Child safety policy

1. Commitments #

1. Minimum age 18 for an account (default, pending Doc; Q21). Known under 13 accounts are deleted (Children's Online Privacy Protection Act of 1998, 15 U.S.C. § 6502; Federal Trade Commission, 2025, 16 C.F.R. § 312.2 and § 312.3, actual knowledge; counsel to confirm the deletion authority).
2. Parent managed child profiles on the Family plan only, created after verifiable parental consent, with no child sign-in in v1 (CO-18). Counsel to confirm the consent method and the 2025 rule amendments (Federal Trade Commission, 2025, 16 C.F.R. § 312.5).
3. Child profile defaults: no screen-watching memory, no calling, no browser agent, no connectors, no sharing outside the family, no analytics or telemetry, AI features limited and filtered, no advertising, no conditioning of participation on extra data (16 C.F.R. § 312.7).
4. Parents can review, export, and delete a child's information at any time (16 C.F.R. § 312.6), and we apply security and retention limits (§ 312.8, § 312.10).
5. No public discovery or direct messaging with strangers.

2. Child sexual abuse material (CSAM) procedure (counsel to approve every step) #

1. Detection and reports: user reports, automated classifiers on shared and generated media, and staff review. Hash matching with an approved industry list is an open question.
2. Access: only named, trained trust and safety staff, under the two-person rule, on a segregated workstation. No one else opens flagged files. Staff welfare support is provided.
3. Preservation: preserved evidence is encrypted under a platform trust and safety key (not the user's key), held for one year after the report as the law requires for reports under 18 U.S.C. § 2258A as amended by the REPORT Act (REPORT Act, 2024; counsel to confirm). Evidence is covered by a legal hold so that account deletion cannot destroy it.
4. Reporting: once we have actual knowledge of apparent violations, report to the National Center for Missing and Exploited Children CyberTipline as the statute requires. [COUNSEL TO CONFIRM: who files, timing, content of the report, and limits on what we may keep or send.] We do not tell the user in ways that would interfere with law enforcement.
5. Account action: immediate termination and block of the offending account and linked identifiers.
6. EU and UK duties for users there (Regulation (EU) 2022/2065, 2022; counsel to confirm).
7. Records: every action goes to the audit chain with opaque identifiers only.

3. Grooming and self harm signals #

AI conversations with a child profile use stricter safety classification. Self harm signals show crisis resources (988 in the US) and never produce an alert that discloses content to anyone without consent unless counsel confirms a duty. [COUNSEL AND CLINICAL ADVISOR TO CONFIRM]

4. Governance #

Owner: [NAME OR ROLE] (open question N6). Quarterly review. Annual rehearsal. Law enforcement contact: [LEGAL EMAIL].

Open questions for counsel #

1. Exact reporting duty, timing, and content, and what evidence we may keep or access.
2. Whether hash matching or classifier use creates extra duties or risks.
3. Parental consent method that satisfies the rule at acceptable friction.
4. Treatment of teens (13 to 17) if the minimum age is lowered later.
5. If users in the United Kingdom are admitted, whether the Children's Code applies to child profiles (Data Protection Act 2018, 2018; Information Commissioner's Office, n.d.).