LexMatrix Guard

1 Introduction & Overview

LexMatrix Guard is a parental control system that protects children from harmful social media platforms and manages their screen time. It consists of two parts:

• Parent Dashboard (PWA) — A web app you open in a browser (phone, tablet, or computer) to control and monitor your child's device remotely.
• Mobile Enforcement App — An app installed on your child's Android or iOS device that silently enforces the rules you set from the dashboard.

What platforms are blocked?

The system enforces 72 platforms — 10 legally-banned platforms for children under 16 (in compliance with Australian, Brazilian, Danish, French, Greek, Indonesian, Malaysian, Spanish, UAE, and UK online safety legislation) plus 62 parent-controlled loophole platforms that children migrate to when banned apps are locked. The following platforms are monitored:

Legally-Banned Platforms (10)

Parent-Controlled Platforms (62)

These platforms are not legally banned but are commonly used as loophole alternatives. They default to LOCKED and parents can change them to TIMED or ALLOWED at any time.

2 Getting Started — Parent Account Setup

2.1 Accessing the Parent Dashboard

The parent dashboard is a Progressive Web App (PWA). You don't need to install anything from an app store — simply open your browser and go to:

https://lexmatrixguard.com/dashboard

2.2 Creating Your Parent Account

Account creation is invitation-gated for security. You'll need an invitation code to register.

1. Navigate to the dashboard URL above.
2. Click "Create one" to switch to the sign-up form.
3. Enter your Email address.
4. Choose a Password.
5. Select your Compliance Region (United Kingdom, Australia, United Arab Emirates, Brazil, Indonesia, or Malaysia) to ensure the proper age-regulation standards are loaded for your profiles.
6. Set a 6-digit Security PIN — this PIN is required for all sensitive actions (toggles, lockdowns, sign-out). Choose something your child cannot guess.
7. Select your Device Setup mode:
   • Mobile + Desktop — enables the Desktop Protection section (browser extension pairing, daemon download, heartbeat monitoring, desktop tamper alerts). Choose this if your family uses desktop or laptop computers.
   • Mobile Only — hides the Desktop Protection section entirely and suppresses all desktop alerts. Choose this if your family only uses mobile devices (phones/tablets). You can switch to Mobile + Desktop later from the dashboard if you get a computer.
8. Enter your Invitation Code (contact support if you don't have one).
9. Click "Create account".

2.3 Email Verification

After creating your account, a verification email is sent to your inbox:

1. Open your email and click the verification link.
2. Return to the dashboard and click "I've Verified My Email".
3. If you didn't receive the email, click "Resend Verification Email".

2.4 Selecting Your Device Setup Mode

During sign-up, you'll choose your Device Setup mode. This determines whether desktop protection features (browser extension, daemon, heartbeat monitoring, desktop alerts) are visible in your dashboard.

• Mobile + Desktop — The Desktop Protection section is visible. Choose this if your family uses desktop or laptop computers. You'll be able to pair the browser extension, download the daemon, and monitor desktop heartbeats and tamper alerts.
• Mobile Only — The Desktop Protection section is hidden and all desktop alerts are suppressed. Choose this if your family only uses mobile devices (phones and tablets). This avoids cluttering your dashboard with desktop features you don't need and prevents unnecessary desktop alert notifications.

2.5 Entering Your Security PIN

Once your email is verified, you'll be prompted to enter your 6-digit Security PIN to access the dashboard. This is the PIN you set during sign-up.

2.6 Signing In (Returning Users)

If you already have an account:

1. Go to the dashboard URL.
2. Enter your Email and Password.
3. Click "Sign in".
4. Enter your 6-digit Security PIN when prompted.

If you forgot your password, click "Forgot password?" on the sign-in screen to receive a reset email.

3 The Parent Dashboard (PWA)

After signing in, you'll see the main dashboard. This is your control centre. The dashboard is organised into the following sections, each explained in detail in the sections below:

• Navigation Bar — Logo, your email, SET PIN button, REFRESH button, SIGN OUT button
• Child Profile Selector — Switch between children, add or delete profiles
• Core Legislation Layer — Global Shield toggle
• Device Integrity — Real-time status of your child's device
• Enforcement Kill Switch — Emergency disable for non-banned platforms
• Hourly Time Allocation Matrix — Time budget for timed apps
• Parent-Controlled Platforms — Toggle 62 parent-controlled platforms (WhatsApp, Telegram, Discord, Roblox, Rednote, Lemon8, and more) between ALLOW/BLOCK/TIMED
• Live Platform Interaction Audit — Table of all monitored platforms
• Category-Based Blocking — 6 restricted categories blocked by default, catch unknown apps by type
• DNS-Level Filtering — Category-aware DNS blocking at the network level, prevents circumvention via alternative DNS resolvers
• Installed App Inventory — Alphabetical list of all apps on your child's device, with new-app alerts
• Community-Sourced Blocklist — Report suspicious apps; 3 reports in a region promotes to watch list
• Behavioral Classification — AI-powered detection of apps behaving like social media (social feed UI, messaging infrastructure, profile systems)
• Trending Social App Detection — Daily polling of App Store trending Social Networking apps; alerts if your child has a newly trending app installed
• Gaming Lobby Chat Detection — Detects in-game chat UI in Roblox, Fortnite, Minecraft, Rec Room, and VRChat
• Messenger Feature-Level Blocking — Blocks WhatsApp Communities/Channels and Telegram Channels/Groups within the apps
• Compliance Region Pills — Shows applicable legal regions (Australia, Brazil, Indonesia, Malaysia, UAE, & UK)
• Curfew — Quiet Hours — Schedule nightly curfew to suppress alerts and lock devices during bedtime (see Section 3.2)
• Device Setup Mode — PIN-gated toggle between Mobile Only and Mobile + Desktop; when Mobile Only is selected, the Desktop Protection section is hidden and all desktop alerts are suppressed (see Section 3.3)
• Desktop Protection — Browser extension pairing, device list, daemon download, heartbeat monitoring, and desktop tamper alerts (hidden when Device Mode is set to Mobile Only)
• Tamper Alert History — Log of all tamper attempts

3.1 Navigation Bar

The top navigation bar contains:

• LexMatrix Guard logo — Click to identify the app
• Your email — Shows which account is signed in
• SET PIN — Change your Security PIN (see Section 11)
• REFRESH — Reload the dashboard to get the latest data
• SIGN OUT — Sign out of the dashboard (requires PIN)

3.2 Curfew — Quiet Hours

The Curfew card lets you schedule a nightly quiet period during which alerts are suppressed and child devices are locked. This ensures you wake up to a clean dashboard without overnight alert spam.

• Toggle switch — Quick enable/disable (saves immediately)
• Start Hour / End Hour — Set the curfew window in 24-hour format (e.g. 22:00–06:00)
• Suppress alert creation — Don't create alert documents during curfew hours
• Suppress push notifications — Don't send FCM push notifications during curfew
• Auto-acknowledge alerts — Mark curfew-period alerts as acknowledged immediately
• Timezone — Auto-detected from your browser; ensures curfew follows your local time
• Status indicator — Shows "Currently in curfew — devices locked" or "Outside curfew hours"

3.2.1 How Curfew Enforcement Works

When curfew is active:

• Cloud Functions — Alert-raising code checks isWithinCurfew() and skips Firestore writes, FCM pushes, or auto-acknowledges based on your settings
• Browser Extension — Fetches curfew settings every 5 minutes, checks every 2 minutes. During curfew, all tabs redirect to a blocked page. When curfew ends, tabs are restored
• Android — Applies screen lock during curfew hours
• iOS — Applies ManagedSettingsStore app shield during curfew hours

3.3 Device Setup Mode

The Device Setup Mode card lets you switch between Mobile Only and Mobile + Desktop modes. This controls whether the Desktop Protection section (browser extension pairing, daemon download, heartbeat monitoring, desktop tamper alerts) is visible in your dashboard.

