Transparency · privacy · rights

Privacy, safety & rights

The CHILD Initiative controls CHILD’s original architecture, methodology and workflows, subject to third-party rights. Technology suppliers do not own CHILD by providing a service.

Ownership and third-party rights →

Contributor origin and participation geography

New public or private inputs request a self-reported country, region and district where available. You can withhold this for safety. District information is restricted to the author and authorised administrators; only a separately consented country enters the public participation map, after publication review. Existing private country preferences are never repurposed for that map. Knowledge relevance and contributor origin are distinct. No device tracking or precise address is required.

Origin is contextual information, not proof of identity, expertise, religion or belief. CHILD must not infer a worldview or assign credibility from someone’s country. Cultural interpretations, values and possible biases require explicit attribution and scrutiny, not stereotypes. Automated cultural-bias adjudication has not been validated in this beta.

Report excerpts, ratings and partnerships

With separate permission, AI report reading retains short matched quotations, page or paragraph references and summaries privately. The full uploaded report is not stored by CHILD. A quoted point becomes public only through a reviewed contribution that references it. Traceability does not establish the report’s authenticity or validity.

Stars describe community usefulness, not factual probability. Rating comments follow contribution sign-in, origin, moderation and provenance rules; authors cannot rate their own inputs. Attributed administrator appraisals remain distinct from popularity.

Partnership briefs are private unless their organiser requests public review. Expressions of interest are shared with the organiser and, if accepted, with accepted consortium members. Account emails are not exposed. Organisations and authority are self-reported; a working roster is not a legal or accredited consortium.

Account access and email

Supabase manages account authentication and password handling. Resend delivers account verification and recovery emails. Your Situation is not included in those emails. These providers process the account data necessary to deliver their services.

AI and hosting

OpenAI provides model services used for requested AI analysis. Cloudflare provides runtime and database infrastructure for this independent beta. A ChatGPT account is not required to use CHILD. AI output is not itself evidence. Requests for analysis require permission and are subject to usage limits.

Administrator controls and online counts

Authorised CHILD administrators can see verified account emails, account permissions, usage reservations and optional country totals. They cannot read browser-local private Situations through the administrator dashboard. Access changes are recorded in an audit trail. AI requests require an owner-approved budget and are subject to administrator pause, account controls and usage limits.

Online counting is optional and off until you choose it on your account page. Only a short-lived hashed account signal is sent while CHILD is visible; no page path, conversation, precise location or IP address is stored in the presence table. Signals expire after two minutes, are removed during later heartbeats or withdrawal, and no activity history is kept. The private administrator sees only the aggregate active count. Existing local content cannot be remotely recalled by changing access.

Optional version announcements

Registered members can opt in to occasional CHILD updates at their verified account email, and withdraw from the account page. The default is not subscribed. Only authorised CHILD administrators can export opted-in contacts with consent dates. Saving the preference sends no email; bulk announcements are not yet connected. Security emails remain separate. CHILD cannot read WhatsApp recipients, private messages or contacts through its sharing link.

Voluntary referral attribution

On joining or from the account page, a signed-in member may choose to name who introduced them to CHILD. This is optional, is not inferred from WhatsApp, and is visible only to that member and authorised CHILD administrators alongside their account. It is a member report, not a verified relationship or rewarded referral. The member can correct or remove it at any time. The inviter is not notified; no referral identity is published. Do not include private contact details or child-identifying information.

Living Pulse contributions

Browsing the Pulse and synthetic map test is public. Adding a contribution, response or revision requires a verified CHILD account. Each record includes the contributor’s self-reported role and relevant experience; these are not verified credentials. Real contributions remain private pending administrator review, while synthetic tests are explicitly labelled and kept separate from real intelligence. Publication review is not verification of truth.

Contributors select the country and, optionally, region and district where the reported situation happened. CHILD does not request device location. The server checks these selections against public geographic directories and uses an approximate administrative-area anchor for the map; this is reported context, not verified presence or a household position. District filtering uses public boundary geometry and may not reflect recent administrative changes. Leave smaller areas unspecified if unsafe. Legacy contributions retain their original coarse-area metadata. Revisions and independent responses are preserved separately; contributors cannot erase another person’s records. Agreement counts are not evidence-strength or confidence scores. A contributor-confirmed first-sentence preview is not an AI synthesis.

Original contributors cannot rate their own contribution. They may add details or withdraw the thread from public view. Withdrawal hides its pin and discussion but retains a restricted provenance record, subject to applicable rights and deletion requests; it does not authorise automatic AI training or unrestricted reuse. Pending responses can be read privately by their author, the original contributor and administrators. Responses to your contributions are available in My contributions & updates. When the sender is connected, authors can opt in to neutral email alerts when another member submits a challenge or addition, including before public review and stop alerts on the contribution page. Resend receives the verified email address and a neutral update link, not the contribution text or location. Sender credentials are encrypted on the server; only authorised administrators can configure delivery. Alerts are limited to 100 per day across the beta, with pending delivery visible to administrators. No paid AI request is made by the Pulse form. Older browser-cookie records remain in legacy storage but cookie-based editing and deletion are disabled.

Public research discovery

For supported published topics, Research watch retrieves bibliographic metadata from Europe PMC using controlled topic keywords only. Contribution wording, identities and locations are not sent. References are stored in a shared-topic register, with publication and discovery dates, and remain unassessed—not automatically validated or clinical recommendations. Checks run at most daily when a topic is opened, with a global 20-topic daily limit, not continuous unattended monitoring. This path makes no paid AI call. External materials retain third-party rights.

Your information

Signing in does not automatically upload this browser’s private drafts. Browser-local history is not encrypted account storage and may be accessible to others using the same browser profile. Do not enter identifying or sensitive information in the beta.

Ownership and third-party rights · Privacy and limitations