LexMatrix Guard

1 Introduction & Overview

LexMatrix Guard is a parental control system that protects children from harmful social media platforms and manages their screen time. It consists of two parts:

• Parent Dashboard (PWA) — A web app you open in a browser (phone, tablet, or computer) to control and monitor your child's device remotely.
• Mobile Enforcement App — An app installed on your child's Android or iOS device that silently enforces the rules you set from the dashboard.

What platforms are blocked?

The system enforces 72 platforms — 10 legally-banned platforms for children under 16 (in compliance with Australian, Brazilian, Danish, French, Greek, Indonesian, Malaysian, Spanish, UAE, and UK online safety legislation) plus 62 parent-controlled loophole platforms that children migrate to when banned apps are locked. The following platforms are monitored:

Legally-Banned Platforms (10)

Parent-Controlled Platforms (62)

These platforms are not legally banned but are commonly used as loophole alternatives. They default to LOCKED and parents can change them to TIMED or ALLOWED at any time.

2 Getting Started — Parent Account Setup

2.1 Accessing the Parent Dashboard

The parent dashboard is a Progressive Web App (PWA). You don't need to install anything from an app store — simply open your browser and go to:

https://lexmatrixguard.com/dashboard

2.2 Creating Your Parent Account

Account creation is invitation-gated for security. You'll need an invitation code to register.

1. Navigate to the dashboard URL above.
2. Click "Create one" to switch to the sign-up form.
3. Enter your Email address.
4. Choose a Password.
5. Select your Compliance Region (United Kingdom, Australia, United Arab Emirates, Brazil, Indonesia, or Malaysia) to ensure the proper age-regulation standards are loaded for your profiles.
6. Set a 6-digit Security PIN — this PIN is required for all sensitive actions (toggles, lockdowns, sign-out). Choose something your child cannot guess.
7. Select your Device Setup mode:
   • Mobile + Desktop — enables the Desktop Protection section (browser extension pairing, daemon download, heartbeat monitoring, desktop tamper alerts). Choose this if your family uses desktop or laptop computers.
   • Mobile Only — hides the Desktop Protection section entirely and suppresses all desktop alerts. Choose this if your family only uses mobile devices (phones/tablets). You can switch to Mobile + Desktop later from the dashboard if you get a computer.
8. Enter your Invitation Code (contact support if you don't have one).
9. Click "Create account".

2.3 Email Verification

After creating your account, a verification email is sent to your inbox:

1. Open your email and click the verification link.
2. Return to the dashboard and click "I've Verified My Email".
3. If you didn't receive the email, click "Resend Verification Email".

2.4 Selecting Your Device Setup Mode

During sign-up, you'll choose your Device Setup mode. This determines whether desktop protection features (browser extension, daemon, heartbeat monitoring, desktop alerts) are visible in your dashboard.

• Mobile + Desktop — The Desktop Protection section is visible. Choose this if your family uses desktop or laptop computers. You'll be able to pair the browser extension, download the daemon, and monitor desktop heartbeats and tamper alerts.
• Mobile Only — The Desktop Protection section is hidden and all desktop alerts are suppressed. Choose this if your family only uses mobile devices (phones and tablets). This avoids cluttering your dashboard with desktop features you don't need and prevents unnecessary desktop alert notifications.

2.5 Entering Your Security PIN

Once your email is verified, you'll be prompted to enter your 6-digit Security PIN to access the dashboard. This is the PIN you set during sign-up.

2.6 Signing In (Returning Users)

If you already have an account:

1. Go to the dashboard URL.
2. Enter your Email and Password.
3. Click "Sign in".
4. Enter your 6-digit Security PIN when prompted.

If you forgot your password, click "Forgot password?" on the sign-in screen to receive a reset email.

3 The Parent Dashboard (PWA)

After signing in, you'll see the main dashboard. This is your control centre. The dashboard is organised into the following sections, each explained in detail in the sections below:

• Navigation Bar — Logo, your email, SET PIN button, REFRESH button, SIGN OUT button
• Child Profile Selector — Switch between children, add or delete profiles
• Core Legislation Layer — Global Shield toggle
• Device Integrity — Real-time status of your child's device
• Enforcement Kill Switch — Emergency disable for non-banned platforms
• Hourly Time Allocation Matrix — Time budget for timed apps
• Parent-Controlled Platforms — Toggle 62 parent-controlled platforms (WhatsApp, Telegram, Discord, Roblox, Rednote, Lemon8, and more) between ALLOW/BLOCK/TIMED
• Live Platform Interaction Audit — Table of all monitored platforms
• Category-Based Blocking — 6 restricted categories blocked by default, catch unknown apps by type
• DNS-Level Filtering — Category-aware DNS blocking at the network level, prevents circumvention via alternative DNS resolvers
• Installed App Inventory — Alphabetical list of all apps on your child's device, with new-app alerts
• Community-Sourced Blocklist — Report suspicious apps; 3 reports in a region promotes to watch list
• Behavioral Classification — AI-powered detection of apps behaving like social media (social feed UI, messaging infrastructure, profile systems)
• Trending Social App Detection — Daily polling of App Store trending Social Networking apps; alerts if your child has a newly trending app installed
• Gaming Lobby Chat Detection — Detects in-game chat UI in Roblox, Fortnite, Minecraft, Rec Room, and VRChat
• Messenger Feature-Level Blocking — Blocks WhatsApp Communities/Channels and Telegram Channels/Groups within the apps
• Compliance Region Pills — Shows applicable legal regions (Australia, Brazil, Indonesia, Malaysia, UAE, & UK)
• Curfew — Quiet Hours — Schedule nightly curfew to suppress alerts and lock devices during bedtime (see Section 3.2)
• Device Setup Mode — PIN-gated toggle between Mobile Only and Mobile + Desktop; when Mobile Only is selected, the Desktop Protection section is hidden and all desktop alerts are suppressed (see Section 3.3)
• Desktop Protection — Browser extension pairing, device list, daemon download, heartbeat monitoring, and desktop tamper alerts (hidden when Device Mode is set to Mobile Only)
• Tamper Alert History — Log of all tamper attempts

3.1 Navigation Bar

The top navigation bar contains:

• LexMatrix Guard logo — Click to identify the app
• Your email — Shows which account is signed in
• SET PIN — Change your Security PIN (see Section 11)
• REFRESH — Reload the dashboard to get the latest data
• SIGN OUT — Sign out of the dashboard (requires PIN)

3.2 Curfew — Quiet Hours

The Curfew card lets you schedule a nightly quiet period during which alerts are suppressed and child devices are locked. This ensures you wake up to a clean dashboard without overnight alert spam.

