How does Fold'em know the block is on?

What the phone sends, and when

Fold'em does not trust its own memory of the block. It reads the phone again and reports what it found. The reading is taken at four moments: when the app comes to the foreground, when a background wake fires, when a silent push arrives, and the moment iOS tells the app that Screen Time permission changed in either direction.

The background wake is a standard iOS background refresh task, registered as app.foldem.heartbeat, and Fold'em asks for it no sooner than four hours after the last one. iOS decides whether to grant it, so it is opportunistic. Nothing depends on it arriving.

One reading carries a small, fixed set of facts: whether Screen Time is granted, whether the shield is still applied on the phone, whether anything had to be repaired to get it there, whether the app pick is still waiting to be done again, whether the subscription is active, and whether the web shield answered its own test. Blocked attempts ride the same send, as a count per hour and nothing more. No app name, no web address and no app token is in any of it, which is why your keyholder can never be shown one.

The phone sends the reading. It does not write the state. That distinction is the whole design: a phone that could write its own state could write a comfortable one.

The silent probe, and the tighter one for a circle

A phone that is never opened sends nothing, so the server goes and asks. A scheduled pass runs every four hours, finds phones that have been quiet for more than six hours, and sends each one a silent push. The push carries no alert and shows nothing; it wakes the app in the background just long enough to take a reading and send it.

If you have a keyholder, a second pass runs every 60 minutes and takes any phone in that group that has been quiet for more than two hours. It sends exactly the same silent push through exactly the same sender. The tighter window exists because there is somebody waiting to be told, and probing everyone that often would be wasteful.

A probe is a nudge, never enforcement. It cannot block anything, it cannot unblock anything, and it never writes the state. All it does is give the phone a chance to speak.

Sometimes the push comes back saying the phone's token is no longer registered, which is what iOS reports after an app is deleted. The server then reads the token again inside a transaction, and clears it only if it is still the one that just failed, so a phone that has already registered a fresh token wins. That is recorded and nothing else: a healthy phone can lose a push token for ordinary reasons, so losing one is never treated as protection coming off.

Silence, counted

The signal with no producer is the one that matters most. An hourly pass looks for phones whose last reading is older than the threshold, which is 24 hours, and marks them Dark. Your keyholder is told, in the softer of the two letters, that the phone has not confirmed protection since a given time and that this is most often a dead battery or airplane mode.

This is also what closes the one known gap. Force quitting Fold'em and then switching Screen Time off in iOS Settings produces no reading at all, because there is no app running to take one. Nothing is heard until the next launch, and the 24 hour rule is what turns that quiet into something your keyholder learns about instead of something nobody sees.

The phone is honest about the other direction too. When the app cannot reach the server, the safe on Home shows the word CHECKING, which the safe's own legend defines as the server being unreachable, so the face claims nothing at all.

What this does not do

It does not watch what you do. There is no browsing history in a reading, no list of apps, no amount of money and nothing you typed, so there is nothing for a page, a pass or an email to leak by accident.

It does not make the block hold. Reporting and enforcing are separate: the shield is applied by Screen Time on the phone, and the reading only describes it. A probe that never arrives, a reading that never sends, and a phone with no signal all leave the block exactly where it was.

It cannot prove the block is on right now. A reading is true for the moment it was taken, and the state your keyholder sees is as fresh as the last one that arrived. It also reaches only this iPhone: a second phone, a computer or a shop are outside all of it.