This PR updates the Terms of Service and Privacy Policy so users must be 18 or over, child sexual abuse material (CSAM) is explicitly prohibited, and both documents say how we detect, preserve and report it. It's the legal groundwork for CSAM screening: matching images against known-CSAM lists, even in log-only mode, creates a duty to report, so the terms need to say this before any screening starts.

What changed

Terms of Service (both pages' "last updated" dates are now 29 October 2026):

• §2 Eligibility: the minimum age goes from 13 (under-18s with a parent's permission) to 18.
• §4.3 Content moderation: we still don't monitor content generally, but we may use automated tools, including hash-matching against known CSAM.
• §4.3 Child safety (new paragraph): zero tolerance. We remove the material, suspend the accounts involved without notice or refund, preserve related information we hold, and report to NCMEC, the Internet Watch Foundation or the National Crime Agency. This applies despite content handling, I/O logging and zero data retention promises. "Information we hold" covers zero data retention requests, where we never store content.
• §5 Prohibited use: a new first item covers uploading, generating, requesting, storing or distributing CSAM or content that sexualises minors, and building tools that produce it.

Privacy Policy:

• §3 Legal bases: a new purpose, detecting, preventing and reporting CSAM. Lawful basis: legal obligations and legitimate interests.
• §4 Sharing: a new item for child-safety reports to NCMEC, the IWF, the NCA or other law enforcement.
• §6 Retention: information preserved because of apparent CSAM is kept securely for up to a year, or longer where the law requires. This matches the US one-year preservation period.
• §8 Children: the service is for adults 18 and over only.

Why

• Phaseo accepts and returns images, and stores some (avatars, I/O logs). Providers such as Anthropic report CSAM matches against the account that sent them, which on managed traffic is ours.
• The old terms didn't mention CSAM and said we don't monitor content. That would conflict with the hash-matching we're adding.
• Allowing 13–17-year-olds risked bringing the UK Online Safety Act's children's safety duties into play for a developer API with almost no teenage users.

How

• Text is changed in all 9 full locales (en-GB, de-DE, fr-FR, es-ES, pt-BR, ar-SA, hi, ja, zh-Hans). en-US has no legal overrides, so it uses en-GB. The edits were made by one script so every locale gets the same structural change. The translations are mine and haven't been reviewed by a native speaker. There's no "the English version prevails" clause, so a lawyer may want to add one.
• The only new key is termsBody.childSafety, rendered under §4.3. The other additions are list items rendered with .map. Nothing reads these lists by index.

Before and after

Verification

• With main's apps/web and apps/docs plus these changes, every step of pnpm run validate:i18n passes: localisation validation, the message-scope self-test, client scopes, and the docs search check.
• All 9 locale files round-trip through JSON unchanged before editing, so the diff contains only the intended keys (+135 / −27).
• Not run locally: next build and the page render. They're left to CI and the Vercel preview.

Not legal advice

These are being published now, ahead of the screening work. A lawyer should still review them afterwards. Open points: whether the UK Online Safety Act applies to us, whether to add an English-prevails clause, and whether the age change needs notice to existing users.

Model: Claude Opus 5.5 (effort unknown) · Harness: Claude Code in T3 Code

🤖 Generated with Claude Code