• Toggle switch — Quick enable/disable (saves immediately)
• Start Hour / End Hour — Set the curfew window in 24-hour format (e.g. 22:00–06:00)
• Suppress alert creation — Don't create alert documents during curfew hours
• Suppress push notifications — Don't send FCM push notifications during curfew
• Auto-acknowledge alerts — Mark curfew-period alerts as acknowledged immediately
• Timezone — Auto-detected from your browser; ensures curfew follows your local time
• Status indicator — Shows "Currently in curfew — devices locked" or "Outside curfew hours"

3.2.1 How Curfew Enforcement Works

When curfew is active:

• Cloud Functions — Alert-raising code checks isWithinCurfew() and skips Firestore writes, FCM pushes, or auto-acknowledges based on your settings
• Browser Extension — Fetches curfew settings every 5 minutes, checks every 2 minutes. During curfew, all tabs redirect to a blocked page. When curfew ends, tabs are restored
• Android — Applies screen lock during curfew hours
• iOS — Applies ManagedSettingsStore app shield during curfew hours

3.3 Device Setup Mode

The Device Setup Mode card lets you switch between Mobile Only and Mobile + Desktop modes. This controls whether the Desktop Protection section (browser extension pairing, daemon download, heartbeat monitoring, desktop tamper alerts) is visible in your dashboard.

• Toggle switch — PIN-gated; click the toggle and enter your 6-digit Security PIN to switch modes
• Mobile Only — Hides the Desktop Protection section entirely and suppresses all desktop alerts server-side. Use this if your family only uses phones and tablets.
• Mobile + Desktop — Shows the Desktop Protection section with full desktop monitoring features. Use this if your family uses desktop or laptop computers.
• When switching to Mobile Only, Desktop Protection Pause is automatically enabled

4 Managing Child Profiles

You can manage multiple children from a single parent account. Each child has their own profile, enforcement settings, and mobile app sign-in credentials.

4.1 Switching Between Children

Use the CHILD dropdown selector at the top of the dashboard to switch between child profiles. The dashboard updates to show the selected child's settings and device status.

4.2 Adding a New Child

1. Click the "+ Add Child" button next to the child selector.
2. Enter the child's name (e.g. "Emma").
3. Set a password for the child's mobile app sign-in (at least 6 characters).
4. Enter your 6-digit Security PIN when prompted (PIN-gated for security).
5. Click "CREATE".

After creating the profile, a green notice box appears showing the child's generated email address and reminding you of the password you set. These are the credentials your child will use to sign in on their mobile device.

4.3 Deleting a Child Profile

1. Select the child you want to delete from the dropdown.
2. Click the "Delete" button.
3. Confirm the deletion in the popup dialog.

5 Core Legislation Layer (Global Shield)

The Core Legislation Layer is the master switch for legally-banned platform enforcement. When active (toggle to the right, cyan colour), all banned platforms are locked down on your child's device.

Toggling the Global Shield

1. Click the toggle switch in the Core Legislation Layer card.
2. A Security PIN modal appears — enter your 6-digit PIN.
3. Click "VERIFY & ENFORCE" to confirm.

6 Device Integrity Monitoring

The Device Integrity card shows the real-time status of your child's device. It displays:

• TARGET — The name/ID of the selected child device
• Uplink status — "Secure" when connected, or warning messages if there are issues
• Last heartbeat — The time of the last check-in from the child's device
• Status badge — One of the following:
  • HEARTBEAT_OK — Device is connected and enforcement is active
  • TAMPER_DETECTED — The child has disabled the enforcement service
  • HEARTBEAT_STALE — No signal from the device in 10+ minutes (may be offline)
  • CONNECTING — Waiting for the device to come online

7 Enforcement Kill Switch

The Enforcement Kill Switch is an emergency control that lets you remotely disable all platform blocking on your child's device. This is useful if you need to temporarily grant full access (e.g. for a school requirement).

Toggling the Kill Switch

1. Click the toggle switch in the Enforcement Kill Switch card.
2. Enter your 6-digit Security PIN in the modal.
3. Click "VERIFY & ENFORCE".

8 Hourly Time Allocation Matrix

The Time Allocation Matrix controls how much time your child can spend on TIMED platforms (currently Twitch and YouTube). The time budget is shared across all timed apps.

How it works

• The green-to-pink progress bar shows remaining time out of a maximum of 360 minutes (6 hours).
• The number next to "Remaining Dynamic Allocation" shows the current minutes left.
• As your child uses timed apps, the server tracks usage and the bar depletes. Usage is reported every 5 minutes (or on session end / budget exhaustion) for cost efficiency, with a local countdown on the dashboard estimating the remaining time between syncs.
• When the budget reaches zero, all timed apps are automatically locked.

Adding Time

Click "+15 MIN UPLINK" to add 15 minutes or "+1 HR UPLINK" to add 1 hour to the time budget. Both require your Security PIN — all budget mutations are PIN-gated to prevent unauthorised time grants. The maximum allocation is 360 minutes (6 hours); both buttons are disabled once the cap is reached.

Force Lockdown

Click "FORCE LOCKDOWN" to immediately zero out the time budget and lock all timed apps. This requires your Security PIN.

