Status: draft. Not yet reviewed by a child-protection specialist or by the partner organisation. Field activity does not begin until it is signed off by both.
1. Status and scope
This policy binds coordinators, engineers, content reviewers and partner staff alike. It applies to every device, every session and every adult who comes into contact with a child through this project.
Where this policy and local law differ, the stricter one applies. Where it conflicts with a partner's own safeguarding policy, the partner's policy wins.
2. Device rules
- Devices belong to the project or the partner. Phase one uses a shared hub with a pass-around microphone: no device is assigned to any individual child. If handheld units are added later, they are numbered, kept at the centre and counted daily. Nothing is taken home.
- The microphone is the only item children handle directly. It is the coordinator's job to wipe it daily and to keep it within the centre.
- Use only during opening hours and only while a coordinator is present in the room.
- Each unit is numbered and signed in and out. A lost device is reported within 24 hours and disabled remotely.
- Caps: 10 minutes per session, 40 minutes per child per day, enforced on the device.
- No cameras. No personal accounts. No pairing with a child's own phone or account.
3. Content safety
- Two layers: a topic whitelist and sensitive-term filtering. Whitelist entries are added weekly from real questions, never opened to free conversation.
- Topics involving self-harm, abuse, sexual content or violence end the session immediately, return a fixed phrase, and alert the coordinator.
- Every blocked request is reviewed weekly by a human. We record the category, never the words.
- A coordinator can kill all sessions on site at any time, with no explanation required.
4. Conduct for staff and volunteers
Everyone signs a safeguarding and confidentiality commitment before touching the system. It requires:
- No private contact with children: no personal social accounts, no phone numbers, no one-to-one meetings.
- No photography, recording or screenshotting of children without written authorisation.
- Suspected abuse, neglect or exploitation reported within 48 hours to the safeguarding lead, who refers it to local authorities. The reporter's identity is protected.
- Breach means immediate removal from contact with children and handover to the partner.
5. No remote human contact
The device speaks to the cloud AI and to nobody else. There are no remote volunteers or teachers on the line, and no device-to-device calling. This removes a large safeguarding surface — and it concentrates all error correction on one person:
- The coordinator is mandatory. No device is used unless a coordinator is present in the room.
- When the system is unsure, it does not guess: it asks the child to repeat, or hands the question to the coordinator.
- The coordinator can end any session instantly, and reviews blocked requests weekly.
- Anything the system cannot handle safely is routed to a human on site, never to a stranger online.
We are explicit about the trade-off: removing humans removes the safety net that would otherwise catch a mis-recognised question. The coordinator is that net, and a site without one is not a site we will run.
6. Reporting and response
- Anyone may raise a concern, anonymously, with the safeguarding lead.
- The lead acknowledges within 24 hours and decides within 48 hours whether it is a safeguarding incident.
- Where a child may be at risk, the partner and the relevant authority are informed the same day.
- A written review follows within 7 days, plus a public summary that identifies no one.
- Zero incidents is reported as zero. We publish the number every month, including when it is zero.
7. What we refuse to do
- We do not place short-term international visitors in direct contact with children, however well-intentioned.
- We do not connect children by voice to remote volunteers or teachers, even where it would improve the experience.
- We do not run a site without a local partner who holds safeguarding responsibility.
- We do not keep children's voice recordings, even where it would improve the product.
- We do not use children's images or stories in fundraising without separate written consent.
- We do not continue a site after a serious incident is unresolved.
8. Contact
Safeguarding lead: liangz2210@gmail.com
This role is deliberately held by someone independent of delivery, so that a concern about the project itself can still be raised safely.
状态：草案。尚未经儿童保护专家与合作方复核。在双方签署确认之前，不开展任何现场活动。
1. 状态与范围
本政策约束协调员、工程人员、内容审核人员与合作方员工。它适用于每一台设备、每一次会话，以及每一个通过本项目接触儿童的成年人。
本政策与当地法律不一致时，取更严者；与合作方自身的儿童保护政策冲突时，以合作方为准。
2. 设备使用规则
- 设备归项目或合作方所有。第一阶段使用共享的中心式设备与传递式麦克风，不分配给任何儿童个人；后续若部署手持机，则编号绑定、存放中心、每日清点。任何设备都不随儿童带回家。
- 麦克风是儿童唯一直接接触的部件，由协调员负责每日清洁，并始终留在中心内。
- 仅在开放时段、且协调员在场时使用。
- 每台编号、借用签字。丢失须 24 小时内上报，并远程停用。
- 上限：单次 10 分钟、每人每日 40 分钟，由设备端强制执行。
- 无摄像头、无个人账户、不与儿童自有手机或账号配对。
3. 内容安全
- 双层机制：话题白名单 + 敏感词过滤。白名单按真实提问逐周补充，绝不开放自由对话。
- 涉及自伤、虐待、性内容或暴力的话题：立即中止、返回固定话术、向协调员告警。
- 每一次拦截都由人工每周复核。只记录类别，不记录原话。
- 协调员可随时一键中止现场全部会话，无需说明理由。
4. 人员行为规范
所有人在接触系统前须签署儿童保护与保密承诺，内容包含：
- 不与儿童建立私下联系：不加社交账号、不留个人电话、不单独见面。
- 未经书面授权，不拍摄、录制或截屏儿童影像与声音。
- 发现疑似虐待、忽视或剥削，须在 48 小时内报告儿童保护联络人，由其对接当地主管部门；报告人身份保密。
- 违反者立即停止接触儿童，并移交合作方处理。
5. 无远程真人接触
设备只与云端 AI 对话，不与任何真人通话：没有远程志愿者或老师在线，也没有设备间通话。这消除了很大一片儿童保护风险面——同时把全部纠错责任压到一个人身上：
- 协调员是强制项。协调员不在场，设备就不启用。
- 系统不确定时不猜：请孩子重复，或把问题交给协调员。
- 协调员可随时中止任一会话，并每周复核被拦截的请求。
- 系统无法安全处理的内容，一律转给现场的人，绝不转给线上的陌生人。
这个取舍我们说清楚：去掉真人，就去掉了那个本来能接住"听错了"的安全网。协调员就是那张网——没有协调员的站点，我们不运营。
6. 报告与响应
- 任何人可匿名向儿童保护联络人提出疑虑。
- 联络人 24 小时内确认收到，48 小时内判定是否构成保护事件。
- 若儿童可能处于风险中，当日通知合作方与相关主管部门。
- 7 天内出具书面复盘，并公开一份不指向任何个人的摘要。
- 零事件也要写零。这个数字我们每月公开，包括它是 0 的时候。
7. 我们拒绝做的事
- 不安排短期国际志愿者直接接触儿童，无论其动机多好。
- 不通过语音把儿童连接到远程志愿者或老师，即使那样体验更好。
- 不在没有在地合作方承担保护责任的情况下开展站点。
- 不留存儿童语音录音，即使留存能改进产品。
- 不在未取得单独书面同意的情况下，用儿童影像或故事做筹款。
- 不在严重事件未解决的情况下继续该站点。