Plain-language privacy policy.

WOMBATS Shield is designed around local‑first network management. Filtering decisions and the management dashboard run on the appliance on your network. There is no vendor cloud control plane and no telemetry pipeline back to us by design.

Shield does not maintain a browsing-history report or a behavioural profiling dashboard. AdGuard Home defaults that would have produced these have been disabled or restricted in our build.

When you place an order or contact support, we collect the information you provide, name, email, shipping address, order reference, and any details you include in your message, in order to process the order or respond to you.

Payments are processed by Stripe, or by PayPal if you choose to pay with PayPal. We don't see or store your card details, and neither processor's scripts run on this site — you are sent to their own page and returned here afterwards. Whichever you use sends a payment confirmation directly.

Arrive from one of our own ads and the website sets a single first-party cookie, wombats_click. It holds the click reference the ad network put in the link (Google for a Google ad, Meta for a Facebook or Instagram ad), no identity and no browsing history, and it lasts 90 days. Only our own server can read it.

It has one job. If you came from a Google ad and go on to buy, we tell Google that the click became a purchase, so we can see which ad earned the sale. That is the whole of what we send. If you came from a Facebook or Instagram ad, the reference stays with us for our own count and nothing is sent to Meta. Arrive any other way and the site sets no cookies at all: our page counter is cookieless, and there are no third-party scripts and no third-party requests.

We don't sell your information. We don't share it with marketing partners. We don't use it to build a profile of you. We don't run a marketing mailing list, and there is no waitlist: the only emails you get from us are about your order, your support request or a security matter.

Order records (your name, delivery address, email and what you bought) are kept for as long as tax law requires us to keep business records — at least five years — and for as long as your warranty runs. Support correspondence is kept while we are helping you and deleted when it is no longer needed, or sooner if you ask. The relay keeps nothing. To have your customer record deleted, email support@wombatss.com from the address you bought with; we purge it within seven days, keeping only what tax law obliges us to keep.

The website uses standard web infrastructure for hosting, email and payments. The Shield appliance reaches out to fetch filter list updates, software bundle updates, and upstream DNS resolution. Where Follow-Me Filtering uses our relay (see below), the Shield also holds open an encrypted connection to it. None of those flows include anything about your internet use. We count update checks and downloads (the date and hour, the file and whether the request came from a Shield's nightly check or someone pressing a button) so we know how many units are keeping up to date. Each check also carries the Shield's software version, model and serial number, so we can spot an update that didn't install. You can switch the serial off on the Shield's Software Update page, and we delete serials after 90 days.

Follow-Me Filtering (Shield Vault) connects a child's phone back to the Shield in your own home. In most homes the phone reaches your Shield directly, and nothing passes through us at all. The same connection carries Back to Shield — your own phone or laptop reaching your Shield's dashboard and the files on its drive from away — on the same terms.

Some internet connections cannot accept incoming connections, including Starlink, mobile broadband, hotel Wi-Fi and a few providers. For those homes, your child's phone reaches your Shield through a WOMBATS relay server located in Australia (hosted with BinaryLane, Melbourne). The relay only passes along data that is already end-to-end encrypted between the phone and your own Shield, so WOMBATS cannot read your family's browsing. The relay can see only a phone's internet (IP) address and when it is connected, which we do not log or use for profiling. Your family's browsing history never leaves your own Shield.

We handle personal information in line with the Australian Privacy Principles. If you have a privacy question or want to access or correct the personal information we hold about you, contact support@wombatss.com. If you think we have mishandled your information, email the same address and we will reply within five business days. If you are not satisfied with our answer, you can contact the Office of the Australian Information Commissioner (oaic.gov.au).

We'll update this page if our practices change. The version you see is current as of the date below. We don't use opaque, undated “privacy updates” for material changes.

Last updated 3 October 2026.