What is true.
Everything written here is something we can point at in our own code. Where the truth was more complicated than a clean sentence, the complicated one is on the page. Where we could not point at anything, we have said nothing rather than said it kindly. If something here stops being true, it is this page that is wrong, and we would rather you told us.
Where a machine reads
Two checks read what your child writes. The first runs the moment they finish, and it is a short fixed list of phrases — language about hurting themselves, about being hurt at home or at school, about being alone for a long time. The second is a model, and it runs later, on its own schedule, away from your child’s screen.
The second check is not inside bodhi.kids, and this is the part we would rather you heard from us than found out. To run it, what your child wrote is sent out to a model built by another company, Anthropic, and read there. What travels is the writing and nothing else — no name, no class, nothing that says which child wrote it, and nothing about you. It is sent to ask one question: whether the words suggest a child needs a caring adult. The only thing the answer can do is open a note here for a person to read.
Neither of them can change anything your child sees. The gentle line that comes back at the end is chosen from sentences written in advance and stored with that day, and it is picked by counting how many days your child has practiced — not by reading a word of what they wrote.
When neither check finds anything, the only thing either of them writes down is that it ran — which check, on which evening’s practice, and how many tokens it took. Your child’s words are not in that record.
When one of them does find something, it opens a note for a person to read. A card appears on your dashboard, and an email goes to you. That email is one fixed sentence pointing you back to your dashboard — nothing your child wrote travels in it.
Who can read what your child writes
You can. The rule that lets you is written into the database itself, and it matches your child’s writing to the children on your account and to nothing else.
If a check raises a note, that one piece of writing — and only that one — becomes readable by two more people. Someone here, and a counsellor at your child’s school if the school has staffed one. The counsellor’s rule reaches only their own school, and only the flagged line.
A principal and a class teacher have no such rule. The list of rules on that table is short, and none of them names those roles.
There is a doorway you should know about anyway. A counsellor’s account is made by the principal, and the principal is shown its starting password once, on screen, to hand over. Until the counsellor signs in and changes it, that password is a way into the counsellor’s view. We would rather tell you that than give you a cleaner sentence.
The weekly letter and the observations on your dashboard are written by a part of the system that was never given permission to read a child’s words at all. Not switched off — never granted.
What the build refuses
Nothing in bodhi.kids can ask your phone for permission to send a notification. That is not a setting we left off — a check runs on every build and fails it if any part of the product so much as asks.
The practice does not end itself
It moves when your child moves it. Each part waits for them, and the last screen — the one where the day’s plant has grown — carries no timer that takes it away. They leave it when they are ready.
Who signs the days
A story arc cannot reach a child without a named child psychologist’s sign-off on file. The step that publishes an arc looks for that record and stops with an error when it is not there, and only an account with the psychologist’s role can write one.
If you leave
If you simply stop, nothing is deleted. Nothing removes a child’s writing because an account went quiet; the only path that erases it is the one you ask for.
If you ask us to close the account, you do that from your settings. Nothing is deleted at that moment. A request is queued and a waiting window opens — seven days, at present — and you can change your mind and cancel it yourself at any point inside it.
After the window, the removal is done by a hand, not by a clock. The step that erases the data cannot run before the window has passed, and it cannot run on its own at all: it needs a person here to sign in and start it. So the honest sentence is that it happens after the window, not on the stroke of the seventh day. If it has been longer than feels right to you, write to us and we will do it.
Some records stay behind afterwards, because the law or a child’s safety requires it. The privacy policy names which ones.