← All privacy impact assessments

PIA: A shared display in the house

Status: Built, for the wall as it runs today — a clock, the date, and your own home automation dashboard. This revision also sets out what we plan to add next: your group's tasks, calendar, meal plan, photos, chat and baby tracker, an assistant you can talk to, and simple people — called profiles — for family members who don't have a phone of their own. Most of that is not built yet; the race game and baby logging at the wall are described in "Games and babies at the wall" below as they are built. We are writing this assessment before we build the rest, as our register requires whenever a feature is likely to be used by children.

Amended 22 October 2026, before release. Kiosk and profile accounts are provisioned under narrowly authorised generated addresses. Turning a profile into an account changes an existing Auth user's email: while sign-up is closed, the destination email must be authorised, and after opening it need not be. Both phases refuse an address already in use, preserve the child's guardian boundary, and show the converted person who added them and how to leave. A converted person cannot use their old managed-profile membership to bypass the adult-month or guardian-link check.

Amended 30 October 2026: "Started cooking", a dinner estimate on Home, and "Dinner's ready". With Meal plan and cooking open, someone at the wall (or the planned cook on their own phone) can record that cooking has started and when dinner should be ready, and later say dinner's ready. Every member's Home shows the state, children included. "Dinner's ready" puts one fixed sentence of ours in the group's chat ("Dinner’s ready. Sent from the wall.") and sends one notification to the group's people: a wall now causes notifications, at most one per dinner and two a day. Nothing names who pressed; Home names only the cook the plan assigns. The state is kept for that evening only and deleted the next day. Assessed in HQ's security review of 30 October 2026 (conditions DR1–DR17), approved by the founder the same day.

Written: 1 October 2026 · Last revised: 30 October 2026 (cooking state and "Dinner's ready") · 22 October 2026 (staged sign-up, before release) · 14 October 2026 Nothing here is legal advice. Children's Code citations are to the exposure draft; section numbers may move on registration (due 10 December 2026).

Amended 14 October 2026: a wall stays current-key only. From the app update released after 14 October 2026, members' phones can send a group's earlier keys to every person's phone, so members can read the group's earlier messages and photos (the key architecture assessment, §3.7). A wall is a screen, not a member: it never receives a group's earlier keys and never sends them. Our database refuses a copy for any phone that isn't a person's, and the wall's own app never sends one. So the wall's chat and photo areas show only what was encrypted under the key it was paired with, or later; anything older stays locked at the wall, as it does today.

1. Purpose and scope

A group can turn a spare tablet — typically an iPad on the hall table or in the kitchen — into a wall screen for the house. Today that means a clock and the day when nobody is near it, and, when someone touches it, the group's own home automation dashboard one swipe away.

What we plan to add. The wall becomes somewhere a group's tasks, calendar, meal plan, chat, photos and baby tracker can be seen and acted on by anyone standing in front of it, with no sign-in — and somewhere a person can talk to the assistant out loud, the way they'd ask a person in the room. Two new kinds of group member make this possible: a single shared member, "Kiosk", whose name records things done at the wall when nobody can be asked who did them; and "profiles" — members who stand in for a person without a phone or an account of their own, a young child, an older relative, or anyone the group wants to include without asking them to sign in.

This document covers the wall itself — the display, the shared member and profiles, the code used to open the wall's settings, which of the group's records it may show, and how what happens there is credited to the right person. It does not re-derive the privacy design of tasks, chat, the calendar, the meal plan, photos or the baby tracker on their own terms — those are each assessed elsewhere. This document is about what changes when a shared, unlocked screen is the thing asking for them.

What the wall can show, once a group turns each part on:

On the wall Default What "Open" means What needs the PIN
Today's plan, calendar and tasks Always available See things, tick them off and say who did it, add a task or event —
Meal plan and cooking Open See the week, recipes, timers, the shopping list; start cooking, a dinner estimate shown to members, and a "Dinner's ready" notice to the group (amended 30 October 2026) Changing the plan
Games Open Play, pick who you are Starting or ending a round, prizes
Baby tracker Open Log something, see today's entries Notes, older days, growth, editing a past entry
Group chat Open Read and send a message, shown as sent by "Kiosk" —
Photos Open See the wall of photos and albums Hiding a photo from the wall
Talking to the assistant Open Have a conversation —
Forwarded email ("Mail Sifter") Needs the PIN — Reading forwarded emails, and asking GroupApp about one. Turning an email into tasks or events, and claiming its cards, happens on a person's phone; our database refuses the wall those steps
Home automation dashboard Open Swipe across to it Changing the connection

A group can change any of these defaults from the wall's own settings, behind the PIN, or from any member's phone. What's set for each area is shown plainly on the wall's settings screen at any time. How the wall rests — showing the day, a plain clock, or a "guest" mode showing only the time and date — and when it dims overnight are that tablet's own settings, kept on the tablet: anyone at the wall can choose them, and guest mode, once on, needs the PIN to turn off.