• Toggle switch — PIN-gated; click the toggle and enter your 6-digit Security PIN to switch modes
• Mobile Only — Hides the Desktop Protection section entirely and suppresses all desktop alerts server-side. Use this if your family only uses phones and tablets.
• Mobile + Desktop — Shows the Desktop Protection section with full desktop monitoring features. Use this if your family uses desktop or laptop computers.
• When switching to Mobile Only, Desktop Protection Pause is automatically enabled

4 Managing Child Profiles

You can manage multiple children from a single parent account. Each child has their own profile, enforcement settings, and mobile app sign-in credentials.

4.1 Switching Between Children

Use the CHILD dropdown selector at the top of the dashboard to switch between child profiles. The dashboard updates to show the selected child's settings and device status.

4.2 Adding a New Child

1. Click the "+ Add Child" button next to the child selector.
2. Enter the child's name (e.g. "Emma").
3. Set a password for the child's mobile app sign-in (at least 6 characters).
4. Enter your 6-digit Security PIN when prompted (PIN-gated for security).
5. Click "CREATE".

After creating the profile, a green notice box appears showing the child's generated email address and reminding you of the password you set. These are the credentials your child will use to sign in on their mobile device.

4.3 Deleting a Child Profile

1. Select the child you want to delete from the dropdown.
2. Click the "Delete" button.
3. Confirm the deletion in the popup dialog.

5 Core Legislation Layer (Global Shield)

The Core Legislation Layer is the master switch for legally-banned platform enforcement. When active (toggle to the right, cyan colour), all banned platforms are locked down on your child's device.

Toggling the Global Shield

1. Click the toggle switch in the Core Legislation Layer card.
2. A Security PIN modal appears — enter your 6-digit PIN.
3. Click "VERIFY & ENFORCE" to confirm.

6 Device Integrity Monitoring

The Device Integrity card shows the real-time status of your child's device. It displays:

• TARGET — The name/ID of the selected child device
• Uplink status — "Secure" when connected, or warning messages if there are issues
• Last heartbeat — The time of the last check-in from the child's device
• Status badge — One of the following:
  • HEARTBEAT_OK — Device is connected and enforcement is active
  • TAMPER_DETECTED — The child has disabled the enforcement service
  • HEARTBEAT_STALE — No signal from the device in 10+ minutes (may be offline)
  • CONNECTING — Waiting for the device to come online

7 Enforcement Kill Switch

The Enforcement Kill Switch is an emergency control that lets you remotely disable all platform blocking on your child's device. This is useful if you need to temporarily grant full access (e.g. for a school requirement).

Toggling the Kill Switch

1. Click the toggle switch in the Enforcement Kill Switch card.
2. Enter your 6-digit Security PIN in the modal.
3. Click "VERIFY & ENFORCE".

8 Hourly Time Allocation Matrix

The Time Allocation Matrix controls how much time your child can spend on TIMED platforms (currently Twitch and YouTube). The time budget is shared across all timed apps.

How it works

• The green-to-pink progress bar shows remaining time out of a maximum of 360 minutes (6 hours).
• The number next to "Remaining Dynamic Allocation" shows the current minutes left.
• As your child uses timed apps, the server tracks usage and the bar depletes. Usage is reported every 5 minutes (or on session end / budget exhaustion) for cost efficiency, with a local countdown on the dashboard estimating the remaining time between syncs.
• When the budget reaches zero, all timed apps are automatically locked.

Adding Time

Click "+15 MIN UPLINK" to add 15 minutes or "+1 HR UPLINK" to add 1 hour to the time budget. Both require your Security PIN — all budget mutations are PIN-gated to prevent unauthorised time grants. The maximum allocation is 360 minutes (6 hours); both buttons are disabled once the cap is reached.

Force Lockdown

Click "FORCE LOCKDOWN" to immediately zero out the time budget and lock all timed apps. This requires your Security PIN.

9 Parent-Controlled Platforms

While legally-banned platforms (Facebook, Instagram, TikTok, etc.) are enforced automatically by the server-side legal list, 62 platforms are exempt from the legal ban and fully parent-controllable. These include messaging apps (WhatsApp, Telegram, Discord, Signal, Session, WeChat, Viber, Threema, Line, IMO, BOTIM, Kik), gaming/social hubs (Roblox, Fortnite, Minecraft, VRChat, Rec Room, IMVU, Habbo Hotel, Steam Community), niche social apps (Rednote, Lemon8, Yope, BeReal, Pinterest, Bluesky, Mastodon, Lemmy, Nostr), anonymous apps (Whisper, NGL, Yik Yak, Sarahah, Sendit, Fizz), AI companion apps (Character.ai, Replika, Chai), video/streaming platforms (Bilibili, Dailymotion, Rumble, Trovo, DLive), and photo/utility apps (Canva, Locket, NoteIt, Geneva, Matrix/Element).

Most of these default to LOCKED to close loophole migration gaps. WhatsApp and Telegram default to ALLOWED for family communication. You can toggle each one between three states at any time. Every change requires your 6-digit Security PIN and is verified server-side.

9.1 Available States

9.2 How to Toggle a Platform

1. Scroll to the "Parent-Controlled Platforms" section in the dashboard (below the Time Allocation Matrix).
2. Find the platform you want to change (e.g. WhatsApp, Telegram, Discord, Roblox, Rednote, or any of the 62 parent-controlled platforms).
3. Click the desired state button: ALLOW, BLOCK, or TIMED.
4. A Security PIN modal appears — enter your 6-digit Security PIN.
5. Click "VERIFY & ENFORCE" to confirm.
6. The change syncs to your child's device in real time via Firestore.

10 Live Platform Interaction Audit

This table shows every monitored platform, its category, legal status, and current enforcement state. It gives you a quick at-a-glance view of what's blocked, timed, or allowed on your child's device.

Compliance Region Pills

Below the platform table, region pills are organized into 5 continent groups indicating which legal frameworks are being enforced:

11 Category-Based Blocking

In addition to blocking 72 individual platforms by name, LexMatrix Guard enforces 6 restricted categories that catch unknown or emerging apps by their type. Even if a niche app isn't in our 72-platform list, category blocking ensures it's still blocked based on what kind of app it is.

11.1 Restricted Categories

11.2 How Category Blocking Works

• All 6 categories are blocked by default when you create a child profile.
• When the enforcement app detects an app that belongs to a restricted category (even if it's not in the 72-platform list), it blocks it automatically.
• You can change a category's state to ALLOWED or TIMED at any time. Every change requires your 6-digit Security PIN.
• Category blocking works alongside individual platform blocking — if either the platform name or the category is blocked, the app is blocked.

11.3 Toggling a Category

1. Scroll to the "Category-Based Blocking" section in the dashboard.
2. Find the category you want to change.
3. Click the desired state button: ALLOW, BLOCK, or TIMED.
4. Enter your 6-digit Security PIN in the modal.
5. Click "VERIFY & ENFORCE" to confirm.

