How we keep it safe

No child login

The person who creates an account confirms they are 18 or over. A learner is a profile on that account: a first name, an avatar and an age band. A child is not asked for an email address or a password.

No way to contact a stranger

There is no chat, no comments, no sharing and no public profile. The database has no table for them. A learner screen cannot link to another website. That rule is a component the build checks, not a setting someone can switch off in a form.

Age bands stay separate

What a profile can open is chosen on the server from that profile's age band. A kids profile is not given the adult catalogue by adding a zone to the address bar. The age band column itself cannot be rewritten with the household login token.

The parent area is behind a PIN

Settings, and account deletion, sit behind a PIN on top of the login. Stepping into a learner profile clears that unlock. A child is not shown a price, a trial or a prompt to fetch a grown-up. No payment is taken anywhere in the product today.

Journals stay with the writer

A reflection journal, when it is used, is readable only by server code acting as that profile. The parent's login cannot read it. The data download from the parent area leaves journal text out for the same reason.

What this page is not claiming

Lessons in the repository are held until a named person reviews them. This page does not say they have already been signed off. Read-aloud is a setting on the profile, not a library of audio that is already published.

The privacy detail is in the privacy notice and the Children's Code page. Both still need a lawyer before launch, and a verifiable parental-consent step is not built yet.