Permitted at every one of the group's privacy settings, including the one that keeps everything on members' own phones (§5, §8). A small number of things always happen on a phone rather than at the wall — voting, saying who a child's guardian is, adding or removing people, changing the group's privacy setting, inviting someone, and changing the wall's own PIN. The wall shows a code that opens the right screen on a phone for these.

2. Data involved

Kind Whose Children's? Sensitive? Free text?
groups.shared_display_enabled — whether this group allows a display The group's No No No
display_grants.label — the display's name, from the device ("Hall iPad") The group's No No Yes — a device name a member chose
display_grants.capabilities — what the display may show without the PIN The group's No No No (closed list)
display_grants.ha_internal_url, ha_external_url — the home automation addresses The group's No Can reveal a home network address or a remote-access address Yes — typed addresses
display_grants.created_by, created_at, revoked_at The member who set it up Possibly No No
display_grants.session_id — which signed-in session this display's permission is bound to The display's No No No
display_grants.pin_capabilities, unlocked_until — which extra parts the PIN can temporarily open, and until when The group's No No No
display_pins — a salted, hashed PIN, kept in a table the display itself cannot read; display_pin_attempts — wrong-try records for the five-in-fifteen-minutes pause The group's No No No
The home automation access token The group's home automation account No Yes — it controls whatever that account can control Scanned from the QR code the home automation app shows, or pasted; the camera image is not kept
managed_members — marks the shared "Kiosk" member and every profile, and who set each one up The group's Yes, for a child's profile No No
The shared "Kiosk" member — a name, no email address, no password, shared by every wall the group has The group's No No No
A profile — a name, a colour, and for a child a birth month and a guardian link The person the profile stands in for Yes, for a child No No
profile_reminder_delegates — which one adult has agreed to receive a profile's reminders as a push notification; shown to the group, so everyone can see whose phone a profile's reminders reach The adult's own choice No No No
task_completions.recorded_by_display — which wall recorded a job as done, alongside who it was credited to The group's Possibly No No
A race game row written at the wall — a power-up spent for the person whose face was picked, or a race started or ended with the PIN — recording the person it is about and that the wall wrote it The group's Possibly No No
Everything the wall can then show — today's tasks and calendar, the meal plan and shopping list, photos, group chat, today's baby logs, and a conversation with the assistant The group's Yes, wherever it's about a child Baby-tracker entries can be health-related Yes — chat, baby notes and the assistant conversation are free text
The wall's own copy of the group's calendar, kept in step with the tablet's own calendars The group's, and the tablet's own calendar accounts Possibly Possibly Yes — assessed separately (see "Keeping the group's calendar and your phone's calendar in step")
Cooking timers — a name someone gave each one ("Rice") and when it ends Whoever is cooking at the wall No No Yes — the name is typed or spoken at the wall
What is said to the wall while "hands-free" cooking is switched on Whoever is in the room Possibly No Yes — speech, turned into words on the tablet and kept only long enough to match "next", "back" or a timer

Not collected, and could have been: the home automation token and the exit PIN never reach our servers — the token is kept only on the display, in the device's secure storage; the PIN is stored only as a salted hash, in a table the display itself has no permission to read. No usage of the wall is otherwise recorded — nothing counts touches, who stood at it, or how long the dashboard was open.

Strictly necessary: the shared member and profile rows exist so that work done at the wall can be credited to the right person, or to nobody in particular, rather than invented; the grant row lets any adult member see which devices are walls and stop one from their own phone; the addresses are needed to open the home automation dashboard; the token is needed so the wall never shows a sign-in form a passer-by would have to fill in; a profile's birth month and guardian link are the same ones the app already asks for any child.

