Early access —not a medical, clinical, or emergency tool. For emergencies, call your doctor or 911. Learn more →
Security
Private by physics, not by policy.
Most apps promise not to look at your data. SonSpeak is designed so there is nothing to look at. The promise, word for word:
“Zero remotely readable identifying child content.”
What lives on your device
Everything your child or family creates lives encrypted on your device: boards, tile photos, voice recordings, button-press history, your child's name and settings. It is designed never to be readable by anyone else — including us.
The child's tablet runs Board Only mode: tiles and nothing else. The child's screen has zero AI, by architecture — there is no AI surface on that device to secure, because none exists.
Exactly five remote services exist
Not “a cloud.” Five small, named services — and none of them can read a child's name, photo, voice, board, or history.
- 1
Account & consent
The adult's identity only — your email, your password (hashed), your consent records. Never the child's.
- 2
Credit ledger
Numbers. How many credits your account holds and spends — no content, by design.
- 3
Helper broker
Caregiver-approved, sanitized, generic briefs in transit to outside AI helpers. It retains nothing.
- 4
Encrypted relay
Ciphertext it cannot read, passing suggestions between you and professionals you invited.
- 5
Release manifest
Plain app configuration — version numbers and settings. No family data at all.
The server-amnesia test
Wipe every server we run, and no family loses their data — boards, photos, and voices are still on your device, untouched.
The sole exception, stated honestly: professional suggestions still in flight on the relay — undelivered encrypted messages held up to 72 hours — would be lost and would need to be re-sent. That's the entire blast radius.
The unconditional line
Custom text about your child never leaves the device. Not to outside AI helpers, not with parental consent on file — never. When outside AI helpers are used, they receive only caregiver-approved briefs drawn from a closed, generic vocabulary; your custom words serve your device alone.
What we deliberately don't run
- No advertising SDKs, ad pixels, or remarketing tags.
- No session-recording or screen-replay tools.
- No third-party support widgets that can see your screen — support is email only.
- No fonts or assets fetched from tracking CDNs — assets are served first-party.
- Errors write to a local log that leaves the device only by the caregiver's own hand.
What we don't claim
We hold no security certifications and we won't pretend otherwise — no audit stamp appears on this page because none has been earned yet. SonSpeak is designed for the standards children's-privacy law expects; we do not claim legal compliance that no lawyer has signed.
SonSpeak is in early access. If you find a security problem, we genuinely want to know: privacy@sonspeak.com reaches the founder directly.