Safety & privacy centre
Plain English first, technical detail underneath. This is a prototype, so almost nothing is collected in the first place — the commitments describe how a real version would behave.
No open-ended AI chat for children
Children only tap pre-written, human-reviewed choices. There is no free-text or voice conversation with a model anywhere in the child flow. The scripted PlayLah Guide is adult-only.
No public profiles or social features
No usernames, friends, messaging, comments or sharing to anyone outside the room.
No ads, purchases or manipulation
No advertising, sponsorship, in-app purchases, loot boxes, streaks, countdowns, leaderboards, infinite scroll or push nudges to come back.
No child uploads
No photo, drawing, video or file upload. Nothing a child makes leaves the device.
No passive audio or video
The microphone and camera are never requested or used. Sound is represented as captions only, and “Talk Together” happens out loud in the room.
No precise location
No GPS, address or device-level location collection of any kind.
Minimal, non-identifying session data
Only age band, session length, goal, language, sensory settings and completed demo activities — held in this browser tab. Never a child name, birth date or photo.
Caregiver consent, default off
Consent is unchecked on every fresh tab. Child activities stay locked until an adult completes the gate and checks consent, and consent can be withdrawn at any time.
Deletion control
An adult can delete all demo data immediately, without giving a reason, and sees a confirmation.
Human safeguarding escalation
Concerns raised by an adult go to trained human safeguarding staff with an audit trail. No automated risk scoring or labelling of a child.
Technical panel
Expand any topic for the design detail a reviewer would ask about.
Purpose limitation
Data exists only to run the current co-play session: choose age-appropriate content, honour sensory settings and show the adult what was completed. No secondary use, profiling, model training or product analytics.
Data minimisation
No direct identifiers are collected at all. A production build would use a random session identifier with no link to a child’s name, birth date, class, device ID or photo, and would reject any field it does not strictly need.
Consent
Consent is explicit, unbundled, unchecked by default and separately recorded with scope, timestamp and policy version. Withdrawal is a single control and takes effect immediately, blocking new sessions.
Session-only state
In this prototype everything lives in the tab’s sessionStorage and in React memory. Closing the tab clears it. There is no cookie, no localStorage persistence, no server record and no cross-device sync.
Deletion
“Delete demo data” clears preferences, completed activities and consent, then visibly confirms. A production build would delete on request within a stated turnaround and confirm in writing.
Human escalation
Any concern is routed to named human safeguarding staff with an escalation path and defined response times. The system never classifies, scores or flags a child automatically.
Audit records
A production build would keep append-only records of content review decisions, consent events, deletion requests and escalations — about adults’ decisions and content, not about children’s behaviour.
Retention choice
Default retention is the session itself. Centres could opt into a short, stated retention window for observations only, with automatic expiry and no silent extension.
Incident response
A documented plan: contain, assess, notify affected caregivers and the regulator where required, remediate, and publish learnings. Contacts and timelines agreed before any pilot.
DPIA and PDPA-ready design considerations
A DPIA-style assessment would be completed and independently reviewed before any pilot with real children. This prototype reflects PDPA-ready design considerations; it is not certified, compliant or approved.
Emergency disclaimer
PlayLah Safe is an educational prototype. It is not a reporting tool, a helpline, a medical service or an emergency service. If a child may be at risk of harm, contact your local emergency number or child protection service immediately.
Consent, receipt and deletion
Privacy receipt
- Age band (non-identifying)
- 2-3
- Session length
- 5 minutes
- Learning goal
- kind-words
- Language preference
- en
- Sensory settings
- captions, largeTapTargets
- Demo activities completed
- none yet
Consent is not recorded. Child activities stay locked until an adult checks the box.
How a production version would be built
This prototype is static. If it were built for real use, these six pieces would carry the safety work.
Curated content library
Every activity is a versioned record written and signed off by named human reviewers before release. No generated-on-the-fly content reaches a child screen.
Deterministic age rules
Age band, session length and goal map to a fixed allow-list of lesson IDs. Selection is rule-based and reproducible, not model-driven.
Local / session-only state
Choices live in memory for the current session. A production build would keep pseudonymous session counters and no child-identifying profile.
Consent records
A caregiver consent record with timestamp, scope and version gates every session, and can be withdrawn at any time from the adult area.
Human moderation & escalation
Adult-raised concerns route to trained human safeguarding staff. No automated risk labels, scoring or emotion inference about a child.
Audit logs
Content changes, review approvals, consent events and deletion requests are append-only and reviewable, separate from any child content.