12 DNS-Level Category Filtering

LexMatrix Guard maintains a DNS domain blocklist on iOS devices that mirrors your category and platform blocking settings. When the iOS Network Extension is active, DNS queries for blocked domains are intercepted and resolved to NXDOMAIN, preventing the child from reaching restricted sites via alternative DNS servers, VPN apps that route DNS externally, or DNS-over-HTTPS (DoH) / DNS-over-TLS (DoT) services.

12.1 How DNS Filtering Works

When category or platform blocking is active on iOS and the Network Extension is operational, the enforcement app intercepts DNS queries and blocks resolution of any domain in the DNS blocklist. Blocked queries receive an NXDOMAIN response, causing the device to believe the domain does not exist — rather than simply timing out.

• Category domains — All domains associated with blocked categories (e.g., facebook.com, tiktok.com, twitch.tv for Social Media / Live-Streaming)
• Platform domains — All domains associated with individually blocked platforms
• DoH/DoT circumvention endpoints — 20 known DNS-over-HTTPS and DNS-over-TLS services (e.g., dns.google, cloudflare-dns.com, dns.nextdns.io) are blocked to prevent the child from using alternative DNS resolvers

The DNS blocklist is maintained on all plans, but network-level interception only occurs when the iOS Network Extension is active. When the extension is not active, domain matching is still performed at the app level. DNS filtering is currently supported on iOS devices only.

12.2 The DNS Filtering Status Card

The dashboard displays a "DNS FILTERING" status card in the Mobile Protection section (visible only for iOS devices), next to the Core Legislation Layer and Device Integrity cards. The card shows one of the following states:

• DNS_ACTIVE (green) — DNS filtering is enforced; the Network Extension is active and blocked domains are being filtered at the network level
• CONFIGURED (amber) — The DNS blocklist is configured but the Network Extension is not active; domain matching is performed at the app level only
• DEGRADED (red) — DNS filtering health check failed; the Network Extension may be misconfigured or unavailable. App-level blocking remains active
• MONITORING_ONLY (slate) — The domain blocklist is maintained but no network-level interception is active. App-level blocking and browser URL checking remain enforced
• CONNECTING — Waiting for the first heartbeat from the child's device

The card also shows the resolver type — Network Extension for iOS — based on the child's device platform.

13 Installed App Inventory & New-App Alerts

LexMatrix Guard scans your child's device every 30 minutes and reports all installed apps to your dashboard. This gives you complete visibility of what's on your child's device, not just the platforms you've explicitly configured.

13.1 The App Inventory Section

The "Installed App Inventory" section appears on the dashboard below the Platform Interaction Audit. It lists every non-system app installed on your child's device, sorted alphabetically, showing:

• App name — The display name of the app
• Category — The app's category (if classified)
• Current state — LOCKED, TIMED, or ALLOWED badge
• Quick actions — BLOCK, TIMED, or ALLOW buttons for unclassified apps

13.2 New-App Alerts

When the device scan detects a new app that isn't in the known platform map, LexMatrix Guard immediately sends you a NEW_APP_DETECTED alert. The alert appears as a banner at the top of the dashboard and includes:

• The app name and package name
• The detected category (if known)
• One-tap BLOCK, TIMED, or ALLOW buttons

You must enter your Security PIN to classify the app. Once classified, the enforcement app on the child's device receives the update in real time.

14 Community-Sourced Blocklist & Watch List

The Community-Sourced Blocklist lets parents crowdsource threat discovery. When a parent discovers a suspicious app that isn't in the 72-platform list or a restricted category, they can report it to the community. Once enough parents in the same region report the same app, it's automatically promoted to a watch list and all other parents in that region receive an alert.

14.1 Reporting an App

1. Find the app you want to report in the Installed App Inventory section (see Section 13).
2. Click the "REPORT" button next to the app.
3. A confirmation modal appears showing the app name and asking you to confirm the report.
4. Click "CONFIRM REPORT" to submit.

The report is sent to the reportCommunityApp Cloud Function, which records it in the community_blocklist Firestore collection, scoped to your region.

14.2 How Promotion Works

• When 3 parents in the same region report the same app, it's automatically promoted to the watch list.
• The onCommunityAppPromoted Cloud Function triggers and scans all children's devices in that region for the reported app.
• If any child has the app installed and it hasn't been classified by their parent, a COMMUNITY_WATCH_LIST alert is created.
• The parent receives a push notification (if enabled) and an alert banner appears on the dashboard.

14.3 Community Watch List Alerts

When an app is promoted to the watch list, the alert on your dashboard shows:

• The app name and package name
• The category (if known)
• A message explaining that the community has flagged this app
• One-tap BLOCK, TIMED, or ALLOW buttons (PIN-gated)

15 Behavioral Classification & Alerting

LexMatrix Guard uses accessibility event pattern analysis on Android to detect when an unclassified app is behaving like a social media platform. Even if an app isn't in the 72-platform list or a restricted category, the behavioral classifier can flag it based on its UI patterns.

15.1 What It Detects

The BehavioralClassifier on Android monitors accessibility events (window state changes, content changes, view clicks) and looks for three behavioral patterns:

• Social Feed UI — scrollable content feeds with like/comment/share buttons, story carousels, or infinite scroll patterns
• Messaging Infrastructure — direct messaging UI with chat bubbles, conversation lists, or compose message fields
• Profile System — user profile screens with avatars, follower counts, bio sections, or edit profile functionality

15.2 Behavioral Alert Banner

When a behavioral pattern is detected, a BEHAVIORAL_FLAG alert appears on the dashboard with:

• The app name and package name
• The detected pattern type (social feed, messaging UI, or profile system)
• A confidence score
• BLOCK APP and DISMISS buttons (PIN-gated)

Alerts use a 30-minute cooldown to prevent spam. If you tap BLOCK App, the app is added to the behavioralFlags list and will be blocked on the child's device in real time.

16 Trending Social App Detection

LexMatrix Guard polls the Apple App Store RSS feed daily for trending Social Networking apps in the Australia region. When a new trending app is detected that isn't already in the platform map, the system:

1. Stores the app in the trending_social_apps Firestore collection
2. Checks all children's app inventories in the region for the trending app
3. Sends a TRENDING_SOCIAL_APP alert to parents whose children have the app installed
4. Delivers an FCM push notification to the parent's device

16.1 Trending App Alert Banner

The alert banner on the dashboard shows:

• The trending app name and category
• A message explaining that this app is trending on the App Store
• BLOCK APP and DISMISS buttons (PIN-gated)

17 Gaming Lobby Chat Detection

Many gaming platforms (Roblox, Fortnite, Minecraft, Rec Room, VRChat) have in-game chat systems that children use for unmoderated communication. LexMatrix Guard's GamingChatDetector on Android analyzes the accessibility node tree to detect chat UI patterns within these gaming apps.

17.1 What It Detects

The detector looks for gaming-specific chat UI elements:

• Chat input fields and send buttons
• Chat message lists with player names
• Voice chat join/leave indicators
• Party/squad invitation UI

17.2 Gaming Chat Alert

When chat UI is detected in a gaming app, a GAMING_CHAT_DETECTED alert is created with a 5-minute cooldown. The alert banner shows:

• The gaming app name
• A message indicating that in-game chat was detected
• BLOCK APP and DISMISS buttons (PIN-gated)

If the gaming app is already in the blocked set, the enforcement service shows a lock screen overlay when chat is detected.

18 Messenger Feature-Level Blocking

WhatsApp and Telegram are exempt from legal bans so children can communicate with family. However, their Communities, Channels, and Public Groups features are used by children to join unmoderated mass-communication spaces. LexMatrix Guard can block access to these specific features within the apps, without blocking the apps entirely.

