PIA: Screen time, entered by people in a group

Status: Assessed before code and approved with conditions on 6 November 2026.

Screen time lets people record how long they or someone in their group spent on screens on a day. It includes children, with or without an account. People type the times in: we never read a phone's screen-time figures. This is a behavioural record about a person, including a child, and changes the earlier position in our child-accounts assessment.

What is kept

An entry holds the person or child it is about, minutes, a day in the group's time zone, who logged it, creation and update times, and a save identifier for Undo. A child's own entry can also hold one adult's current verification tick, who added it and when. An adult can set one current daily target for a child. Earlier targets and removed ticks are not kept.

A child added only in Screen time has a name and palette colour. They have no account, birth month, guardian link or photo there, and never appear in the roster or another tool. There are no fields for a device, app, activity, note or time of day. Minutes and targets range from 5 to 240. Targets use five-minute steps.

Who can see and change it

Everyone in the group aged 16 or over sees every entry and can log for anyone. A child account under 16 sees only their own entries and target. They can log for themselves and change or delete an entry they logged, until an adult verifies it. They cannot change entries someone else logged about them. People aged 16–17 cannot change or delete a verified entry.

Only people aged 18 or over can verify a child account's self-logged entry or set a child's target. They can also remove a tick. Editing a verified entry updates its tick's attribution to the adult making the change. Entries an adult logged, entries about people aged 16 or over, and entries about a child without an account cannot be verified. Targets apply only to child accounts and children added in Screen time, and a member's target goes when they turn 16.

The database enforces these boundaries. The shared display and accounts representing people without phones cannot read or write these records. Pending and former members, someone in another group and anyone signed out have no access. Guardianship does not narrow the audience: a separated parent still in the group can see these figures. A later joiner aged 16 or over sees earlier entries too. The child's own view tells them exactly who sees and can add to it, that adults can verify entries and set targets, and that people type the times in.

Where it is kept, and what never reads it

The records are stored as ordinary text in our database in Sydney, protected by transport security and database access rules. They are not encrypted on the phones. Pending new entries are kept on the logging phone for sending later; signing out clears them. Other loaded records stay in memory and are cleared when the group or account changes.

There are no notifications, wall surface, assistant reads, voice reads, daily-brief reads, insights, Mail Sifter reads or allocation reads. Entries have no share action, chat link, cross-group mirror or phone-calendar copy. Usage counts may record opening the tool, never subjects or minutes. Runtime logs contain counts and fixed failure codes only.

An assistant action for proposing verification is a separately assessed future step. It must pass its evaluation before being offered, and its privacy-policy sentence must ship with it. No assistant action is part of this tool release.

Deletion, retention and Undo

There is no automatic sweep. Entries remain until someone deletes them. Each person's All entries list reaches older entries, newest first. Everyone can delete all their own screen time in the group. A member aged 16 or over can delete all of a child added in Screen time's entries without removing the child. These actions delete only entries the caller could delete individually. A child is told how many adult-logged or verified entries remain, why they remain, and that they can ask an adult in the group to remove them.

Deleting one entry hides it while its Undo offer is visible. Undo cancels the deletion, keeping its attribution and tick intact. When that offer ends, the deletion is sent. Leaving the screen, changing group or account, signing out, or moving the app to the background sends it immediately. If a tick landed first and the deletion is refused, the entry is read again and shown with the tick and a failure message. Nothing is reinserted to implement this Undo.

Leaving or being removed from the group deletes entries and targets about that member. Their attribution on entries about others is removed, while existing ticks stay. Account deletion, erasing a profile, removing a child added here and deleting the group remove their records. Backups can last up to 90 days, and a delivered export or screenshot can outlive a deletion. Exports read through the caller's access rules: a child gets only their own entries and target.

A phone cancels queued inserts for an entry it deletes, and retrying an insert cannot replace an existing row. There is no server deletion ledger: a stale insert from another phone can recreate an identifier after its row was deleted. This limitation was accepted on 6 November.

Avoiding ranking and pressure

Rows stay in this order: you, members in group order, then children added here. Amounts never reorder people. Charts share an axis, use neutral bars and draw a child's target as a dashed ink line. Nothing calculates a verdict against the target. There are no group totals, rankings, streaks, rewards, comparisons, surveillance reports or labels for entries without a tick.

The accepted risks are that adults can record someone else without their agreement or a notification; a separated parent still in the group sees the figures; history can accumulate; duplicates and false entries are possible; a tick restricts a child's correction rights; and a visible target may feel like pressure. Attribution, informed disclosures, deletion and leaving are the available remedies. Membership is the audience boundary, not guardianship.

Sources

The binding assessment is HQ pias/pia-018-screen-time.md, conditions C1–C24, with copy decision D140 and deferred-delete decision D142. The register amendment and policies accompany the tool. The provisional adult policy edition is subject to coordination before merging; only Screen time and live v3.16 notices for members who skip them are included. The child policy is version 1.9.

Implementation and evidence: docs/reference/screen-time.md, __tests__/screen_time.test.ts, __tests__/screen_time_export.test.ts, __tests__/screen_time_delete_all.test.ts, lib/__tests__/screenTimeBoundaries.test.ts, and Screen time component, screen and copy tests.