledge service. Encryption is an important protection, but it does not prevent the service from seeing the metadata listed on this page.
03 / Service providers
Who helps provide Cublink
We use service providers for specific functions: Google Firebase Authentication for sign-in; Firebase Cloud Messaging for push registration and delivery when enabled; Google Play for app distribution and subscription payment processing; Cloudflare Tunnel to route website requests; and hosting and network-relay providers to run Cublink. These providers may process information needed for their function under their own service terms and privacy practices. We do not authorize them to sell Cublink family data on our behalf.
The website uses Google Fonts, so a browser requests font files from Google. Cloudflare, Google, Firebase, Google Play, network, and hosting provider log retention is governed by each provider's own terms and settings. The webserver's access and error logs are retained for up to 14 days.
04 / Retention and deletion
How long information stays
Active family and device records
When a verified family deletion request is completed, active family and device records are removed from the relay along with associated queued messages and temporary relay state. Use the account and data deletion request page, also linked from the app. Requests are reviewed and processed manually after ownership is verified. Legacy family/device records not linked to a signed-in Firebase account by Nov 30, 2026 are scheduled for deletion after that date; linked families are preserved.
Offline commands
Encrypted commands queued for an offline device expire after up to seven days.
App icon catalog
Shared package-name, app-name, and icon entries remain in the catalog until they are replaced or manually removed. They are not linked to a family record.
Server logs and backup copies
Cublink server logs and any server-side backup copies are retained for no more than 30 days. No scheduled Proxmox backup job is currently configured for the Cublink or website containers. If a server backup copy is created, it must expire within 30 days. A deletion request removes active family records; copies in logs or backups may remain until they expire. Third-party provider logs follow the provider's own retention policies and may be kept for a different period.
Connection records
The relay stores a child's last-known local address, port, and last-seen time until the device record is deleted. Source IP may be processed by the relay and hosting/network providers to handle connections and security.
Phone storage
Information in app storage remains on the phone until removed by the app or the app's data is cleared/uninstalled; phone backup settings may affect copies outside the device.
Start a request from the account and data deletion page or contact [email protected]. Requests are handled manually after ownership is verified. We may use the verified Firebase user ID-to-family association, sign-in email, and family/device display name or family ID to locate the right records; never send a password, Parent PIN, QR code, pairing secret, or encryption key. A request to delete a Cublink account covers its Firebase Authentication account and associated Cublink data we can identify. It does not delete the user's Google Account. Google Play subscriptions must be cancelled separately in Google Play. Uninstalling the app or clearing phone data does not by itself remove server-side records. Local app data must be cleared or the app uninstalled separately. We confirm when processing is complete; server backup copies and provider logs follow the retention limits described above.
05 / Our promise
Your family's information is not a product.
Seals Logistics and Services LLC does not sell, and will never sell, personal information or data about parents, children, families, devices, app use, or location. We use data to provide and secure Cublink, troubleshoot service operation, and meet legal obligations. We do not sell this information to advertisers or data brokers.
Questions or a parent data request?[email protected]
Contact Seals Logistics and Services LLC →Seals Logistics and Services LLC · 3101 120th Ave NE, Norman, OK 73026 · 405-561-2389