9 Parent-Controlled Platforms

While legally-banned platforms (Facebook, Instagram, TikTok, etc.) are enforced automatically by the server-side legal list, 62 platforms are exempt from the legal ban and fully parent-controllable. These include messaging apps (WhatsApp, Telegram, Discord, Signal, Session, WeChat, Viber, Threema, Line, IMO, BOTIM, Kik), gaming/social hubs (Roblox, Fortnite, Minecraft, VRChat, Rec Room, IMVU, Habbo Hotel, Steam Community), niche social apps (Rednote, Lemon8, Yope, BeReal, Pinterest, Bluesky, Mastodon, Lemmy, Nostr), anonymous apps (Whisper, NGL, Yik Yak, Sarahah, Sendit, Fizz), AI companion apps (Character.ai, Replika, Chai), video/streaming platforms (Bilibili, Dailymotion, Rumble, Trovo, DLive), and photo/utility apps (Canva, Locket, NoteIt, Geneva, Matrix/Element).

Most of these default to LOCKED to close loophole migration gaps. WhatsApp and Telegram default to ALLOWED for family communication. You can toggle each one between three states at any time. Every change requires your 6-digit Security PIN and is verified server-side.

9.1 Available States

9.2 How to Toggle a Platform

1. Scroll to the "Parent-Controlled Platforms" section in the dashboard (below the Time Allocation Matrix).
2. Find the platform you want to change (e.g. WhatsApp, Telegram, Discord, Roblox, Rednote, or any of the 62 parent-controlled platforms).
3. Click the desired state button: ALLOW, BLOCK, or TIMED.
4. A Security PIN modal appears — enter your 6-digit Security PIN.
5. Click "VERIFY & ENFORCE" to confirm.
6. The change syncs to your child's device in real time via Firestore.

10 Live Platform Interaction Audit

This table shows every monitored platform, its category, legal status, and current enforcement state. It gives you a quick at-a-glance view of what's blocked, timed, or allowed on your child's device.

Compliance Region Pills

Below the platform table, region pills are organized into 5 continent groups indicating which legal frameworks are being enforced:

11 Category-Based Blocking

In addition to blocking 72 individual platforms by name, LexMatrix Guard enforces 6 restricted categories that catch unknown or emerging apps by their type. Even if a niche app isn't in our 72-platform list, category blocking ensures it's still blocked based on what kind of app it is.

11.1 Restricted Categories

11.2 How Category Blocking Works

• All 6 categories are blocked by default when you create a child profile.
• When the enforcement app detects an app that belongs to a restricted category (even if it's not in the 72-platform list), it blocks it automatically.
• You can change a category's state to ALLOWED or TIMED at any time. Every change requires your 6-digit Security PIN.
• Category blocking works alongside individual platform blocking — if either the platform name or the category is blocked, the app is blocked.

11.3 Toggling a Category

1. Scroll to the "Category-Based Blocking" section in the dashboard.
2. Find the category you want to change.
3. Click the desired state button: ALLOW, BLOCK, or TIMED.
4. Enter your 6-digit Security PIN in the modal.
5. Click "VERIFY & ENFORCE" to confirm.

12 DNS-Level Category Filtering

LexMatrix Guard maintains a DNS domain blocklist on iOS devices that mirrors your category and platform blocking settings. When the iOS Network Extension is active, DNS queries for blocked domains are intercepted and resolved to NXDOMAIN, preventing the child from reaching restricted sites via alternative DNS servers, VPN apps that route DNS externally, or DNS-over-HTTPS (DoH) / DNS-over-TLS (DoT) services.

12.1 How DNS Filtering Works

When category or platform blocking is active on iOS and the Network Extension is operational, the enforcement app intercepts DNS queries and blocks resolution of any domain in the DNS blocklist. Blocked queries receive an NXDOMAIN response, causing the device to believe the domain does not exist — rather than simply timing out.

• Category domains — All domains associated with blocked categories (e.g., facebook.com, tiktok.com, twitch.tv for Social Media / Live-Streaming)
• Platform domains — All domains associated with individually blocked platforms
• DoH/DoT circumvention endpoints — 20 known DNS-over-HTTPS and DNS-over-TLS services (e.g., dns.google, cloudflare-dns.com, dns.nextdns.io) are blocked to prevent the child from using alternative DNS resolvers

The DNS blocklist is maintained on all plans, but network-level interception only occurs when the iOS Network Extension is active. When the extension is not active, domain matching is still performed at the app level. DNS filtering is currently supported on iOS devices only.

12.2 The DNS Filtering Status Card

The dashboard displays a "DNS FILTERING" status card in the Mobile Protection section (visible only for iOS devices), next to the Core Legislation Layer and Device Integrity cards. The card shows one of the following states:

• DNS_ACTIVE (green) — DNS filtering is enforced; the Network Extension is active and blocked domains are being filtered at the network level
• CONFIGURED (amber) — The DNS blocklist is configured but the Network Extension is not active; domain matching is performed at the app level only
• DEGRADED (red) — DNS filtering health check failed; the Network Extension may be misconfigured or unavailable. App-level blocking remains active
• MONITORING_ONLY (slate) — The domain blocklist is maintained but no network-level interception is active. App-level blocking and browser URL checking remain enforced
• CONNECTING — Waiting for the first heartbeat from the child's device

The card also shows the resolver type — Network Extension for iOS — based on the child's device platform.

13 Installed App Inventory & New-App Alerts

LexMatrix Guard scans your child's device every 30 minutes and reports all installed apps to your dashboard. This gives you complete visibility of what's on your child's device, not just the platforms you've explicitly configured.

13.1 The App Inventory Section

The "Installed App Inventory" section appears on the dashboard below the Platform Interaction Audit. It lists every non-system app installed on your child's device, sorted alphabetically, showing:

• App name — The display name of the app
• Category — The app's category (if classified)
• Current state — LOCKED, TIMED, or ALLOWED badge
• Quick actions — BLOCK, TIMED, or ALLOW buttons for unclassified apps

13.2 New-App Alerts

When the device scan detects a new app that isn't in the known platform map, LexMatrix Guard immediately sends you a NEW_APP_DETECTED alert. The alert appears as a banner at the top of the dashboard and includes:

• The app name and package name
• The detected category (if known)
• One-tap BLOCK, TIMED, or ALLOW buttons

You must enter your Security PIN to classify the app. Once classified, the enforcement app on the child's device receives the update in real time.