3. Flows and locations

Data Device Our database Anywhere else
The group's switch, the grant row, the PIN's hash, the session binding, and which areas are open Read and written by members' phones and by the display Stored, readable by the group's active members —
Home automation token, the PIN itself, which display this device is Only on the display, in secure storage Never —
How the wall rests and dims, how many days its calendar shows, whether its setup has run, and when it last checked in Only on the display, in secure storage, removed when the wall is stopped Never —
The home automation page Loaded by the display from the group's own home automation server Never The group's own home automation server, or its remote-access service
The shared member and profile rows, a profile's birth month and guardian link Written from a member's phone Stored, readable by the group's active members —
Today's tasks, calendar, meal plan, photos, chat, and baby logs shown on the wall Read and written by the display, subject to the areas above Stored exactly as it is for the same information shown on a phone —
A conversation with the assistant at the wall Typed or spoken at the display Stored like any assistant conversation, under the wall's own weekly allowance and the group's, never any one person's; deleted when someone at the wall chooses Start over Reaches a language model the same way a conversation from a phone does, following the group's own choice of how far its words may travel — see where a group's words are processed and a privacy setting for every group
Speaking to Ask at the wall The tablet's microphone, only after someone at the wall taps its microphone, and only while Ask is open and on screen; it stops when Ask closes, relocks, the wall rests or the app leaves the screen. The tablet's own transcription when it has it, otherwise Apple's or Google's speech service under their terms, and the wall says which Never the audio. The words are sent to the assistant when the person pauses or presses Stop, exactly as if they had typed and sent them. Words typed before the microphone was tapped are never sent by it unless the session also heard speech The words follow the same path as a typed conversation at the wall (the row above)
The wall's own calendar, kept in step with the group's Read continuously while the wall is in use, because the wall stays open Written as ordinary group events The tablet's own calendar accounts — see keeping the group's calendar and your phone's calendar in step
A profile's reminder, shown on the wall Computed and shown locally, the same as any reminder The due time is read from the group's own records If one adult has agreed, a push naming the person (never what the reminder is about) reaches that adult's own phone
A code shown on the wall, for something that needs a person Shown on the wall; read by an adult's own phone camera Never stored Only which screen to open, which group, and the one thing it is about. It carries no sign-in: the phone opens the screen as the adult already signed in on it, and checks them again
Cooking timers Kept only on the display, in its own storage, until the timer is cleared or the wall is signed out; the tablet's own notification system rings when one ends Never —
Tonight's cooking state: when cooking started, the estimated dinner time, and when "Dinner's ready" was sent Recorded at the wall or on the planned cook's phone, and shown on every member's Home and on the wall while Meal plan and cooking is open One row per dinner per evening, readable by the group's active members (children included) and by the wall while that area is open; never by a profile. It holds no dish, no name and nothing about who pressed, only which wall recorded it when a wall did. Deleted once its day has passed in the group's time zone, at the latest an hour into the next day, and with the group or the dinner. Not read by the assistant, the home brief, allocation, usage counts, tracing or analytics —
"Dinner's ready" in the group's chat Sent from the wall or the planned cook's phone, after a five-second chance to cancel; can be taken back for two minutes One fixed sentence of ours in the group's chat, written by our database and kept like any chat notice. At most one per dinner and two a day One notification to the group's people with a phone, children included, through Expo, Apple and Google: the group's name and the same fixed sentence, or "Something changed in" the group for a Device-only group. Never to the wall, a profile, anyone who muted the group, or the phone that pressed it; it expires after two hours. A notification already shown can't be recalled
Hands-free cooking The tablet's microphone, only while a recipe is open, the wall is in front and someone has switched it on; speech is recognised on the tablet itself, and the wall refuses to switch hands-free on if the tablet cannot do that Never — the audio and the words are not sent or kept —

Nothing reaches a model except as part of a conversation a person started at the wall, and that conversation follows the same rules as one on a phone. Nothing about who stood at the wall, or when, is logged by us beyond the ordinary database writes above.

4. Legal basis and consents

The group's switch is a consent-class group setting (shared_display in the consent ledger): turning it on lets a device show the group's information to whoever is standing in front of it, with no sign-in. Only a group owner or admin can change it, our database refuses anyone else, the change is announced in the group's chat, and the consent expires after twelve months — at which point the switch turns itself off and the settings screen says why. Turning it off, by hand or by expiry, does not stop a display that already exists; each display is stopped on its own, from any member's phone.

Setting up a display, choosing what it may show, and entering home automation details are acts on that one device by an adult member. They are offered only to a confirmed adult account; an account whose age has not been confirmed yet sees a sentence rather than the controls.

