Independent consent per child

Every child has an independent consent record managed by the parent. No photo including the child is published without valid consent, and consent can be withdrawn at any time with immediate effect.

Full isolation between nurseries

Each nursery runs on its own database and subdomain. There is no shared access path between nurseries, and computer-vision matching never crosses nursery boundaries and excludes non-consenting children.

Short-lived media links

Child photos are stored in private storage and exposed only through short-lived URLs generated after an authorization check. No public permanent links exist for any child photo.