14 Community-Sourced Blocklist & Watch List

The Community-Sourced Blocklist lets parents crowdsource threat discovery. When a parent discovers a suspicious app that isn't in the 72-platform list or a restricted category, they can report it to the community. Once enough parents in the same region report the same app, it's automatically promoted to a watch list and all other parents in that region receive an alert.

14.1 Reporting an App

1. Find the app you want to report in the Installed App Inventory section (see Section 13).
2. Click the "REPORT" button next to the app.
3. A confirmation modal appears showing the app name and asking you to confirm the report.
4. Click "CONFIRM REPORT" to submit.

The report is sent to the reportCommunityApp Cloud Function, which records it in the community_blocklist Firestore collection, scoped to your region.

14.2 How Promotion Works

• When 3 parents in the same region report the same app, it's automatically promoted to the watch list.
• The onCommunityAppPromoted Cloud Function triggers and scans all children's devices in that region for the reported app.
• If any child has the app installed and it hasn't been classified by their parent, a COMMUNITY_WATCH_LIST alert is created.
• The parent receives a push notification (if enabled) and an alert banner appears on the dashboard.

14.3 Community Watch List Alerts

When an app is promoted to the watch list, the alert on your dashboard shows:

• The app name and package name
• The category (if known)
• A message explaining that the community has flagged this app
• One-tap BLOCK, TIMED, or ALLOW buttons (PIN-gated)

15 Behavioral Classification & Alerting

LexMatrix Guard uses accessibility event pattern analysis on Android to detect when an unclassified app is behaving like a social media platform. Even if an app isn't in the 72-platform list or a restricted category, the behavioral classifier can flag it based on its UI patterns.

15.1 What It Detects

The BehavioralClassifier on Android monitors accessibility events (window state changes, content changes, view clicks) and looks for three behavioral patterns:

• Social Feed UI — scrollable content feeds with like/comment/share buttons, story carousels, or infinite scroll patterns
• Messaging Infrastructure — direct messaging UI with chat bubbles, conversation lists, or compose message fields
• Profile System — user profile screens with avatars, follower counts, bio sections, or edit profile functionality

15.2 Behavioral Alert Banner

When a behavioral pattern is detected, a BEHAVIORAL_FLAG alert appears on the dashboard with:

• The app name and package name
• The detected pattern type (social feed, messaging UI, or profile system)
• A confidence score
• BLOCK APP and DISMISS buttons (PIN-gated)

Alerts use a 30-minute cooldown to prevent spam. If you tap BLOCK App, the app is added to the behavioralFlags list and will be blocked on the child's device in real time.

16 Trending Social App Detection

LexMatrix Guard polls the Apple App Store RSS feed daily for trending Social Networking apps in the Australia region. When a new trending app is detected that isn't already in the platform map, the system:

1. Stores the app in the trending_social_apps Firestore collection
2. Checks all children's app inventories in the region for the trending app
3. Sends a TRENDING_SOCIAL_APP alert to parents whose children have the app installed
4. Delivers an FCM push notification to the parent's device

16.1 Trending App Alert Banner

The alert banner on the dashboard shows:

• The trending app name and category
• A message explaining that this app is trending on the App Store
• BLOCK APP and DISMISS buttons (PIN-gated)

17 Gaming Lobby Chat Detection

Many gaming platforms (Roblox, Fortnite, Minecraft, Rec Room, VRChat) have in-game chat systems that children use for unmoderated communication. LexMatrix Guard's GamingChatDetector on Android analyzes the accessibility node tree to detect chat UI patterns within these gaming apps.

17.1 What It Detects

The detector looks for gaming-specific chat UI elements:

• Chat input fields and send buttons
• Chat message lists with player names
• Voice chat join/leave indicators
• Party/squad invitation UI

17.2 Gaming Chat Alert

When chat UI is detected in a gaming app, a GAMING_CHAT_DETECTED alert is created with a 5-minute cooldown. The alert banner shows:

• The gaming app name
• A message indicating that in-game chat was detected
• BLOCK APP and DISMISS buttons (PIN-gated)

If the gaming app is already in the blocked set, the enforcement service shows a lock screen overlay when chat is detected.

18 Messenger Feature-Level Blocking

WhatsApp and Telegram are exempt from legal bans so children can communicate with family. However, their Communities, Channels, and Public Groups features are used by children to join unmoderated mass-communication spaces. LexMatrix Guard can block access to these specific features within the apps, without blocking the apps entirely.

18.1 Blockable Messenger Features

18.2 How It Works (Android)

The MessengerFeatureBlocker analyzes the accessibility node tree for known UI patterns (tab labels, screen titles, button texts) associated with restricted features. When a restricted feature is detected:

1. The enforcement service presses the Back button to navigate the child away from the restricted feature
2. A MESSENGER_FEATURE_BLOCKED alert is created with a 10-minute cooldown
3. An FCM push notification is sent to the parent

18.3 How It Works (iOS)

On iOS, the Screen Time API does not support feature-level blocking within apps. When any messenger feature block is active, LexMatrix Guard blocks the entire app (WhatsApp or Telegram) as a fallback.

18.4 Messenger Feature Alert Banner

The alert banner on the dashboard shows (in blue):

• The messenger app name and detected feature
• A message indicating the child attempted to access a blocked feature
• BLOCK APP and DISMISS buttons (PIN-gated)

19 Tamper Alerts & Alert History

19.1 Active Tamper Alert Banner

When your child disables the enforcement service on their device, a red, pulsing TAMPER ALERT banner appears at the top of the dashboard. It shows:

• The alert message(s) — up to 3 recent alerts are shown
• The total number of unacknowledged alerts
• An "Acknowledge All" button to dismiss the alerts once you've reviewed them

19.2 Stale Heartbeat Warning

If the child's device hasn't sent a heartbeat in over 10 minutes (but no tamper alert has been triggered), an amber warning appears: "No heartbeat from child device in over 10 minutes."

19.3 Tamper Alert History

At the bottom of the dashboard, the TAMPER ALERT HISTORY section shows a complete log of all alerts. The list shows the 5 most recent alerts by default. If there are more than 5, you can scroll vertically within the list to see older entries.