No new consent purpose is planned. Which of the group's records a particular display may then show is a setting any admin can change, not a second consent — see §5 and §8 for why we chose useful defaults and recorded the trade as a risk we accept rather than asking for it to be agreed to separately.

The PIN identifies nobody. It is a shared code the wall checks against our database; anything it unlocks is recorded as done "at the wall", never attributed to a particular person. It is never offered as the way to vote, say who a child's guardian is, add, change or remove a person, change the group's privacy setting, create an invitation, or change the wall's own PIN — those always happen on a phone, signed in as the person actually doing them.

A profile becoming an account. When a profile grows up, or simply wants their own account, a guardian (for a child) or any adult (for an adult's profile) can turn it into one from a phone, using the person's email. While sign-up is closed this goes through the same check every new account goes through — the address has to be on the app's invite list (for a child, the guardian adds it the same way they would invite any child, and a child under 13 can't be given an account); after the founder opens sign-up it needn't be (amended 22 October 2026, before release). In both phases the step is refused outright if that address already has an account, so two accounts are never merged, and the conversion itself writes no new guardian entry: the profile already carries its guardian link and month. At their first sign-in the person is shown which group they were added to and by whom, and can leave; a converted person with no adult birth month or guardian link can't use the group until they give one. The person then signs in with their own one-time code. Everything the profile ever did — a task completed, a point earned, a guardian link — stays with the same underlying person once this happens.

No new fixed retention period is planned. Everything described here follows the keeping period already in place for that kind of information elsewhere in a group's records — a task, a chat message, a baby log, and so on. The wall doesn't keep anything for longer, or shorter, because it was entered there.

