Requirement status

The platform shall minimize child personal information to what is necessary for the service.

Acceptance: Enrollment does not collect unnecessary financial or demographic details.

Child data is a nickname, age band, avatar and optional interests — no birthdate, school or financial data.

The product shall support verifiable parental consent where required before collecting covered child personal information.

Acceptance: Consent status gates child activation.

Consent is recorded and gates activation (guardian attestation in a signed-in adult account); stronger verification methods are not built.

Parents shall be able to review, correct where appropriate, and request deletion of covered child information subject to applicable obligations.

Acceptance: Controls are documented and operational.

Guardians can review (export), close or delete child data in-product.

Child information shall not be sold or used for targeted advertising.

Acceptance: Privacy policy and product behavior align.

No advertising or data-sale code paths; stated in the trust center.

The platform shall maintain a clear retention policy and shall not keep child data indefinitely without a specific purpose.

Acceptance: Retention is purpose-linked and visible in privacy documentation.

Purpose-linked retention is enforced by applyRetention: closed profiles are deleted after a 30-day recovery window and learning records after 12 months of inactivity; runs are audited with counts only. Scheduled via /api/cron/retention or `pnpm db:retention`; privacy pages read the same policy constants. Tested.

The platform shall use privacy-preserving aggregate reporting for credit unions.

Acceptance: CU cannot browse child-level journals or raw reflections.

CU reporting is aggregate and privacy-preserving.

No public child profile, follower graph, or open messaging network shall be part of the core product.

Acceptance: Social exposure is minimized.

No public profiles, followers or open messaging.

The product shall prevent a child from entering personal contact information into open discussion spaces where technically and operationally feasible.

Acceptance: Cohort interactions use controlled modes.

No open discussion spaces exist; free-text answers warn against contact details.

The product shall include content safety policies for suicide/self-harm disclosures, abuse disclosures, financial abuse, and other high-risk situations encountered in live cohorts or support.

Acceptance: Facilitators and staff have escalation procedures; educational app does not attempt therapy.

Escalation guidance appears in facilitator materials and the trust center; case-management workflow not built.

The product shall distinguish financial education from counseling, therapy, financial advice, and regulated recommendations.

Acceptance: User-facing and facilitator language reflects boundaries.

UI copy consistently distinguishes education from advice, counseling and therapy.

The platform shall support content rights/licensing controls for facilitator-owned and third-party content.

Acceptance: Only permitted institutions/audiences receive licensed content.

Only items licensed to a tenant reach its families; rights metadata on every item.

Accessibility shall be treated as a product requirement across family, CU, facilitator, and creator surfaces.

Acceptance: Core flows are usable with assistive technologies and alternate media.

Labels, focus management, keyboard use, contrast (brand button text is computed to meet 4.5:1) and reduced motion across surfaces; not yet audited with assistive technology.

The product shall provide language/localization support starting with English-US and Spanish-US as a commercial requirement, with expansion possible.

Acceptance: CU can choose enabled languages; financial meaning remains US-contextual unless otherwise reviewed.

English (US) only; Spanish (US) versions are tracked per mission as planned.

The product shall support incident and content takedown procedures.

Acceptance: A harmful or incorrect mission can be unpublished quickly while preserving audit history.

Reviewers unpublish and quarantine instantly; history and audit log are preserved.

The product shall provide clear disclaimers that NCUA does not approve or certify vendor technology.

Acceptance: No misleading regulatory endorsement appears.

NCUA non-endorsement disclaimer appears across public, parent and CU surfaces.