18.1 Blockable Messenger Features

18.2 How It Works (Android)

The MessengerFeatureBlocker analyzes the accessibility node tree for known UI patterns (tab labels, screen titles, button texts) associated with restricted features. When a restricted feature is detected:

1. The enforcement service presses the Back button to navigate the child away from the restricted feature
2. A MESSENGER_FEATURE_BLOCKED alert is created with a 10-minute cooldown
3. An FCM push notification is sent to the parent

18.3 How It Works (iOS)

On iOS, the Screen Time API does not support feature-level blocking within apps. When any messenger feature block is active, LexMatrix Guard blocks the entire app (WhatsApp or Telegram) as a fallback.

18.4 Messenger Feature Alert Banner

The alert banner on the dashboard shows (in blue):

• The messenger app name and detected feature
• A message indicating the child attempted to access a blocked feature
• BLOCK APP and DISMISS buttons (PIN-gated)

19 Tamper Alerts & Alert History

19.1 Active Tamper Alert Banner

When your child disables the enforcement service on their device, a red, pulsing TAMPER ALERT banner appears at the top of the dashboard. It shows:

• The alert message(s) — up to 3 recent alerts are shown
• The total number of unacknowledged alerts
• An "Acknowledge All" button to dismiss the alerts once you've reviewed them

19.2 Stale Heartbeat Warning

If the child's device hasn't sent a heartbeat in over 10 minutes (but no tamper alert has been triggered), an amber warning appears: "No heartbeat from child device in over 10 minutes."

19.3 Tamper Alert History

At the bottom of the dashboard, the TAMPER ALERT HISTORY section shows a complete log of all alerts. The list shows the 5 most recent alerts by default. If there are more than 5, you can scroll vertically within the list to see older entries.

Each alert entry shows:

• A coloured dot — red (pulsing) for unacknowledged, grey for acknowledged
• The alert message
• The date and time the alert was triggered
• An "ACK" button to acknowledge individual alerts (if not yet acknowledged)

20 SIM Detection & Device-Switch Alerts

LexMatrix Guard monitors your child's SIM card state in real time. If the SIM card is removed, swapped for a different one, or the child switches to an entirely different device, an instant alert is sent to your parent dashboard. This prevents children from bypassing enforcement by moving their account to a new, unmonitored device.

20.1 How SIM Monitoring Works

The mobile enforcement app records a cryptographic hash of the child's SIM card at sign-in time and stores it as the authorized SIM hash on the server. On every heartbeat (every 30 seconds), the app checks the current SIM state and compares it to the authorized hash:

• SIM_REMOVED — The SIM card has been physically removed from the device.
• SIM_CHANGED — A different SIM card has been inserted (the hash no longer matches).
• DEVICE_SWITCH_DETECTED — The child's account has been signed in on a different device.

When any of these events is detected, a tamper alert is written to the child's alert history and a push notification is sent to the parent's devices immediately.

20.2 Accepting or Rejecting a SIM Change

When a SIM_CHANGED alert appears on the dashboard, two PIN-gated buttons are shown:

• ACCEPT NEW SIM — Updates the authorized SIM hash on the server to the new SIM card. This is used when you, the parent, have knowingly changed your child's SIM card or phone.
• REJECT — Marks the alert as escalated. Enforcement remains locked and the alert stays active until you intervene. Use this if the SIM change was unauthorized.

Both actions require your 6-digit Security PIN, which is verified server-side by the authorizeSimChange Cloud Function.

20.3 SIM Alerts in Alert History

SIM-related alerts appear in the Tamper Alert History feed at the bottom of the dashboard, alongside other tamper alerts. Each SIM alert shows:

• The alert type (SIM_REMOVED, SIM_CHANGED, or DEVICE_SWITCH_DETECTED)
• The date and time the alert was triggered
• The resolution status — SIM Accepted or SIM Rejected (Escalated) once you've taken action

21 Desktop Enforcer Daemon

The Desktop Enforcer Daemon is a lightweight background program that runs on your child's Windows, macOS, or Linux computer and terminates forbidden applications at the operating system level — even if they are launched outside the browser. This works alongside the browser extension to provide complete desktop coverage.

21.1 What It Does

• Process-level enforcement: Scans running processes every 1.5 seconds and immediately terminates forbidden executables (Discord, Telegram, WhatsApp, Roblox, Steam, Epic Games, Opera GX, Brave, Tor, etc.)
• Real-time block alerts: When a forbidden app is terminated, an instant alert is sent to your parent dashboard with the platform name and binary that was blocked
• Heartbeat monitoring: The daemon sends a heartbeat every 60 seconds so the dashboard shows it as online. If the daemon is killed or deleted, a DESKTOP_HEARTBEAT_STALE tamper alert is raised within 3 minutes
• Push notifications: Block events trigger FCM push notifications to your phone and browser

21.2 How to Install

The daemon is designed for non-technical parents — no manual configuration required. To ensure the binary is paired with your household's cryptographic keys, it is downloaded exclusively as a pre-configured LexMatrix-Daemon.zip bundle from the PIN-gated Parent Dashboard.

1. Open the Parent Dashboard (/dashboard) in a browser on your child's computer (ensure Device Setup Mode is set to Mobile + Desktop).
2. Scroll to the Desktop Protection section and locate the Desktop Enforcer Daemon card.
3. Click "DOWNLOAD DAEMON" and enter your 6-digit Security PIN.
4. The dashboard automatically detects the computer's operating system and architecture and downloads LexMatrix-Daemon.zip — containing both the native daemon executable (e.g., lexmatrix_guard_windows-amd64.exe) and your account's signed daemon_config.json configuration file.
5. Extract both files from LexMatrix-Daemon.zip into a dedicated folder on the child's computer (for example, a LexMatrix Daemon folder on the Desktop) so the binary and daemon_config.json stay together in the same folder.
6. Run the daemon binary (double-click the .exe on Windows; if Chrome shows an "Uncommonly downloaded file" prompt or Windows SmartScreen appears, choose Keep anyway / More info → Run anyway). On macOS or Linux, run chmod +x on the extracted binary and launch it once from Terminal.

21.3 Desktop Enforcer Alert Banner

When the daemon terminates a forbidden executable, a green DESKTOP ENFORCER banner appears on the parent dashboard. It shows:

• The number of blocked executable attempts
• The platform name (e.g., DISCORD, TELEGRAM, ROBLOX) for each blocked attempt
• The alert message with details of what was blocked
• An "Acknowledge All" button to dismiss the alerts

21.4 Anti-Tamper Protection (Windows)

On Windows, the daemon installs three independent layers of persistence to prevent your child from disabling it:

21.5 macOS & Linux Persistence

On macOS, the daemon installs a LaunchAgent plist at ~/Library/LaunchAgents/com.lexmatrix.guard.plist with KeepAlive set to true. This ensures the daemon auto-starts when the child logs in and is automatically restarted if killed.

On Linux, a systemd user service is installed at ~/.config/systemd/user/lexmatrix-guard.service with Restart=always, providing the same auto-start and restart-on-crash behaviour.

21.6 Improved Process Matching

The daemon doesn't just match by binary name — it also checks alias names for each target platform. This catches renamed binaries, portable variants, and beta/canary builds. For example:

• Discord: Also matches DiscordPTB.exe, DiscordCanary.exe
• Telegram: Also matches tdesktop.exe, TelegramDesktop.exe
• Tor: Also matches tor-browser.exe, torbrowser.exe

On Windows, the daemon also detects WSL (Windows Subsystem for Linux) processes. If wsl.exe is running, the daemon checks Linux processes inside the WSL container for blocked platform binaries.

