How Savor protects teenagers

Store-led age assurance, where required

On a fresh install, Savor consults the platform's age service. Apple's age-range sheet appears only where Apple identifies a legally required check; Google Play supplies signals in the regions and accounts where its service applies.

Savor uses Apple's Declared Age Range or Google Play's Age Signals service. Savor never asks for a birth date or shows its own age question.

1. 1
   The store decides whether a check is required.

   A required verification or parental step cannot fall through to a Savor question or be bypassed inside the app.

2. 2
   A shared range is intentionally broad.

   Apple or Google Play can report under 13, 13–17, or 18+ without Savor receiving a birth date or identity document.

3. 3
   Store metadata stays out of Savor.

   Install identifiers, declaration methods, approval dates, and parental-control details are not written to Savor storage, analytics, logs, crash reports, support tools, API requests, or account records.

4. 4
   A store-reported under-13 range stops access.

   The under-13 band is not a valid server value, and Savor has no parent-managed under-13 account path.

5. 5
   Eligible accounts keep only minimal proof.

   When a range is shared, the device and account may retain 13_17 or 18_plus, the assessment time, and the policy version. Teen records expire after 365 days and require another store check.

6. 6
   No requirement and no range means no saved age.

   Savor opens without inferring that the person is an adult. Universal safeguards still apply, but age-specific controls cannot activate without a known band.

Teen AI output is checked before display

OpenAI's moderation endpoint checks Take action input separately from the model that writes the answer. That input check applies to every account and does not change when Savor uses Claude Sonnet 5.5 for the response.

For Take action, the authenticated Savor API reads the account's age-assurance record. A current 13–17 record selects the teen-safety route. A failed account-profile read, or a malformed or stale age record, also selects that safer route instead of silently weakening the protection.

OpenAI receives the finished Sonnet text and a stable, pseudonymous safety identifier created with a keyed one-way hash. Savor does not send the raw account ID for that purpose. This safety layer is enforced in the service path; it is not merely an instruction asking the model to behave.

A generated answer can be reported

Every visible Take action answer has a Report this answercontrol. The person selects one of six fixed reasons: dangerous or violent, sexual content, self-harm concern, hateful or harassing, incorrect or misleading, or another problem. There is no free-text box that could invite a teenager to disclose more personal information.

The client builds the evidence only from the model-written answer visible on the screen, capped at 4,000 characters. It leaves out the person's prompt, card, answers, history, and surrounding context. The authenticated API rejects unexpected fields, prevents duplicate submissions, and rate-limits the route.

Savor Support receives the answer, fixed reason, and the minimum account, intention, surface, and timing information needed to review it. Dangerous, sexual, and self-harm concerns enter the queue as high priority. The target is review by the next business day, not live or 24/7 monitoring. Evidence is not copied into application logs or sent to an AI provider. Reports expire after 90 days and account deletion removes them sooner, unless counsel approves a legal hold. If the request cannot be sent, no background report is queued on the phone—the panel stays available for a manual retry. This is not an emergency service.

Technical control map

This is the practical difference between a written safety promise and a guardrail in the product: each control below has an enforcement point and a defined failure behavior.

Private and low-pressure by design

Why this is personal to us

Our teenage son has ADHD, and he has genuinely enjoyed using Savor to help him throughout his day: putting a thought somewhere safe, seeing the next step, and spending less energy trying to hold everything in mind.

His experience is part of why we care about calm language, low-pressure design, clear choices, and privacy that does not depend on reading fine print. This is our family's experience, not evidence of a clinical outcome.

Limits, accountability, and what Savor is not

• Stores do not share an age range for every person. If the store reports no legal requirement and shares no range, Savor asks no age question and keeps no age band. Universal safeguards still apply, but Savor cannot activate age-specific controls or prevent every under-13 person from misrepresenting eligibility.
• No automated safeguard is perfect. Output screening reduces risk; it does not make every AI answer correct, suitable, or harmless.
• Savor is not a monitoring service. We do not provide live human review of every private card or conversation.
• Savor is not for children under 13. We do not offer parent-managed accounts or a consent path for under-13 use.
• 13+ is not a universal consent rule. We use store age signals, parental controls, disclosures, and country availability first. If a mandatory local exception cannot be enforced by the stores, teen availability or the affected feature may be restricted there.
• Savor is not medical care. It does not diagnose or treat ADHD or another condition, and it is not an emergency or crisis service.
• Sharing creates another copy. A card shared with another person can remain with that recipient after the original account is deleted.

Read the full children and teens privacy disclosure, or email support@savorapp.ai with a safety or privacy question.