5. Risks and mitigations

Risk Who is harmed Mitigation Structural or conventional? Residual
A visitor in the house sees the group's open tasks, calendar, meal plan, photos, today's chat and today's baby logs, with no sign-in, and who each event is for, on the resting screen too, without a touch Every member, especially a child named in a task or a baby being logged Each area can be set to need the PIN or turned off, from the wall itself or any phone; what's currently set is shown plainly on the wall's settings. Older baby history always needs the PIN even when today's logs are open. Who each event is for at rest: Clock only or Guest mode, which someone has to switch on Structural for an area set to PIN or Off — our database refuses the wall both the records and the stored files (photos, forwarded-email attachments, baby photos), and the group list shows it no chat preview; conventional for which area defaults to Open, and for splitting today from older baby history We chose useful defaults over private-by-default ones, with an easy switch; see §8
A child talks to the assistant at the wall with nobody checking their age The child Supervision by presence in a shared part of the house; Ask can be set to PIN or Off, and what it can reach follows the wall's other areas Conventional — an owner choice — that Ask is open by default and that nobody's age is checked; structural that our server refuses Ask set to PIN or Off, and offers it nothing outside the open areas Accepted, recorded separately as a named decision; see §8
The wrong person is credited for a job ticked off at the wall Whoever is wrongly credited, and whoever actually did the work The wall asks who did it whenever more than one person could have; an easy Undo for two minutes, and for anything done that day; credit can be moved from a phone afterwards Conventional for the prompt and the window; structural that our database refuses a credit recorded for the wrong group or the wrong day Tapping a face says who did it; it doesn't prove it — a child could tap an adult's picture, or the other way round
A profile — a person who can never sign in — has what they did recorded with no account of their own to have agreed to anything from The profile A profile is set up from a phone by an adult already in the group (a guardian, for a child); it can never approve anything, give a consent, be a guardian, or join another group; it's removed from a phone, with each kind of its information handled on its own terms Structural — our database refuses a profile every one of those abilities A profile's day-to-day activity (a job done, a baby log) is recorded the same way a signed-in member's is, with no separate step of its own to agree, because it has no account to agree from
Turning a profile into an account creates two accounts for the same person, hands an account to an address nobody invited, or bypasses the adult-month check The person; the group (Amended 22 October 2026, before release.) Turning a profile into an account changes an existing Auth user's email: while sign-up is closed, the destination email must be authorised, and after opening it need not be. Both phases refuse an address already in use, preserve the child's guardian boundary, and show the converted person who added them and how to leave. A converted person cannot use their old managed-profile membership to bypass the adult-month or guardian-link check Structural After opening, an address typed by mistake gives its owner an account in that group until they sign in and leave
A reminder set for a profile shows on a screen anyone nearby can see The profile, and whoever the reminder is about Said plainly when the reminder is set; it can also go, as a push naming only the person, to one adult who has agreed on their own phone to receive it Conventional for the wording; structural that nobody receives the push without agreeing themselves A reminder on a shared screen is less private than one only its owner can see — accepted, because a profile has no phone of their own to show it on instead
A group that chose to keep everything on members' own phones still has a wall that holds the group's key, so anyone standing at it sees whatever its areas allow The group Said plainly as a disclosure when such a group sets up a wall Conventional — the disclosure; the privacy setting itself is unaffected Accepted, and named at setup
A PIN typed on a shared screen is watched by whoever happens to be nearby The group Said plainly in the settings; the PIN can be reset or the display stopped entirely from any phone; five wrong tries pause it for fifteen minutes Conventional Accepted (carried over from before)
Stopping a wall — replacing the tablet, or turning it off — is read as a reason to delete everything it ever sent to the group's chat The group One shared member exists for a group's wall or walls and is never removed just because one tablet stops being the wall; each tablet has its own separate permission, and only that permission is removed when a wall is stopped. Deleting the shared member's own history is a separate, clearly warned step Structural — the permission and the member are different things, and "stop" removes only the first None
A wall that has just been stopped still holds a sign-in for a short while The group Every request the wall makes for the group's records, files or chat is checked against its permission, so stopping it cuts those off at once; its sign-in is also ended when it is stopped Structural for the records, files and chat; conventional for the rest Until the sign-in runs out — at most an hour — a stopped wall can still read the names of the group's members and the group's reminders. Accepted: neither is in an area a household can switch off, and both were already on show at the wall
An older copy of the app, still installed somewhere, counts a profile or the shared member as a full person in a vote, or could let someone create one before every phone understands the difference The group Creating a profile or a wall is refused until the app's minimum version is raised. A copy too old to check that minimum can still vote the old way, but our server keeps only that person's own vote and counts only people before it records a plan as agreed — never what the phone says Structural for the record; conventional for what an old copy shows An old copy decides on its own phone whether everyone agreed, so it may set the plan up there while our record still says it is waiting; the next agreeing vote from an up-to-date phone then sets it up again. Updating the app ends this
Somebody at the wall taps another person's face and spends a power-up they were holding in the race game The person whose power-up it was Picking a face is described as taking the person's word for it; the row records that it was done at the wall, and the race's history says so. Only a "double points" power-up can be used at the wall; a paper dart is thrown only from a phone Conventional that a face is the right person; structural that the wall can spend only for a person or profile of its own group who is holding one, only while Games is open on that wall and its permission is live Accepted — the same light touch as crediting a job at the wall
A visitor starts, ends or changes the prizes of the group's race The group These need the PIN, and our database checks the PIN window itself rather than trusting the wall's screen Structural The ordinary PIN risk above
Forwarded email ("Mail Sifter") is reachable from a shared screen The group, and whoever sent the email This is the one area that needs the PIN by default Conventional for the default; structural that a PIN area is enforced on our server None beyond the ordinary PIN risk above

6. Structural versus conventional

Structural: stopping a display's permission takes effect immediately for the group's records, stored files and chat, including for a sign-in that is technically still valid (the names of members and the group's reminders stay readable until that sign-in runs out, at most an hour — see §5); a profile can never sign in; the shared member and any profile can never approve something, give a consent, be a guardian, become an admin, or join another group; an area set to Off or needing the PIN for chat, photos, forwarded email or the baby tracker is refused by our database before anything is handed over — the records, their stored files, and the chat preview in the group list alike; the PIN is checked on our server, never on the device; the wall can change which areas are open, and its home automation addresses, only while it is unlocked with the PIN, and never by writing its own permission directly; a job recorded at the wall can only be credited to a person or profile in that wall's own group, never to the wall itself, and the wall can only undo it or move the credit on the day it happened (afterwards, from a phone); the home automation token and the PIN have no column anywhere our database that a client can read. In the race game, the wall writes nothing directly: it can spend a power-up only for a person or profile of its own group who is holding one, only while Games is open on it, and it can start or end a race or change the prizes only inside the PIN window — each checked by our database. What the assistant can reach at the wall follows the same areas: on every request our server reads the wall's open areas from our database, refuses the conversation itself unless Ask is open, offers the assistant only the actions those areas allow, and never offers it anything that only a person can do — voting, inviting, changing people, roles or the group's settings, or answering for someone.