Each alert entry shows:

• A coloured dot — red (pulsing) for unacknowledged, grey for acknowledged
• The alert message
• The date and time the alert was triggered
• An "ACK" button to acknowledge individual alerts (if not yet acknowledged)

20 SIM Detection & Device-Switch Alerts

LexMatrix Guard monitors your child's SIM card state in real time. If the SIM card is removed, swapped for a different one, or the child switches to an entirely different device, an instant alert is sent to your parent dashboard. This prevents children from bypassing enforcement by moving their account to a new, unmonitored device.

20.1 How SIM Monitoring Works

The mobile enforcement app records a cryptographic hash of the child's SIM card at sign-in time and stores it as the authorized SIM hash on the server. On every heartbeat (every 30 seconds), the app checks the current SIM state and compares it to the authorized hash:

• SIM_REMOVED — The SIM card has been physically removed from the device.
• SIM_CHANGED — A different SIM card has been inserted (the hash no longer matches).
• DEVICE_SWITCH_DETECTED — The child's account has been signed in on a different device.

When any of these events is detected, a tamper alert is written to the child's alert history and a push notification is sent to the parent's devices immediately.

20.2 Accepting or Rejecting a SIM Change

When a SIM_CHANGED alert appears on the dashboard, two PIN-gated buttons are shown:

• ACCEPT NEW SIM — Updates the authorized SIM hash on the server to the new SIM card. This is used when you, the parent, have knowingly changed your child's SIM card or phone.
• REJECT — Marks the alert as escalated. Enforcement remains locked and the alert stays active until you intervene. Use this if the SIM change was unauthorized.

Both actions require your 6-digit Security PIN, which is verified server-side by the authorizeSimChange Cloud Function.

20.3 SIM Alerts in Alert History

SIM-related alerts appear in the Tamper Alert History feed at the bottom of the dashboard, alongside other tamper alerts. Each SIM alert shows:

• The alert type (SIM_REMOVED, SIM_CHANGED, or DEVICE_SWITCH_DETECTED)
• The date and time the alert was triggered
• The resolution status — SIM Accepted or SIM Rejected (Escalated) once you've taken action

21 Desktop Enforcer Daemon

The Desktop Enforcer Daemon is a lightweight background program that runs on your child's Windows, macOS, or Linux computer and terminates forbidden applications at the operating system level — even if they are launched outside the browser. This works alongside the browser extension to provide complete desktop coverage.

21.1 What It Does

• Process-level enforcement: Scans running processes every 1.5 seconds and immediately terminates forbidden executables (Discord, Telegram, WhatsApp, Roblox, Steam, Epic Games, Opera GX, Brave, Tor, etc.)
• Real-time block alerts: When a forbidden app is terminated, an instant alert is sent to your parent dashboard with the platform name and binary that was blocked
• Heartbeat monitoring: The daemon sends a heartbeat every 60 seconds so the dashboard shows it as online. If the daemon is killed or deleted, a DESKTOP_HEARTBEAT_STALE tamper alert is raised within 3 minutes
• Push notifications: Block events trigger FCM push notifications to your phone and browser

21.2 How to Install

The daemon is designed for non-technical parents — no manual configuration required.

1. Open the browser extension popup on your child's computer (after pairing).
2. The popup automatically detects the child's operating system and architecture (e.g., "Windows 64-bit").
3. Click the "Download Desktop Enforcer" button.
4. Two files will download: the daemon binary and a daemon_config.json file.
5. Place both files in the same folder on the child's computer.
6. Run the daemon binary (double-click the .exe on Windows).

21.3 Desktop Enforcer Alert Banner

When the daemon terminates a forbidden executable, a green DESKTOP ENFORCER banner appears on the parent dashboard. It shows:

• The number of blocked executable attempts
• The platform name (e.g., DISCORD, TELEGRAM, ROBLOX) for each blocked attempt
• The alert message with details of what was blocked
• An "Acknowledge All" button to dismiss the alerts

21.4 Anti-Tamper Protection (Windows)

On Windows, the daemon installs three independent layers of persistence to prevent your child from disabling it:

21.5 macOS & Linux Persistence

On macOS, the daemon installs a LaunchAgent plist at ~/Library/LaunchAgents/com.lexmatrix.guard.plist with KeepAlive set to true. This ensures the daemon auto-starts when the child logs in and is automatically restarted if killed.

On Linux, a systemd user service is installed at ~/.config/systemd/user/lexmatrix-guard.service with Restart=always, providing the same auto-start and restart-on-crash behaviour.

21.6 Improved Process Matching

The daemon doesn't just match by binary name — it also checks alias names for each target platform. This catches renamed binaries, portable variants, and beta/canary builds. For example:

• Discord: Also matches DiscordPTB.exe, DiscordCanary.exe
• Telegram: Also matches tdesktop.exe, TelegramDesktop.exe
• Tor: Also matches tor-browser.exe, torbrowser.exe

On Windows, the daemon also detects WSL (Windows Subsystem for Linux) processes. If wsl.exe is running, the daemon checks Linux processes inside the WSL container for blocked platform binaries.

21.7 Daemon Heartbeat on the Dashboard

The daemon's heartbeat appears in the Desktop Protection section of the dashboard, alongside the browser extension's heartbeat. The device card shows:

• HEARTBEAT_OK — Daemon is running and sending heartbeats every 60 seconds
• HEARTBEAT_STALE — No heartbeat for 3+ minutes (daemon may have been killed or deleted)

21.8 Alert History

Daemon block events also appear in the Tamper Alert History feed at the bottom of the dashboard, tagged with a green DESKTOP DAEMON badge so you can distinguish them from browser extension and mobile app alerts.

22 Security PIN Management

Your 6-digit Security PIN protects all sensitive actions on the dashboard and is required to sign out of the enforcement app on your child's device. You can change your PIN at any time.

Changing Your PIN

1. Click the "SET PIN" button in the navigation bar.
2. Enter your new 6-digit PIN in the "NEW PIN" field.
3. Re-enter the same PIN in the "CONFIRM PIN" field.
4. Click "SAVE PIN".
5. A green "Security PIN set successfully" message confirms the change.