21.7 Daemon Heartbeat on the Dashboard

The daemon's heartbeat appears in the Desktop Protection section of the dashboard, alongside the browser extension's heartbeat. The device card shows:

• HEARTBEAT_OK — Daemon is running and sending heartbeats every 60 seconds
• HEARTBEAT_STALE — No heartbeat for 3+ minutes (daemon may have been killed or deleted)

21.8 Alert History

Daemon block events also appear in the Tamper Alert History feed at the bottom of the dashboard, tagged with a green DESKTOP DAEMON badge so you can distinguish them from browser extension and mobile app alerts.

22 Security PIN Management

Your 6-digit Security PIN protects all sensitive actions on the dashboard and is required to sign out of the enforcement app on your child's device. You can change your PIN at any time.

Changing Your PIN

1. Click the "SET PIN" button in the navigation bar.
2. Enter your new 6-digit PIN in the "NEW PIN" field.
3. Re-enter the same PIN in the "CONFIRM PIN" field.
4. Click "SAVE PIN".
5. A green "Security PIN set successfully" message confirms the change.

90-Day PIN Reset Recommendation

To protect against gradual PIN discovery (such as tech-savvy children observing finger movements or guessing combinations over time), LexMatrix Guard actively evaluates PIN age. When your PIN reaches 90 days of age, an amber security reminder banner appears automatically on your dashboard recommending a reset. You can click "RESET PIN NOW" to update your PIN immediately, or click "Remind Me in 7 Days" to snooze the reminder.

Child Device Lockout & Real-Time Push Alerts

When an unlock attempt occurs on a child's mobile or desktop device, attempts are tracked in an isolated rate limiter to prevent denial-of-service against the parent's account. If 5 incorrect attempts occur on the child's device:

• The child unlock flow is locked down for 15 minutes.
• An immediate high-priority FCM push notification (⚠️ Security Alert) is sent to all registered parent devices.
• An in-app alert banner appears on the parent dashboard with a 1-click "CHANGE SECURITY PIN" shortcut.
• The parent master login PIN remains completely unaffected.

23 Signing Out of the PWA

Signing out of the parent dashboard requires your Security PIN for security.

1. Click "SIGN OUT" in the navigation bar.
2. Enter your 6-digit Security PIN in the modal.
3. Click "VERIFY & ENFORCE" to sign out.

If you enter the wrong PIN, an "Incorrect security PIN" error appears and you can try again.

24 Installing the Android Enforcement App

The Android enforcement app runs on your child's Android phone (Android 8.0 / API 26 or later). It uses an Accessibility Service to detect and block app launches, and Device Admin to prevent uninstallation.

24.1 Installation Steps

1. Install the LexMatrix Guard app on your child's Android phone from the Google Play Store using the button above.
2. Open the app. The setup wizard will appear.
3. Tap "Enable Accessibility Service" — you'll be taken to Android Settings → Accessibility.
4. Find "LexMatrix Guard" in the list and enable it.
5. Return to the app and tap "Enable Device Admin" — confirm the Device Admin prompt.
6. Tap "Continue".

24.2 Battery Optimisation

Some Android manufacturers (Xiaomi, Oppo, Vivo, Samsung) aggressively kill background services to save battery. To ensure reliable enforcement:

• Go to Settings → Battery → LexMatrix Guard → Don't optimise
• Add the app to your manufacturer's auto-start whitelist if applicable

25 Installing & Setting Up the iOS Enforcement App

The iOS enforcement app runs natively on your child's iPhone or iPad (iOS 16.0 or later). It leverages Apple's official Screen Time & Family Controls APIs (including ManagedSettings and DeviceActivity) to enforce app shielding, hourly matrix time-outs, and web domain filtering directly at the operating system and WebKit engine levels.

25.1 Prerequisites & Apple ID Configuration

Before installing the app on your child's iPhone or iPad, ensure the following device prerequisites are met:

• iOS Version: The device must be running iOS 16.0 or higher (compatible with iOS 16, 17, and 18+).
• Child Apple ID: For optimal supervision, the device should be signed into your child's Apple ID as a member of your Apple Family Sharing group.
• Device Passcode: The device should have a lock screen passcode configured with Face ID or Touch ID enabled.

25.2 Installation & Pairing

1. Install the LexMatrix Guard app on your child's iPhone from the Apple App Store using the link above (or via TestFlight during pilot/beta deployments).
2. Launch the app. You will be greeted by the child sign-in screen.
3. Enter the Child Account Email and Child Password generated from the Parent Dashboard (see Section 4.2).
4. Tap "Sign In & Enforce". The app securely pairs the device to your parent account and registers Apple Push Notification service (APNs) credentials for real-time background synchronization.

25.3 Authorizing Apple Screen Time & Family Controls

iOS requires parental authorization to allow LexMatrix Guard to manage application shields and web content filters.

1. Immediately after sign-in, tap the "Authorize Screen Time Protection" button.
2. An official Apple system dialog will appear: "LexMatrix Guard would like to access Screen Time".
3. Authenticate using the Parent Apple ID password, Face ID, or the device passcode, and tap "Continue" / "Allow".

25.4 One-Time Priority App Linking (FamilyActivityPicker)

Apple's Screen Time architecture requires an authentic, opaque ApplicationToken to halt a running foreground app (like YouTube or Twitch) the exact second its hourly time matrix expires. Because iOS forbids fabricating tokens from bundle IDs, LexMatrix Guard uses Apple's official FamilyActivityPicker to link priority platforms in a clean, one-time flow.

1. On the child app dashboard, any unlinked priority slot displays a prominent banner: "Action Required: Link YouTube" (or Twitch, Chrome, etc.).
2. Tap the linking banner. Enter your 6-digit Parent Security PIN to authorize the configuration.
3. Apple's native FamilyActivityPicker modal opens. Search for or select the matching native application from the list.
4. Tap "Done" in the top-right corner.

Once selected, the encrypted application token is stored in the app's secure App Group container and persists across device reboots and app updates. The setup banner automatically dismisses permanently, and the child's dashboard remains completely clean and read-only.

25.5 Essential Apple Screen Time System Hardening (Anti-Bypass Protection)

Tech-savvy children frequently attempt to bypass parental controls by deleting apps, downloading third-party VPN apps (such as FastestVPN, Opera VPN, or Cloudflare 1.1.1.1), or modifying device configuration profiles. To ensure airtight enforcement, configure these built-in Apple Screen Time settings on the child's iPhone:

1. Lock Screen Time Settings:
   On the child's iPhone, open Settings → Screen Time. Scroll down and tap "Lock Screen Time Settings". Enter a dedicated 4-digit Screen Time passcode that your child does not know.
2. Prevent App Deletion:
   Go to Screen Time → Content & Privacy Restrictions → iTunes & App Store Purchases → Deleting Apps. Set this to "Don't Allow". This prevents your child from deleting the LexMatrix Guard app from the home screen.
3. Prevent Unauthorized App & VPN Downloads:
   In iTunes & App Store Purchases → Installing Apps, set this to "Don't Allow" (or require parental approval via Apple's "Ask to Buy"). This blocks your child from downloading proxy tools, VPN apps, or alternative browsers from the App Store.
4. Lock Down VPN & Profile Configuration:
   Under Content & Privacy Restrictions, scroll down to the "Allow Changes" section. Set "Account Changes", "Passcode Changes", and "Cellular Data Changes" to "Don't Allow". This locks the iOS Settings menu so your child cannot manually install VPN profiles or disconnect cellular data.

