Latch
Get Latch
Back to support

Encrypted DNS in Latch 2.0

Website rules, applied by Latch over an encrypted DNS connection.

What it protects

Latch checks domain lookups against your website rules. It does not inspect page contents or individual URLs. App blocking still uses Apple’s Screen Time permissions separately. Apps with their own DNS, cached answers, and other VPN or DNS configurations can affect coverage.

Setup and migration

  1. Turn on website protection in Latch and read the hosted DNS disclosure.
  2. With an active subscription and an internet connection, let Latch prepare and check your DNS configuration.
  3. Approve the system request. If Latch asks you to select its DNS configuration, open iOS Settings → General → VPN & Device Management → DNS and select Latch. Labels may vary by iOS version.
  4. Return to Latch and check the protection status. Latch only removes its old VPN configuration after iOS reports the new DNS setting enabled.

If setup fails, reopen Latch to retry and check the status before relying on protection.

Keep protection up to date

Open Latch regularly with an internet connection. The app renews subscription access and sends updated website rules and upcoming schedules. It also requests background refresh, but iOS decides when that runs. Access lasts no more than 23 hours without renewal; the schedule stored on the server covers up to six days. A valid schedule does not extend expired subscription access.

Expired access or rules can stop DNS lookups and make websites unavailable. If you cannot reconnect to renew, open the DNS section in iOS Settings and switch away from Latch to restore normal DNS, then reopen the app. Website filtering is inactive while Latch DNS is off. You can also turn website protection off from Latch when its session controls permit it.

What reaches the service

Hosted DNS sends domain queries and the website rules and schedule needed to filter them to Latch’s service, hosted on Cloudflare. Allowed queries are forwarded to Cloudflare’s DNS resolver. Network infrastructure can process connection information such as your IP address. Encryption protects the connection; it does not hide queries from the resolver processing them.

Latch sends signed App Store purchase information to verify access with Apple. Server records connect a configuration to that verified purchase and its expiry. Your guardian PIN, Screen Time app selections, and local reports are not part of the DNS configuration.

The implementation does not write individual DNS query history to its application database. Stored Worker invocation logs, traces, Logpush and Tail Worker exports are disabled in the reviewed DNS and Together deployments. Hosting providers still process network and service information; these settings do not establish that their infrastructure keeps no records.

Removal and retention

Turning protection off stops using the configuration but keeps it available for reuse. Account deletion in Latch also requests removal of the hosted configuration. Keep the app installed and retry if that step cannot finish; uninstalling alone does not send a deletion request.

Inactive server policies are scheduled for removal thirty days after both their access and policy validity have expired. Minimal deletion records remain to prevent an old configuration from being recreated by a delayed request. Cloudflare’s database recovery window can retain earlier copies for up to another thirty days after removal from active storage. Cancelling your App Store subscription is a separate action in Apple’s subscription settings.

Read the current Privacy Policy or contact app@latch.family with questions.