23 Signing Out of the PWA

Signing out of the parent dashboard requires your Security PIN for security.

1. Click "SIGN OUT" in the navigation bar.
2. Enter your 6-digit Security PIN in the modal.
3. Click "VERIFY & ENFORCE" to sign out.

If you enter the wrong PIN, an "Incorrect security PIN" error appears and you can try again.

24 Installing the Android Enforcement App

The Android enforcement app runs on your child's Android phone (Android 8.0 / API 26 or later). It uses an Accessibility Service to detect and block app launches, and Device Admin to prevent uninstallation.

24.1 Installation Steps

1. Install the LexMatrix Guard app on your child's Android phone (via APK or Play Store when available).
2. Open the app. The setup wizard will appear.
3. Tap "Enable Accessibility Service" — you'll be taken to Android Settings → Accessibility.
4. Find "LexMatrix Guard" in the list and enable it.
5. Return to the app and tap "Enable Device Admin" — confirm the Device Admin prompt.
6. Tap "Continue".

24.2 Battery Optimisation

Some Android manufacturers (Xiaomi, Oppo, Vivo, Samsung) aggressively kill background services to save battery. To ensure reliable enforcement:

• Go to Settings → Battery → LexMatrix Guard → Don't optimise
• Add the app to your manufacturer's auto-start whitelist if applicable

25 Installing the iOS Enforcement App

The iOS enforcement app runs on your child's iPhone or iPad (iOS 16.0 or later). It uses Apple's Family Controls (Screen Time API) to block apps at the OS level.

25.1 Installation Steps

1. Install the LexMatrix Guard app on your child's iPhone (via TestFlight or App Store when available).
2. Open the app. It will request Family Controls permission.
3. Tap "Allow" on the iOS permission dialog.
4. The app will sign in and start listening for policy changes.

How iOS enforcement works: When a platform is locked, iOS shows a shield screen when your child tries to open the blocked app. The app icon may appear greyed out with an hourglass symbol. This is Apple's built-in Screen Time enforcement — it cannot be bypassed by the child.

26 Signing In on the Child's Mobile Device

After installing the enforcement app on your child's device, you need to sign in using the child's credentials that were generated when you created their profile (see Section 4.2).

Steps

1. Open the LexMatrix Guard app on the child's device.
2. Enter the child's email (the long generated email from the "Child Profile Created" notice).
3. Enter the password you set when creating the child profile.
4. Sign in.

27 How Mobile Enforcement Works

Once signed in, the enforcement app runs silently in the background. Here's what happens:

27.1 App Blocking

• Android: When your child tries to open a blocked app, the Accessibility Service detects the launch and immediately shows a full-screen lock screen overlay. The child cannot bypass it — the back button is disabled.
• iOS: Apple's ManagedSettings framework blocks the app at the OS level. The app icon appears greyed out with a shield/hourglass, and iOS shows a restriction screen if tapped.

27.2 Timed App Usage

For TIMED apps (Twitch, YouTube), the child can use them freely until the time budget runs out. The mobile app reports usage to the server every 30 seconds. When the budget is exhausted, the app is automatically locked.

Additionally, the Parent-Controlled Platforms (Discord, Telegram, and WhatsApp) can be set by the parent to a TIMED state on the dashboard. When set to TIMED, they are subject to this same hourly Time Wallet budget and will be automatically locked as soon as the wallet exhausts.

27.3 Tamper Detection (Android)

• If your child disables the Accessibility Service in Settings, a full-screen lock appears immediately, preventing further device use.
• The parent dashboard shows a TAMPER_DETECTED status and a tamper alert is logged.
• Split-screen and multi-window attempts with blocked apps are also detected and blocked.

27.4 Tamper Detection (iOS)

• Family Controls cannot be disabled by the child without the parent's Apple ID password.
• The app monitors for enforcement status changes and alerts the parent dashboard.

28 Signing Out from the Mobile App

Signing out from the enforcement app on the child's device requires the parent's Security PIN. This prevents children from disabling enforcement by signing themselves out.

Steps

1. Open the LexMatrix Guard app on the child's device.
2. Tap "Sign Out" on the enforcement screen.
3. Enter the parent's 6-digit Security PIN.
4. Confirm sign-out.

After Sign-Out (Android)

A "Protection Disabled" screen appears with instructions to disable Accessibility in Settings. The parent can re-enable protection at any time by tapping "Re-enable Protection".

29 Troubleshooting & FAQ

Q: The dashboard shows "CONNECTING" and never changes to "HEARTBEAT_OK"

The child's device hasn't sent a heartbeat yet. Check that:

• The enforcement app is installed and signed in on the child's device
• The child's device has internet connectivity
• The correct child profile is selected in the dashboard dropdown

Q: I see "HEARTBEAT_STALE" — what should I do?

The child's device hasn't reported in over 10 minutes. The device may be:

• Offline or out of battery
• In an area with no internet
• Force-killed by the OS (Android — check battery optimisation settings)

Q: My child disabled the Accessibility Service (Android)

The app's AccessibilityGuardService should detect this and lock the device. You'll see a TAMPER_DETECTED alert on the dashboard. On the child's device, a full-screen lock prevents use until the Accessibility Service is re-enabled. Go to Settings → Accessibility → LexMatrix Guard → ON to restore enforcement.

Q: The lock screen isn't appearing on Android

• Ensure "Draw over other apps" (SYSTEM_ALERT_WINDOW) permission is granted
• Check that the Accessibility Service is actively running
• Disable battery optimisation for the app
• On Xiaomi/Oppo/Vivo devices, add the app to the auto-start whitelist

Q: I forgot my Security PIN

Contact LexMatrix Guard support. For security reasons, PIN reset is not available through the app interface.

Q: Can my child reset the time budget by clearing app data?

No. Time usage is tracked server-side. The mobile app reports usage every 30 seconds, and clearing app data does not affect the server's record of accumulated usage.

Q: Can my child uninstall the enforcement app?

• Android: No — Device Admin prevents uninstallation without the admin password.
• iOS: The app can be deleted, but Family Controls restrictions remain in effect if configured through Screen Time. Reinstalling the app restores full enforcement.