25.6 Background Operation & Push Synchronization

Once installed and hardened, the iOS enforcement engine runs seamlessly in the background without requiring the app to remain open:

• Silent APNs Push Updates: Any policy mutation performed on the Parent PWA (granting bonus time, updating curfew, or initiating Emergency Lockdown) dispatches an instant background APNs push notification that re-arms device shields in under 2 seconds.
• System Monitor Extension: An isolated system extension (DeviceActivityMonitor) runs continuously inside iOS system daemons, ensuring hourly budget expirations trigger on schedule even when the phone is locked or low on battery.
• SIM Removal Tracking: The telephony subsystem continuously verifies physical cellular connectivity. If a child pulls the physical SIM card to evade location or network policies, an immediate SIM_REMOVED alert is recorded and pushed to your dashboard.

25.7 Active OS Protection: Home Screen App Shields, Safari Web Filtering & Timed Usage

Once paired and synchronized with your parental policy, LexMatrix Guard continuously enforces application shielding and web domain restrictions directly at the core iOS operating system layer:

• Home Screen App Shielding: All restricted native applications (such as TikTok, Snapchat, YouTube, and Instagram) are immediately shielded by Apple's ManagedSettings framework. App icons appear darkened with an official Screen Time hourglass badge, preventing launch.
• Safari & WebKit Domain Filtering: Whenever your child attempts to bypass app restrictions by browsing platform websites in Safari (e.g. tiktok.com or instagram.com), the WebKit filter stops the request instantly at the browser layer and displays Apple's native "Website Not Allowed" or "Restricted" screen. Even if a third-party VPN is running, WebKit blocks the traffic before it enters the network stack.
• Priority Timed App Shielding & "Check for Time": For hourly Time Wallet platforms (such as YouTube), foreground playback is halted the exact second the allocated budget expires. The child is presented with the custom LexMatrix Guard shield displaying a dynamic "Check for Time" button. If you grant bonus time from the Parent Dashboard, tapping this button instantly polls the server, acknowledges the new time grant, and unshields the app on the spot.

25.8 Branded App Shield Screens for Always-Blocked Platforms

When a child attempts to open any platform designated as ALWAYS BLOCKED (such as TikTok, Snapchat, Instagram, or Facebook), LexMatrix Guard's custom ManagedSettingsUI shield extension activates instantly:

• Branded, Distraction-Free Lock Screens: Rather than a generic system crash or freeze, the screen displays a customized, dark-themed LexMatrix Guard lock screen showing the platform's official icon, a prominent security padlock, and clear messaging: "LexMatrix Guard blocked [Platform] because it is covered by your protection policy."
• Single-Tap "OK" Home Return: A clean, high-contrast "OK" button lets the child acknowledge the shield and immediately returns them to the iOS home screen without app switching loops or permission conflicts.

26 Signing In on the Child's Mobile Device

After installing the enforcement app on your child's device, you need to sign in using the child's credentials that were generated when you created their profile (see Section 4.2).

Steps

1. Open the LexMatrix Guard app on the child's device.
2. Enter the child's email (the long generated email from the "Child Profile Created" notice).
3. Enter the password you set when creating the child profile.
4. Sign in.

27 How Mobile Enforcement Works

Once signed in, the enforcement app runs silently in the background. Here's what happens:

27.1 App Blocking

• Android: When your child tries to open a blocked app, the Accessibility Service detects the launch and immediately shows a full-screen lock screen overlay. The child cannot bypass it — the back button is disabled.
• iOS: Apple's ManagedSettings framework blocks the app at the OS level. The app icon appears greyed out with a shield/hourglass, and iOS shows a restriction screen if tapped.

27.2 Timed App Usage

For TIMED apps (Twitch, YouTube), the child can use them freely until the time budget runs out. The mobile app reports usage to the server every 30 seconds. When the budget is exhausted, the app is automatically locked.

Additionally, the Parent-Controlled Platforms (Discord, Telegram, and WhatsApp) can be set by the parent to a TIMED state on the dashboard. When set to TIMED, they are subject to this same hourly Time Wallet budget and will be automatically locked as soon as the wallet exhausts.

27.3 Tamper Detection (Android)

• If your child disables the Accessibility Service in Settings, a full-screen lock appears immediately, preventing further device use.
• The parent dashboard shows a TAMPER_DETECTED status and a tamper alert is logged.
• Split-screen and multi-window attempts with blocked apps are also detected and blocked.

27.4 Tamper Detection (iOS)

• Screen Time Authorization Integrity: Apple's Family Controls cannot be disabled by the child without the parent's Apple ID password or Screen Time passcode. If an unauthorized attempt is made to revoke Screen Time authorization, the app records an immediate ACCESSIBILITY_DISABLED tamper alert on the Parent Dashboard.
• Baseband SIM Removal Alerts: The iOS app and background monitor extension continuously monitor the iPhone's cellular radio state. Pulling the physical SIM card immediately triggers a high-priority SIM_REMOVED tamper notification to the parent.
• Graceful Lifecycle vs. Real Tamper: When the iPhone is locked or quiet for extended periods, the dashboard shows a neutral grey APP_CLOSED status rather than a false alarm. System shields, hourly matrix time-outs, and curfew restrictions remain strictly enforced by Apple's background daemons.

28 Signing Out from the Mobile App

Signing out from the enforcement app on the child's device requires the parent's Security PIN. This prevents children from disabling enforcement by signing themselves out.

Steps

1. Open the LexMatrix Guard app on the child's device.
2. Tap "Sign Out" on the enforcement screen.
3. Enter the parent's 6-digit Security PIN.
4. Confirm sign-out.

28.1 After Sign-Out (Android)

A "Protection Disabled" screen appears with instructions to disable Accessibility in Settings. The parent can re-enable protection at any time by tapping "Re-enable Protection".

28.2 After Sign-Out (iOS)

Upon successful Security PIN validation on iOS, the app immediately releases all active ManagedSettings shields, unregisters background DeviceActivity monitoring schedules, and securely purges session credentials from the shared Keychain and App Group storage. The iPhone returns to an unshielded state for device servicing or handoff.

29 Troubleshooting & FAQ

Q: The dashboard shows "CONNECTING" and never changes to "HEARTBEAT_OK"

The child's device hasn't sent a heartbeat yet. Check that:

• The enforcement app is installed and signed in on the child's device
• The child's device has internet connectivity
• The correct child profile is selected in the dashboard dropdown

Q: I see "HEARTBEAT_STALE" — what should I do?

The child's device hasn't reported in over 10 minutes. The device may be:

• Offline or out of battery
• In an area with no internet
• Force-killed by the OS (Android — check battery optimisation settings)

Q: My child disabled the Accessibility Service (Android)

The app's AccessibilityGuardService should detect this and lock the device. You'll see a TAMPER_DETECTED alert on the dashboard. On the child's device, a full-screen lock prevents use until the Accessibility Service is re-enabled. Go to Settings → Accessibility → LexMatrix Guard → ON to restore enforcement.

Q: The lock screen isn't appearing on Android

• Ensure "Draw over other apps" (SYSTEM_ALERT_WINDOW) permission is granted
• Check that the Accessibility Service is actively running
• Disable battery optimisation for the app
• On Xiaomi/Oppo/Vivo devices, add the app to the auto-start whitelist

Q: I forgot my Security PIN

Contact LexMatrix Guard support. For security reasons, PIN reset is not available through the app interface.