Conventional, test-pinned: hiding an earlier answer from the assistant again once an area it used relocks (each answer records which areas it used; the wall's screen does the hiding); showing today's baby logs while older history still needs the PIN (with the baby tracker open on a wall, our database would let the wall read older entries — it is the wall's own screen that shows only today, and it shows notes, earlier days, growth and editing only behind the PIN); that picking a face at the wall is the person it claims to be; Meals and Games being set to Off; the "guest" clock-only mode; what the wall draws when nobody is near it; the display trusting only home automation addresses it saved itself; the tool and its setup screens being withheld from a child account and waiting for a confirmed adult.

Conventional only: using a non-admin home automation account for the token; using the device's own screen-lock feature on the display.

Games and babies at the wall

The race game ("Taskrun"). The wall shows the group's race while one is running, one lane per person or profile (never the wall itself), each showing that person's next job. Someone standing there taps their own face to use a power-up they are holding; only "double points for an hour" can be used at the wall. The row records the person it is about and that the wall wrote it, and the race's history on a phone says "Recorded at the wall." Starting or ending a race, and changing the prizes, need the PIN, which our database checks. The race's named positions are part of a game the group chose to switch on; nothing new on the wall reports how anybody else responded to anything they posted, counts who played, or ranks people outside that game. When a job ticked off at the wall carries somebody past a box in the race, the wall says so on its race screen ("A box for Leo") — the person was standing there — and nothing about it is posted into the wall's conversation with the assistant.

The baby tracker. The wall logs with the same cards and the same records a phone uses, recorded by the wall's own account and shown as "At the wall". With the tracker open on the wall, anybody there can log and see today's entries; notes, earlier days, growth and changing a past entry need the PIN; changing a past entry opens the tracker's own edit screen on top of the wall, from which no other part of the app can be reached. Today versus earlier is the wall's screen's choice: our database refuses the tracker entirely to a wall where it is switched off or locked, but where it is open it would let the wall read an earlier entry. The wall does not show one without the PIN. Health wording is the tracker's own — no verdicts, and the same advice to talk to a professional wherever the tracker shows it.

7. Best interests of the child

Children are part of the group, and this revision brings far more of a child's information onto a shared screen than before: tasks they're named in, calendar events, baby logs if they're being cared for, and a conversation anyone — including them — can have with the assistant.

What this gives a child. A way to take part without needing a phone or an account of their own — a profile can be set up for a young child, so their baby logs, task credit and points stay with them from the start, carried over automatically if they later get an account. A child old enough to use the wall themselves can see the plan for the day, tick off a job, log something for a younger sibling, or ask the assistant a question, the same as anyone else standing there.

What it costs. Under the defaults, a child's own activity — a task, a baby log, a chat message — can be seen by any visitor standing at the wall, not only the group. So can who each event is for, on the resting screen too, without a touch: "Swimming · Alex · for Mia" with its time, never its place (see Who an event is for). Clock only and Guest mode show no events, so they show none of it. A child's reminders, if they have a profile, show on a shared screen. A child using the assistant at the wall is not separately checked by our server the way a child signed in on their own phone is; supervision comes from being in a shared part of the house, not from anything the app verifies.

The safer design, and why we didn't choose it. We considered locking every one of these areas behind the PIN by default. We chose not to, because that would take away most of what makes a shared wall useful, and we think a device already standing in a shared part of a family's own house is supervised by the people in that house, the same as anything else happening there. Every one of these defaults can still be changed by any admin, from the wall or from a phone.

The guardian rule is unchanged. A child's profile can only exist linked to an active guardian in the group, the same rule that applies to a child's account; removing the last guardian for a child who still has a profile is refused the same way.

What a child is told. The wall doesn't ask who is using it, so it has nothing specific to tell a child standing there beyond what's already shown on screen — which areas are open, and which need the PIN. A profile is set up and removed from a phone by an adult, with the same explanation given for any child's account.

8. Residual risk we accept

9. Review trigger

10. Checklist against exposure draft s 38(2)

s 38(2) Requires Answered in
(a) nature, scope, context, flow and purposes §§1–3
(b) why collection of children's personal information is strictly necessary §2
(c) lawful and fair means §4
(d) best interests of the child §7
(e) how the entity complies with the Code and the Act §§4, 6
(f) risk of harm to children §5

11. Sources