Q: What happens if I lose internet on my phone (parent)?

The dashboard will not update in real time, but enforcement continues on the child's device — it operates independently based on the last received policy. When your internet returns, refresh the dashboard to see the latest status.

Q: What happens if my child's device loses internet?

The enforcement app continues to enforce the last received policy offline. The dashboard will show HEARTBEAT_STALE after 10 minutes. When the device reconnects, it resumes sending heartbeats and the dashboard updates automatically.

Q: Can I use the same parent account on multiple devices?

Yes. Sign in to the PWA on any browser/device with your parent email and password. The dashboard syncs in real time.

Q: The "+15 MIN UPLINK" or "+1 HR UPLINK" button isn't working

Check for a red error banner below the child selector — it will show any policy save errors. Ensure you have a stable internet connection and try the REFRESH button. If the buttons are greyed out, the time budget has already reached the 360-minute (6 hour) maximum.

Q: The desktop daemon isn't showing up on the dashboard

If the daemon is running but the dashboard doesn't show a heartbeat:

• Ensure daemon_config.json is in the same folder as the daemon binary
• Check that the child's computer has internet connectivity
• Verify the daemon was downloaded from the paired extension (not a different child's extension)
• Look for log output in the daemon's console window — it will show "Daemon config loaded" on success

Q: My child killed the daemon via Task Manager — what happens?

On Windows, the Windows Service layer automatically restarts the daemon within 30 seconds. If the service is also disabled, the Scheduled Task watchdog re-launches it within 5 minutes. If both fail, you'll receive a DESKTOP_HEARTBEAT_STALE tamper alert within 3 minutes.

Q: Can my child delete the daemon?

The child can delete the binary file, but this breaks all persistence layers and stops heartbeats — triggering a DESKTOP_HEARTBEAT_STALE alert on your dashboard within 3 minutes. You'll know immediately that the daemon has been tampered with. Re-download it from the browser extension popup.

Q: I see a "SIDELOADED_APP_DETECTED" alert — what does this mean?

Your child has installed an app from a source other than the official Play Store (Android) or App Store (iOS). This is called "sideloading" and can be a security risk. The alert shows which app was sideloaded and its installer source. You can block the app directly from the alert banner on the dashboard.

Q: I see a "STALE_TIMED_USAGE" alert — what does this mean?

Your child's device is online and sending heartbeats, but the timed usage reporter has stopped reporting for more than 10 minutes while the child still has remaining timed budget. This may indicate the child has found a way to interfere with the usage tracking service. Check the child's device to ensure the enforcement app is running properly and hasn't been tampered with.

Q: How will the iOS App be installed once available?

Once compiled on a macOS environment using Xcode, the iOS Enforcement App can be deployed via TestFlight or Apple Developer provisioning profiles. During setup, the child's device will prompt to enable the Family Controls API. This configuration requires the parent's Apple ID password to confirm and prevent the child from deleting or disabling the app.

Q: How does the UAE region regulation work?

UAE Cabinet Resolution No. 106 imposes age restrictions on social media platforms for children under 15 years old. When you select the UAE region during parent sign-up or profile creation, the legal compliance shield automatically configures the platform access defaults to align with this under-15 legal ban.

Q: Can I manage children in different regulatory regions on one account?

Yes. Each child profile has its own settings. The platform automatically tracks and enforces the correct local compliance rules (Australia, Brazil, UAE, or UK) based on the region selected when you create or edit the child's profile on the dashboard.

30 Recent Integrations, Security Updates & PWA Dashboard Upgrades

This section summarises the integrations and security hardening released in recent updates. It covers the new Indonesia and Malaysia compliance regions, PWA dashboard upgrades, and client-hardening features that parents should know about.

30.1 Indonesia & Malaysia Regional Compliance

LexMatrix Guard now supports two additional compliance regions, bringing the total to six:

• INDONESIA_GR17_2026 — Indonesian Ministry of Communication and Digital (Kemenkomigi) Government Regulation No. 17 of 2025. In this region Bigo Live and Roblox are added to the legal ban list and cannot be overridden by a parent.
• MALAYSIA_ONSA_2025 — Malaysian Communications and Multimedia Commission (MCMC) Online Safety Act 2025. Adds eKYC privacy identity bypass protection and ONSA local block compliance.

During parent sign-up and when creating or editing a child profile, select the correct compliance region so the correct legal floor and regional defaults are loaded. Region-specific bans (for example YouTube and Twitch locked in the UAE, Brazil, Indonesia and Malaysia) are enforced automatically.

30.2 PWA Dashboard Upgrades

The parent dashboard has received a number of new controls and status indicators:

• Desktop Protection Pause — A toggle that mutes desktop heartbeats, tamper alerts and block notifications when your child is away from the computer (for example at school or on holiday). The badge reads Desktop Alerts Muted while paused.
• Alerts Notifications Toggle — Silences popup notifications on parent desktop and mobile devices while still recording every alert in the dashboard. The badge reads Mobile Alerts Muted while off.
• Telemetry & Privacy Consent — A card that lets you control whether non-security telemetry is collected from your child's devices. Security-critical endpoints (enforcement status, SIM-swap detection, etc.) remain active regardless of the setting.
• Brazil Digital Statute Controls — Two toggles that remove addictive interface elements at the system layer for users under 16: Remove Infinite Scroll (hard scroll limits on TikTok, Instagram, YouTube) and Remove Variable-Reward Feeds (blocks auto-playing algorithms and variable reward mechanics).
• Device Trust Labels — The Device Integrity card now shows a trust label (Verified, Attested, Self-Reported, Unverified, Rooted or Jailbroken) based on Play Integrity / App Attest evidence and the actual device state.
• Pending Device Confirmation — New desktop devices must be parent-confirmed before they are trusted. Unconfirmed devices show a Pending parent confirmation warning.
• Web Browser Blocking — Banned platforms are blocked in all major web browsers automatically; no separate configuration is required.
• Alert History — The bottom of the dashboard shows a scrollable history of all alerts, tagged by source (Community, Behavioral, Trending, Gaming Chat, Messenger, Desktop Daemon, Desktop Extension, Mobile App) and acknowledgement state.