Q: Can my child reset the time budget by clearing app data?

No. Time usage is tracked server-side. The mobile app reports usage every 30 seconds, and clearing app data does not affect the server's record of accumulated usage.

Q: Can my child uninstall the enforcement app?

• Android: No — Device Admin prevents uninstallation without the admin password.
• iOS: The app can be deleted, but Family Controls restrictions remain in effect if configured through Screen Time. Reinstalling the app restores full enforcement.

Q: What happens if I lose internet on my phone (parent)?

The dashboard will not update in real time, but enforcement continues on the child's device — it operates independently based on the last received policy. When your internet returns, refresh the dashboard to see the latest status.

Q: What happens if my child's device loses internet?

The enforcement app continues to enforce the last received policy offline. The dashboard will show HEARTBEAT_STALE after 10 minutes. When the device reconnects, it resumes sending heartbeats and the dashboard updates automatically.

Q: Can I use the same parent account on multiple devices?

Yes. Sign in to the PWA on any browser/device with your parent email and password. The dashboard syncs in real time.

Q: The "+15 MIN UPLINK" or "+1 HR UPLINK" button isn't working

Check for a red error banner below the child selector — it will show any policy save errors. Ensure you have a stable internet connection and try the REFRESH button. If the buttons are greyed out, the time budget has already reached the 360-minute (6 hour) maximum.

Q: The desktop daemon isn't showing up on the dashboard

If the daemon is running but the dashboard doesn't show a heartbeat:

• Ensure both files from LexMatrix-Daemon.zip (the daemon binary and daemon_config.json) were extracted into the exact same folder
• Check that the child's computer has internet connectivity
• Verify LexMatrix-Daemon.zip was downloaded from your Parent Dashboard under Desktop Protection → DOWNLOAD DAEMON (not run as an unconfigured standalone binary)
• If you added a new child or focus profile after installing the daemon, click "SYNC NEW PROFILES" in the dashboard and place daemon_update.json into the daemon folder

Q: My child killed the daemon via Task Manager — what happens?

On Windows, the LexMatrixGuardWatchdog Scheduled Task automatically re-launches the daemon within 3 minutes, and the Registry Run key restarts it on login. If all persistence layers are disrupted, you'll receive a DESKTOP_HEARTBEAT_STALE tamper alert within 3 minutes.

Q: Can my child delete the daemon?

While running, Windows locks the executable and hardens its ACLs with icacls. If the child stops the process and deletes the folder, heartbeats stop — triggering a DESKTOP_HEARTBEAT_STALE alert on your dashboard within 3 minutes so you know immediately that the daemon was tampered with. Re-download LexMatrix-Daemon.zip from the Desktop Protection section of your Parent Dashboard (/dashboard).

Q: I see a "SIDELOADED_APP_DETECTED" alert — what does this mean?

Your child has installed an app from a source other than the official Play Store (Android) or App Store (iOS). This is called "sideloading" and can be a security risk. The alert shows which app was sideloaded and its installer source. You can block the app directly from the alert banner on the dashboard.

Q: I see a "STALE_TIMED_USAGE" alert — what does this mean?

Your child's device is online and sending heartbeats, but the timed usage reporter has stopped reporting for more than 10 minutes while the child still has remaining timed budget. This may indicate the child has found a way to interfere with the usage tracking service. Check the child's device to ensure the enforcement app is running properly and hasn't been tampered with.

Q: How will the iOS App be installed once available?

Once compiled on a macOS environment using Xcode, the iOS Enforcement App can be deployed via TestFlight or Apple Developer provisioning profiles. During setup, the child's device will prompt to enable the Family Controls API. This configuration requires the parent's Apple ID password to confirm and prevent the child from deleting or disabling the app.

Q: How does the UAE region regulation work?

UAE Cabinet Resolution No. 106 imposes age restrictions on social media platforms for children under 15 years old. When you select the UAE region during parent sign-up or profile creation, the legal compliance shield automatically configures the platform access defaults to align with this under-15 legal ban.

Q: Can I manage children in different regulatory regions on one account?

Yes. Each child profile has its own settings. The platform automatically tracks and enforces the correct local compliance rules (Australia, Brazil, UAE, or UK) based on the region selected when you create or edit the child's profile on the dashboard.

30 Recent Integrations, Security Updates & PWA Dashboard Upgrades

This section summarises the integrations and security hardening released in recent updates. It covers the new Indonesia and Malaysia compliance regions, PWA dashboard upgrades, and client-hardening features that parents should know about.

30.1 Indonesia & Malaysia Regional Compliance

LexMatrix Guard now supports two additional compliance regions, bringing the total to six:

• INDONESIA_GR17_2026 — Indonesian Ministry of Communication and Digital (Kemenkomigi) Government Regulation No. 17 of 2025. In this region Bigo Live and Roblox are added to the legal ban list and cannot be overridden by a parent.
• MALAYSIA_ONSA_2025 — Malaysian Communications and Multimedia Commission (MCMC) Online Safety Act 2025. Adds eKYC privacy identity bypass protection and ONSA local block compliance.

During parent sign-up and when creating or editing a child profile, select the correct compliance region so the correct legal floor and regional defaults are loaded. Region-specific bans (for example YouTube and Twitch locked in the UAE, Brazil, Indonesia and Malaysia) are enforced automatically.

30.2 PWA Dashboard Upgrades

The parent dashboard has received a number of new controls and status indicators:

• Desktop Protection Pause — A toggle that mutes desktop heartbeats, tamper alerts and block notifications when your child is away from the computer (for example at school or on holiday). The badge reads Desktop Alerts Muted while paused.
• Alerts Notifications Toggle — Silences popup notifications on parent desktop and mobile devices while still recording every alert in the dashboard. The badge reads Mobile Alerts Muted while off.
• Telemetry & Privacy Consent — A card that lets you control whether non-security telemetry is collected from your child's devices. Security-critical endpoints (enforcement status, SIM-swap detection, etc.) remain active regardless of the setting.
• Brazil Digital Statute Controls — Two toggles that remove addictive interface elements at the system layer for users under 16: Remove Infinite Scroll (hard scroll limits on TikTok, Instagram, YouTube) and Remove Variable-Reward Feeds (blocks auto-playing algorithms and variable reward mechanics).
• Root & Jailbreak Detection — The Device Integrity card keeps status simple for parents by showing plain connection badges (HEARTBEAT_OK, APP_CLOSED, HEARTBEAT_STALE, TAMPER_DETECTED) and only displaying ROOTED or JAILBROKEN warning badges if device compromise is detected.
• Pending Device Confirmation — New desktop devices must be parent-confirmed before they are trusted. Unconfirmed devices show a Pending parent confirmation warning.
• Web Browser Blocking — Banned platforms are blocked in all major web browsers automatically; no separate configuration is required.
• Alert History — The bottom of the dashboard shows a scrollable history of all alerts, tagged by source (Community, Behavioral, Trending, Gaming Chat, Messenger, Desktop Daemon, Desktop Extension, Mobile App) and acknowledgement state.

30.3 Security Audit Frontend Hardening

Following the LexMatrix Guard security audit, several parent-facing and client-facing protections were added or strengthened:

• Atomic PIN lockout — PIN attempt counting, lockout, successful reset and hash upgrade are now performed inside a Firestore transaction, so concurrent wrong attempts cannot race on the counter. A durable Firestore-based per-IP sliding-window rate limiter replaces the old in-memory limiter.
• Recent reauthentication — High-risk actions such as deleting a child profile, deleting the parent account, deleting/revoking a device and rotating a device key require recent Firebase Authentication (within a 5-minute window).
• Parent-controlled notification privacy — You can set notificationPrivacy to full, minimal or none on your user document to control how much alert detail appears on lock-screen notifications.
• Sensitive alert detail protection — Viewing sensitive alert details (message, appName, installerSource, deviceName) now requires recent reauthentication via the getSensitiveAlertDetail callable.
• DOMPurify translation sanitization — Translated HTML in the PWA is sanitized with a strict allowlist (only strong and a tags) and 18 XSS tests reject scripts, event handlers and unsafe URLs.
• CSP hardening — unsafe-inline has been removed from style-src across all static website routes and the dashboard route. All inline style attributes were replaced with CSS classes.
• Anomaly detection — Security anomalies are logged for PIN brute-force lockout, nonce replay, webhook replay, daemon auth brute-force, telemetry quota abuse, cleanup job failures and dead-lettered deletions.
• PIN-gated budget mutations — All time-budget changes (granting time, force lockdown, resetting usage) require the 6-digit Security PIN via the grantTimedBudget and resetTimedUsage Cloud Functions. Direct Firestore writes to timeRemaining are blocked by security rules.
• Per-device usage accounting — Each child device writes timed usage to its own sub-document under timed_usage/current/devices/. The server sums across all devices, preventing multiple devices from double-draining a single time budget.
• Audit log integrity — Policy audit entries now use Firestore auto-generated document IDs instead of deterministic keys, preventing collisions when two PIN-gated actions occur simultaneously.

30.4 Browser Extension & Desktop Daemon Updates

• Ed25519 non-extractable keys — The browser extension now generates Ed25519 keys using the Web Crypto API and stores the private key as a non-extractable CryptoKey in IndexedDB. Raw secrets are no longer used for steady-state requests and legacy HMAC fallback has been removed. The migration includes retry logic with exponential backoff and fail-closed behaviour — if migration fails, local storage is cleared so the raw device secret does not persist.
• AES-256-GCM cache encryption — Cached active_blocks and curfew settings in the browser extension are now encrypted at rest using AES-256-GCM. The encryption key is generated and stored in IndexedDB (lexmatrix_keys / cache_key object store), so even if local storage is accessed, cached policy data is not readable in plaintext.
• Manifest host hardening — The extension's host_permissions now uses a wildcard (https://*.cloudfunctions.net/*) to avoid exposing the Firebase project ID and region in the published extension manifest.
• Device pairing — The dashboard can generate a time-limited pairing code for the Chrome/Edge extension. The extension registers itself with the backend and downloads a daemon_config.json for the desktop daemon.
• Versioned daemon URLs — Daemon downloads use immutable, versioned paths such as /daemon/v1.0.0/. Firebase Hosting caches these with immutable headers. The daemon checks /daemon/manifest.json for updates, enforces anti-downgrade and honours emergency revocation.
• OS-native hardening — Windows binaries are protected with icacls ACLs, macOS LaunchAgent plists and Linux systemd service files are set read-only (0444), and the scheduled-task watchdog interval was reduced to 3 minutes for faster recovery.
• Incognito / private-browsing blocking — The browser extension detects attempts to open Incognito or Private Browsing mode and blocks them, raising a DESKTOP_INCOGNITO_ATTEMPT alert.
• Extension/device revocation — Parents can revoke a desktop device or browser extension from the dashboard. Revoked devices cannot fetch policy or send heartbeats.

30.5 Mobile App Updates

• Play Integrity / App Attest — Android uses Google Play Integrity and iOS uses Apple App Attest to validate app and device integrity, flagging rooted/jailbroken devices on the dashboard.
• DNS filtering modes — iOS now reports an explicit dnsFilteringMode of monitoring-only, configured, enforced or degraded, with colour-coded badges and localised descriptions on the dashboard.
• Telemetry consent gating — Non-security telemetry is gated by the parent-facing Telemetry & Privacy Consent setting. Android and iOS implement rotating 24-hour identifiers to prevent long-term tracking correlation.
• SafeLog — Android release builds replace direct android.util.Log calls with a debug-gated SafeLog wrapper, so sensitive data does not appear in logcat.
• Actual service state checks — Android SimStateReceiver and BootReceiver now validate intent actions and verify the real running state of AccessibilityGuardService rather than assuming it from a broadcast.
• Monotonic clock enforcement — Android uses SystemClock.elapsedRealtime() and iOS uses ProcessInfo.systemUptime for budget calculations instead of wall-clock time. This prevents children from extending timed access by changing the device clock. iOS also detects backward clock jumps greater than 60 seconds and triggers a re-sync.
• Server-seeded local usage — On every policy sync, the mobile app's local accumulated usage is seeded from the authoritative server-side total (serverUsedSeconds). This prevents clearing app data or local storage from resetting the timed usage countdown.
• Correct child ID reporting — Android's TimedUsageReporter now receives the actual linkedChild ID at instantiation instead of hardcoding "primary", ensuring usage is reported to the correct child profile.

30.6 BOCHA Identity Airlock

BOCHA ("Bring Our Children Home Again") is the dashboard indicator that LexMatrix Guard is acting as an on-device digital airlock. By blocking banned platform domain handshakes locally before any connection resolves, the system prevents Big Tech's age-verification prompts from requesting your child's passport scans, eID links or biometric facial sweeps. The card shows Identity Protection: Sovereign / Anonymous and Biometric Prompts: Pre-empted (0 Loaded) while the airlock is active.

30.7 Child PIN Brute-Force Alerting & 90-Day PIN Rotation

To counter persistent brute-force and observation attempts by tech-savvy minors:

• Child PIN Lockout Alert & Instant FCM Push — Child unlock challenges (such as emergency unblock requests) are isolated in a child-specific limiter (security/unlock_limits). Five failed attempts lock the child flow for 15 minutes, log a CHILD_PIN_LOCKOUT alert, and immediately dispatch a high-priority FCM push notification to all parent devices. The parent's master dashboard login PIN remains completely isolated and immune to child-induced lockouts.
• 90-Day PIN Rotation Policy — The getPinStatus Cloud Function calculates PIN age without exposing cryptographic secrets. If a PIN is 90 days or older, the dashboard presents an amber security recommendation card with a 1-click RESET PIN NOW shortcut and a 7-day snooze option.
• Adult Digital Detox (Ages 18–60) & Partner Sovereignty Profiles — Supports three profile modes when adding a seat on the dashboard (Child, Adult / Self Detox, and Partner Account). Adult profiles apply kernel-level Layer 7 blocking, Go desktop process termination, Brazil ECA Adult Mode (removing infinite scroll and variable-reward feeds while keeping Slack/WhatsApp/Email active), and a Partner Sovereignty Lock where a spouse or accountability partner holds the server-verified 6-digit PBKDF2 PIN required to modify focus hours or curfews.
• 81-Platform Enforcement & 6-Browser App-Level Timed Freezing — The enforcement matrix covers 81 total platforms (10 statutorily banned + 71 parent/partner-controlled, including 6 major web browsers: Google Chrome, Mozilla Firefox, Microsoft Edge, Brave, Opera, and DuckDuckGo). Treating web browsers as TIMED applications at the OS layer ensures that when the daily time wallet reaches 00:00 or curfew begins, the entire browser app (including active incognito video streams) freezes immediately.

31 Glossary