30.3 Security Audit Frontend Hardening

Following the LexMatrix Guard security audit, several parent-facing and client-facing protections were added or strengthened:

• Atomic PIN lockout — PIN attempt counting, lockout, successful reset and hash upgrade are now performed inside a Firestore transaction, so concurrent wrong attempts cannot race on the counter. A durable Firestore-based per-IP sliding-window rate limiter replaces the old in-memory limiter.
• Recent reauthentication — High-risk actions such as deleting a child profile, deleting the parent account, deleting/revoking a device and rotating a device key require recent Firebase Authentication (within a 5-minute window).
• Parent-controlled notification privacy — You can set notificationPrivacy to full, minimal or none on your user document to control how much alert detail appears on lock-screen notifications.
• Sensitive alert detail protection — Viewing sensitive alert details (message, appName, installerSource, deviceName) now requires recent reauthentication via the getSensitiveAlertDetail callable.
• DOMPurify translation sanitization — Translated HTML in the PWA is sanitized with a strict allowlist (only strong and a tags) and 18 XSS tests reject scripts, event handlers and unsafe URLs.
• CSP hardening — unsafe-inline has been removed from style-src across all static website routes and the dashboard route. All inline style attributes were replaced with CSS classes.
• Anomaly detection — Security anomalies are logged for PIN brute-force lockout, nonce replay, webhook replay, daemon auth brute-force, telemetry quota abuse, cleanup job failures and dead-lettered deletions.
• PIN-gated budget mutations — All time-budget changes (granting time, force lockdown, resetting usage) require the 6-digit Security PIN via the grantTimedBudget and resetTimedUsage Cloud Functions. Direct Firestore writes to timeRemaining are blocked by security rules.
• Per-device usage accounting — Each child device writes timed usage to its own sub-document under timed_usage/current/devices/. The server sums across all devices, preventing multiple devices from double-draining a single time budget.
• Audit log integrity — Policy audit entries now use Firestore auto-generated document IDs instead of deterministic keys, preventing collisions when two PIN-gated actions occur simultaneously.

30.4 Browser Extension & Desktop Daemon Updates

• Ed25519 non-extractable keys — The browser extension now generates Ed25519 keys using the Web Crypto API and stores the private key as a non-extractable CryptoKey in IndexedDB. Raw secrets are no longer used for steady-state requests and legacy HMAC fallback has been removed. The migration includes retry logic with exponential backoff and fail-closed behaviour — if migration fails, local storage is cleared so the raw device secret does not persist.
• AES-256-GCM cache encryption — Cached active_blocks and curfew settings in the browser extension are now encrypted at rest using AES-256-GCM. The encryption key is generated and stored in IndexedDB (lexmatrix_keys / cache_key object store), so even if local storage is accessed, cached policy data is not readable in plaintext.
• Manifest host hardening — The extension's host_permissions now uses a wildcard (https://*.cloudfunctions.net/*) to avoid exposing the Firebase project ID and region in the published extension manifest.
• Device pairing — The dashboard can generate a time-limited pairing code for the Chrome/Edge extension. The extension registers itself with the backend and downloads a daemon_config.json for the desktop daemon.
• Versioned daemon URLs — Daemon downloads use immutable, versioned paths such as /daemon/v1.0.0/. Firebase Hosting caches these with immutable headers. The daemon checks /daemon/manifest.json for updates, enforces anti-downgrade and honours emergency revocation.
• OS-native hardening — Windows binaries are protected with icacls ACLs, macOS LaunchAgent plists and Linux systemd service files are set read-only (0444), and the scheduled-task watchdog interval was reduced to 3 minutes for faster recovery.
• Incognito / private-browsing blocking — The browser extension detects attempts to open Incognito or Private Browsing mode and blocks them, raising a DESKTOP_INCOGNITO_ATTEMPT alert.
• Extension/device revocation — Parents can revoke a desktop device or browser extension from the dashboard. Revoked devices cannot fetch policy or send heartbeats.

30.5 Mobile App Updates

• Play Integrity / App Attest — Android uses Google Play Integrity and iOS uses Apple App Attest to validate app and device integrity. The dashboard trust label reflects the result and flags rooted/jailbroken devices.
• DNS filtering modes — iOS now reports an explicit dnsFilteringMode of monitoring-only, configured, enforced or degraded, with colour-coded badges and localised descriptions on the dashboard.
• Telemetry consent gating — Non-security telemetry is gated by the parent-facing Telemetry & Privacy Consent setting. Android and iOS implement rotating 24-hour identifiers to prevent long-term tracking correlation.
• SafeLog — Android release builds replace direct android.util.Log calls with a debug-gated SafeLog wrapper, so sensitive data does not appear in logcat.
• Actual service state checks — Android SimStateReceiver and BootReceiver now validate intent actions and verify the real running state of AccessibilityGuardService rather than assuming it from a broadcast.
• Monotonic clock enforcement — Android uses SystemClock.elapsedRealtime() and iOS uses ProcessInfo.systemUptime for budget calculations instead of wall-clock time. This prevents children from extending timed access by changing the device clock. iOS also detects backward clock jumps greater than 60 seconds and triggers a re-sync.
• Server-seeded local usage — On every policy sync, the mobile app's local accumulated usage is seeded from the authoritative server-side total (serverUsedSeconds). This prevents clearing app data or local storage from resetting the timed usage countdown.
• Correct child ID reporting — Android's TimedUsageReporter now receives the actual linkedChild ID at instantiation instead of hardcoding "primary", ensuring usage is reported to the correct child profile.

30.6 BOCHA Identity Airlock

BOCHA ("Bring Our Children Home Again") is the dashboard indicator that LexMatrix Guard is acting as an on-device digital airlock. By blocking banned platform domain handshakes locally before any connection resolves, the system prevents Big Tech's age-verification prompts from requesting your child's passport scans, eID links or biometric facial sweeps. The card shows Identity Protection: Sovereign / Anonymous and Biometric Prompts: Pre-empted (0 Loaded) while the airlock is active.

31 Glossary